GDPR Data Breach Fine Estimator

GDPR splits violations into two severity tiers under Article 83. Lower tier violations, things like inadequate record-keeping or missing a breach notification deadline, cap at 10 million euros or 2 percent of global annual turnover, whichever figure is higher. Higher tier violations, which cover core failures like processing personal data without a lawful basis or ignoring a data subject's rights, cap at 20 million euros or 4 percent of global annual turnover. That turnover figure is worldwide revenue for the entire corporate group, not just revenue earned inside the EU, which is why the fine exposure for a large multinational can run into the hundreds of millions even for a single incident.

Within that statutory ceiling, the assigned data protection authority has wide discretion. It weighs the nature and duration of the violation, the number of people affected, whether the data involved was sensitive, and how the company behaved once the violation came to light. This calculator applies those same inputs to move from a bare percentage cap toward a number that reflects how enforcement actually works.

The 2 percent and 4 percent figures get quoted constantly, but they describe a ceiling, not a typical outcome. Regulators size a fine to be effective, proportionate, and dissuasive for the specific facts in front of them, and in practice that produces numbers far smaller than the theoretical maximum. Some of the largest GDPR fines ever issued illustrate this clearly.

• British Airways was initially facing a fine close to the statutory maximum before the final penalty was reduced to a fraction of that figure.
• Marriott's fine followed a similar pattern, settling well under the 4 percent ceiling despite the scale of the breach.
• H and M and TIM, two of the largest fines issued by European regulators, also landed at roughly 3 to 4 percent of each company's theoretical maximum exposure rather than the full cap.
• Across these and other large enforcement actions, self-reporting, cooperation, and swift remediation were consistently cited as reasons the final fine sat well below the statutory ceiling.

This is exactly why the calculator's realistic fine estimate exists alongside the statutory maximum. Quoting only the maximum overstates real exposure for most companies, especially smaller ones with turnover under a few million dollars, where the calculated maximum is often the flat euro floor rather than the percentage figure at all.

A GDPR violation is any failure to meet an obligation set out in the regulation, which is broader than most people assume. A personal data breach specifically means an accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. Both can trigger a fine, but a breach additionally triggers a notification obligation: controllers generally must notify their supervisory authority within 72 hours of becoming aware of a breach that risks the rights and freedoms of the people affected, and must notify those individuals directly when the risk is high.

Scale and sensitivity both move the needle on severity. A breach affecting a few hundred people is treated very differently from one affecting hundreds of thousands, and special category data, meaning health records, biometric identifiers, genetic data, or information about a child, pushes a violation toward the higher end of the severity scale regardless of how many records were involved. This calculator's data subjects affected and special category data inputs exist because both factors are explicitly called out in the EDPB's own guidance on setting fine amounts.

Beyond the statutory tier, a handful of factors consistently move a real GDPR penalty up or down, and this calculator's inputs mirror them directly.

None of these factors operate in isolation. A company that self-reports an intentional violation still faces a materially higher penalty than one that self-reports simple negligence, and a company with strong encryption and access controls in place going into an incident is treated more leniently than one with none, even when the breach itself was identical in scale. The realistic fine estimate this calculator produces combines all of these inputs at once, the same way a regulator's own severity assessment does.

A data breach and a breach notification failure are two separate things a regulator can penalize. Article 33 requires a controller to notify its supervisory authority within 72 hours of becoming aware of a breach that risks people's rights and freedoms, and to notify the affected individuals directly when that risk is high. Missing the 72-hour window, understating the scope of a breach, or failing to notify at all is treated as its own aggravating factor layered on top of whatever caused the breach in the first place.

This is where the self-reported input in this calculator does most of its work. A company that meets its notification obligation and comes forward voluntarily is, in practice, treated meaningfully better than one a regulator discovers through a complaint, a journalist, or a competitor. Combined with full cooperation once an investigation opens, timely notification is one of the few factors within a company's control after a breach has already happened, which is why it moves the realistic fine estimate down rather than the statutory maximum, which stays fixed regardless of how the company responds.