GDPR Article 83 sets two ceilings. The lower tier is up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. The upper tier is up to 20 million euros or 4 percent. These are maximums, not standard penalties.
What falls in the lower tier
Article 83(4) covers, among others, controller and processor obligations under Articles 8, 11 and 25 to 39, and the certification and monitoring body obligations. In everyday terms that includes:
- Data protection by design and by default (Article 25).
- Joint controller arrangements and processor contracts (Articles 26 to 28).
- Records of processing (Article 30).
- Security of processing (Article 32).
- Breach notification (Articles 33 and 34).
- Impact assessments (Article 35) and data protection officers (Articles 37 to 39).
What falls in the upper tier
Article 83(5) covers:
- The basic principles of processing, including the conditions for consent (Articles 5, 6, 7 and 9).
- Data subjects' rights (Articles 12 to 22).
- Transfers to third countries (Articles 44 to 49).
- Non compliance with an order or temporary limitation from a supervisory authority.
So mishandling an access request or transferring data without a valid mechanism sits in the higher band.
"Whichever is higher" for undertakings
For a company, the cap is the higher of the fixed amount and the percentage of total worldwide annual turnover of the preceding financial year. For a small firm the fixed amount is the cap that matters. For a large group, the percentage can be much bigger.
What the authority weighs
Article 83(2) lists factors, including:
- The nature, gravity and duration of the infringement, and the number of people affected and damage suffered.
- Whether it was intentional or negligent.
- Steps taken to reduce the harm.
- The degree of responsibility, including technical and organisational measures under Articles 25 and 32.
- Previous infringements.
- Cooperation with the authority.
- The categories of personal data affected.
- How the authority found out, including whether you reported it.
- Adherence to approved codes of conduct or certification.
What you can do with that list
Treat the factors as a checklist of evidence worth having before anything goes wrong: documented security measures, a rehearsed breach process, a record of training, and a habit of reporting promptly. None of that guarantees a lower fine, since each case is decided on its facts. But it is the material the law tells the authority to weigh.
Quick check
Is every breach fined at the maximum?
No. The text sets ceilings and a list of factors, and the authority decides case by case.
Do fines apply to processors too?
Yes. Article 83(4) refers to the obligations of the controller and the processor.
Sources
Last reviewed: 19 October 2026.
