Why use this calculator
Data protection is the rare compliance area where the theoretical penalty is large enough to threaten the business itself, and that headline figure is quoted so often that it has stopped conveying anything useful. Almost no organisation is ever fined four per cent of turnover.
Regulators work through the factors in Article 83(2), and the fines actually issued to mid-sized companies are typically a fraction of a per cent of turnover. This calculator models that gap, giving both the statutory maximum and a realistic working estimate, so a privacy budget can be argued against a credible number rather than a headline that finance will discount. It also prices the two levers you genuinely control: reporting within seventy-two hours, and not being a repeat offender.
How to use it
- Start by choosing the regime, which depends on where your affected data subjects are rather than where you are based, and note that the turnover you enter should be in that regime's own currency.
- Enter worldwide group turnover for the preceding financial year, since the percentage cap applies at group level rather than to the entity that made the mistake.
- Enter how many individuals were affected, then pick the severity band that matches the facts, weighing whether the conduct was negligent or deliberate and whether sensitive categories of data were involved.
- Record whether you notified the regulator within seventy-two hours and cooperated, then enter any enforcement action taken against you in the last five years.
What each result means
- Estimated fine
- A working figure derived from observed enforcement patterns. Use it for budgeting and board reporting, never as a prediction of what a regulator will actually do.
- Saving from full mitigation
- The difference that full mitigation makes to this estimate: prompt notification, cooperation with the regulator and fixing the cause. If you already chose full mitigation, it shows what doing nothing would have added.
- Statutory maximum
- The legal ceiling for the most serious category of infringement. Reaching it requires deliberate, large-scale wrongdoing with no cooperation whatsoever.
- 4% of turnover
- The percentage limb of the cap, applied to worldwide group turnover. For large groups this is far higher than the fixed ceiling and is the operative limit.
- Fixed ceiling
- The absolute figure in the regulation, €20 million or £17.5 million. It governs for smaller organisations where 4 per cent of turnover is the lower number.
- Estimate as a share of turnover
- The estimate as a percentage of revenue. Most published fines against mid-sized firms sit well under one per cent, which is the useful reality check.
- Cost per data subject
- The regulatory cost of each affected individual. It excludes compensation claims, which individuals can bring on top of any fine.
- Mitigation applied
- The effect of notifying within 72 hours and cooperating. This is the single largest factor you still control once a breach has happened.
- Repeat infringement loading
- The uplift for prior enforcement. Regulators treat a repeat infringement as evidence that earlier action failed to change behaviour.
- Currency
- Which regime and currency the figures are expressed in. No exchange rate is applied, so enter turnover in the currency shown here.
The formula
Statutory maximum = the higher of 4 per cent of worldwide annual turnover or the fixed ceiling, which is €20 million under EU GDPR and £17.5 million under UK GDPR
The working estimate starts at a share of turnover set by severity, being 0.4 per cent for minor, 1.2 per cent for significant and 2.8 per cent for major. That is scaled by the number of data subjects, from 0.6 at none to 1.0 at 250,000 or more, then multiplied by a mitigation factor of 0.7 for full self-reporting, 0.9 for partial and 1.15 for none, and by a repeat infringement loading of 15 per cent per prior action up to five. The result is capped at the statutory maximum.
How this number is used in practice
Article 83 sets two tiers. The lower tier, covering obligations such as records of processing, processor contracts and breach notification itself, is capped at two per cent of turnover or ten million euros. The upper tier, which this calculator models, covers the core principles, the lawful basis for processing, data subject rights and international transfers, and is capped at four per cent or twenty million.
Almost every large fine reported publicly sits in the upper tier, and most concern either a missing lawful basis for advertising or a transfer mechanism found inadequate, rather than a security breach.
Notification within seventy-two hours is where the practical work lies. The clock runs from awareness rather than from the incident, and awareness is judged objectively, so a report sitting unread in a security inbox can start it. Organisations that meet the deadline, document their reasoning and cooperate are consistently treated more leniently, while those that delay find the delay itself becomes a separate infringement. Every incident response plan should name who decides, by what time, and on what evidence.
A fine is rarely the largest cost. Individuals affected by an infringement can claim compensation for material and non-material damage, including distress, and group claims are increasingly organised in both the UK and EU. Add breach notification to affected individuals, forensic investigation, remediation and the cost of any regulatory order requiring you to change or stop a processing activity, and the indirect costs frequently exceed the penalty itself. A regulator that orders a suspension of processing can halt a revenue line entirely.
Worked examples
A company with €40m turnover, 50,000 data subjects affected, a significant breach, self-reported
Estimated fine of €228,480, or 0.57 per cent of turnover, against a statutory maximum of €20 million
The same breach where the regulator found out independently and there were two prior actions
The estimate rises to £487,968, more than doubling on the mitigation and repeat-offender factors alone
A £900m turnover group with a major breach affecting 2 million people and no self-report
An estimate near £28.98 million, below the £36 million statutory maximum set by the 4 per cent cap
When people use it
- Building a business case for data protection investment with a credible rather than headline number
- Preparing a board-level risk register entry for data protection exposure
- Quantifying residual risk in a Data Protection Impact Assessment
- Weighing the cost of a compliance programme against realistic penalty exposure
- Modelling how much self-reporting within 72 hours is worth after an incident
Tips
- Notify within 72 hours of becoming aware. The clock runs from awareness, not from the incident, and late notification is a separate infringement.
- The percentage cap applies to worldwide group turnover, not the turnover of the entity that made the mistake.
- Keep records of processing and impact assessments current. Their absence is itself an infringement and evidence of poor governance.
- Fines are only part of it. Individuals can claim compensation for distress, and group claims are becoming routine.
- A corrective order suspending a processing activity can cost far more than the fine attached to it.
- UK and EU regimes now diverge on detail. If you serve both markets, check obligations separately rather than assuming they match.
What it assumes, and where it stops being accurate
- Models the upper tier under Article 83(5). Lower-tier infringements are capped at 2 per cent of turnover or €10 million instead.
- No currency conversion is applied. Turnover must be entered in the currency of the regime selected, since fines are imposed in that currency.
- The estimate is derived from observed enforcement patterns, not from any published regulator formula. Actual outcomes vary widely on identical facts.
- Excludes compensation claims brought by individuals, which are separate from and additional to any regulatory fine.
- Excludes the cost of a corrective order, such as a ban on processing, which can be far more damaging commercially than the fine.
- Assumes a single infringement. Regulators may treat linked failings as several infringements, though the total is capped at the highest applicable maximum.
Terms used on this page
- Article 83
- The GDPR provision setting the two tiers of administrative fine and the factors regulators weigh.
- Data subject
- An identified or identifiable living individual whose personal data is being processed.
- Supervisory authority
- The national regulator enforcing GDPR, such as the ICO in the UK.
- Undertaking
- The single economic unit whose worldwide turnover sets the percentage cap, usually the whole group.
- Corrective order
- A regulatory direction to change, limit or stop processing, often costlier than the fine itself.
Questions people ask
- What is the difference between Article 83(4) and 83(5) fines?
- Article 83(4) covers administrative obligations such as records of processing and processor contracts, capped at two per cent of turnover or ten million euros. Article 83(5) covers the data protection principles, lawful basis, data subject rights and international transfers, capped at four per cent or twenty million. This calculator models the upper tier.
- Does the fine apply to my company or the whole group?
- The percentage cap is calculated on the worldwide annual turnover of the whole undertaking, which regulators interpret using competition law concepts of a single economic unit. A small subsidiary of a large group is therefore exposed to a cap based on group turnover, not its own.
- Does GDPR apply to companies outside the EU?
- Yes, where you offer goods or services to people in the EU or monitor their behaviour there, regardless of where you are established. The UK GDPR applies on equivalent terms for the UK. Organisations serving both markets are subject to both regimes at once.
- Has anyone actually been fined the maximum?
- No regulator has imposed the full four per cent of worldwide turnover. The largest fines to date have been very substantial in absolute terms but still well short of the theoretical ceiling, and the overwhelming majority of enforcement actions are reprimands and orders rather than significant financial penalties.
- Does self-reporting really reduce the fine?
- It is an express mitigating factor under Article 83(2), alongside cooperation and the technical measures you had in place. Enforcement decisions consistently treat prompt notification and candour as reducing the penalty, while delay or attempts to minimise an incident are treated as aggravating.
- How do UK and EU maximums differ?
- The structure is identical but the fixed ceilings differ in currency and amount: €20 million under EU GDPR and £17.5 million under UK GDPR for upper-tier infringements. Both sit alongside the same four per cent of worldwide turnover limb, and the higher of the two applies.
Use this with
GDPR Fine Risk Calculator answers one part of the question. These pick up where it stops: Litigation Cost Estimator, Employment Tribunal Cost Estimator, Discrimination Compensation Calculator and Unfair Dismissal Compensation Calculator.
Where these figures come from
Figures and rules on this page follow United Kingdom law.
- Regulation (EU) 2016/679, Article 83. The two fine tiers, the ceilings and the factors weighed in setting a penalty
- European Data Protection Board: guidelines on calculating fines. The harmonised methodology supervisory authorities apply
- ICO: Data protection fining guidance. UK GDPR maximums and the ICO's approach to penalties
- Data Protection Act 2018. The UK GDPR ceiling of £17.5 million and UK-specific provisions
GDPR Fine Risk Calculator produces an estimate for general information. It is not financial, tax, medical, legal or engineering advice. read the full disclaimer. Spotted a wrong number? Report it and it gets fixed. The form picks up this calculator and the inputs you used.