Calculate potential GDPR fines under EU Article 83's two-tier system, based on annual turnover, violation severity, data categories, and factors.
Assessment Factors (Optional)
You might also find these calculators useful
Estimate the financial impact of a data breach
Analyze compliance posture and identify gaps
Calculate risk severity scores using ISO 27001 and NIST frameworks
Assess ISO 27001 certification readiness
The EU General Data Protection Regulation (GDPR) imposes significant penalties for data protection violations. This calculator estimates potential fines based on Article 83's two-tier system, considering your organization's annual turnover, the nature of the violation, and key assessment factors that regulators use to determine final penalties.
A GDPR fine is an administrative penalty imposed by an EU data protection authority when an organization violates the General Data Protection Regulation. The regulation defines two tiers: less severe infringements can reach up to €10 million or 2% of global annual turnover, whichever is higher, while the most serious violations can reach up to €20 million or 4% of global annual turnover, whichever is higher. Authorities weigh factors such as the nature and gravity of the breach, negligence, and cooperation. This calculator estimates potential exposure by comparing the fixed cap against the turnover-based percentage and returning the larger figure.
A data protection officer estimates the maximum fine a company could face for a specific GDPR violation.
A manager compares potential penalty amounts against the cost of compliance measures to justify spending.
A legal team projects the likely fine range after a reportable breach based on turnover and severity factors.
A procurement lead gauges the regulatory penalty exposure tied to a processor before signing an agreement.
Quantify the potential financial impact of GDPR violations to inform risk management decisions and budget for compliance.
Identify which violations carry the highest penalties so you can focus compliance resources where they matter most.
Use concrete fine estimates to build business cases for data protection investments and demonstrate ROI to leadership.
Understand how factors like cooperation, notification timing, and mitigation actions can reduce potential penalties.
Tier 1 violations (up to €10M or 2% of global turnover) cover administrative requirements like record-keeping, data protection officer appointments, and certification body compliance. Tier 2 violations (up to €20M or 4% of global turnover) address core principles like lawful processing, consent, data subject rights, and international transfers.
Regulators consider 10 factors under Article 83(2): nature and gravity of infringement, intentional vs negligent conduct, mitigation actions, precautionary measures, prior history, cooperation with authorities, data categories affected, notification timing, certifications held, and any aggravating/mitigating circumstances.
Tier 2 covers violations of: basic processing principles (Articles 5, 6, 9), consent conditions (Article 7), data subject rights (Articles 12-22), and international data transfers (Articles 44-49). These are considered more severe as they go against the core privacy principles of GDPR.
Yes, proactive notification to supervisory authorities is specifically listed as a mitigating factor. Organizations that self-report breaches within the required 72-hour window and cooperate fully with investigations typically receive lower penalties than those discovered through complaints or audits.
GDPR applies to any organization processing EU residents' data, regardless of location. Fines are calculated on worldwide annual turnover of the entire corporate group, not just EU revenues. Non-EU companies can be fined and face enforcement through their EU representatives.
If multiple violations arise from the same processing operation, regulators fine for the most severe violation only, not cumulatively. However, separate incidents can result in separate fines. Repeat offenders face significantly higher penalties as history is a key assessment factor.