GDPR Maximum Penalty: €20M Fine or 4% of Turnover

The maximum penalty under GDPR is €20 million or 4% of a company’s total worldwide annual turnover from the preceding financial year, whichever amount is higher. For a large multinational, the turnover calculation is almost always the binding one, which is how single fines have reached into the hundreds of millions and past €1 billion. The fine is only part of what regulators can do, and a separate right lets individuals sue for their own compensation on top.

The Two Fine Tiers

GDPR splits penalties into two ceilings, depending on which part of the regulation was broken.

The lower tier applies to operational and procedural failures: not keeping proper records, failing to report a breach to regulators, skipping a required data protection impact assessment, or not appointing a data protection officer where one is required. These violations are capped at €10 million or 2% of total worldwide annual turnover, whichever is higher.¹

The upper tier covers the core substantive rules: processing personal data without a valid legal basis, collecting data without proper consent, ignoring someone’s right to have their data deleted, or sending personal data outside the EU without adequate safeguards. Those violations carry the maximum of €20 million or 4% of total worldwide annual turnover.²

Ignoring a direct order from a data protection authority sits in the same upper tier. If a regulator tells a company to stop processing or to comply with an individual’s rights and the company refuses, the €20 million or 4% ceiling applies again.²

The “whichever is higher” rule matters. A company earning €2 billion a year faces an upper-tier ceiling of €80 million (4% of turnover), not €20 million. A small business earning €200,000 a year faces the flat €20 million cap in theory, but 4% of its turnover would be €8,000, so the flat number is a meaningless limit in practice.¹

What “Worldwide Annual Turnover” Includes

The turnover figure is not limited to the subsidiary that broke the rules. GDPR borrows the concept of an “undertaking” from EU competition law, meaning the whole economic unit under common control. Recital 150 states directly that “undertaking” should be read in line with Articles 101 and 102 of the Treaty on the Functioning of the EU.³

In practice, a parent company and all its controlled subsidiaries are treated as one entity. When a regulator applies the 2% or 4% cap, it uses the consolidated revenue of the entire corporate group from the prior financial year. A European subsidiary’s violation can pull the global parent’s revenue into the calculation, even if that parent sits outside Europe.⁴

This is what makes the ceiling genuinely threatening for large multinationals. A company with $100 billion in global revenue faces a theoretical upper-tier ceiling of $4 billion, regardless of where the infringement occurred.

How Regulators Set the Actual Amount

The maximum is a ceiling, not a starting point. Article 83(2) lists eleven factors regulators must weigh when deciding where within the allowable range a fine should land.² The ones that move the number most:

Severity and duration of the breach. Millions of people affected over years pushes the fine up sharply; a handful of users affected briefly pulls it down.
Intent versus negligence. Deliberately ignoring the rules draws heavier penalties than an honest oversight.
The type of data involved. Health records, biometric data, and children’s data carry extra weight.
Mitigation. Fast action to limit harm, prompt notification to affected people, and cooperation with investigators pull the fine downward.
Prior track record. Repeat offenders pay more than first-time violators.
Financial benefit gained. If the company profited from the violation, regulators can factor those gains into the amount.

In 2023 the European Data Protection Board published binding guidelines that give regulators a five-step methodology: identify the processing operations involved, set a starting amount based on the seriousness of the violation, adjust for aggravating or mitigating factors, check the result against the legal maximum, and then verify the final figure is effective, proportionate, and dissuasive.⁵

The EDPB says calculating a fine “is no mere mathematical exercise.” The last step asks whether the number makes sense for the specific company in front of the regulator. A mechanically calculated fine could be crushing for a small business and trivial for a tech giant, and regulators have discretion to adjust in either direction so long as they stay under the legal ceiling.⁵

The Largest Fines Issued So Far

The upper-tier ceiling is not theoretical. The five largest GDPR fines as of early 2025:

Meta (Facebook), €1.2 billion in 2023. Issued by the Irish Data Protection Commission for transferring EU users’ personal data to the United States using standard contractual clauses without adequate safeguards. This is the largest GDPR fine to date.⁶
Amazon, €746 million in 2021. Luxembourg’s data protection authority penalized how Amazon processed personal data for targeted advertising without proper consent.
Meta (Instagram), €405 million in 2022. Ireland’s DPC over Instagram’s handling of children’s personal data.
Meta (Facebook and Instagram), €390 million in 2023. Another Irish DPC fine, this one for relying on an invalid legal basis to process personal data for behavioral advertising.
TikTok, €345 million in 2023. Ireland’s DPC found TikTok violated fairness, transparency, and data-minimization principles when processing data of users aged 13 to 17.⁷

Big Tech dominates the list because these companies process data at enormous scale, so violations are widespread by default. Ireland’s DPC issues a disproportionate share of the largest fines because many of these companies have their European headquarters there, making Ireland the lead supervisory authority.

Non-Financial Penalties

Fines get the headlines, but regulators have other tools that can hurt just as much. Under Article 58(2), a data protection authority can impose any of the following alongside or instead of a fine:⁸

Processing bans, either temporary or permanent. For a company whose business model depends on user data, this can be more damaging than any fine.
Orders to comply, forcing the company to honor data subject requests, bring processing into compliance by a specific deadline, or notify affected individuals of a breach.
Data deletion or rectification orders, including a requirement to notify anyone the data was shared with.
Suspension of data transfers outside the EU.
Withdrawal of approved data protection certifications.

Meta’s €1.2 billion fine came with an order to suspend data transfers to the United States. For a company built on transatlantic data flows, the suspension was arguably the more consequential half of the penalty.

Individual Compensation Claims

Administrative fines are paid to the government. Individuals who suffered actual harm from a GDPR violation can separately sue for compensation under Article 82, which covers both material and non-material damage.⁹

In 2023 the Court of Justice of the EU set out the requirements in the Österreichische Post case. A successful claim needs three things: a GDPR infringement, actual damage, and a causal link between the two. A bare violation is not enough on its own. The court also held that there is no minimum severity threshold for non-material damage, meaning even relatively minor distress can qualify for compensation.¹⁰

Where multiple companies are jointly responsible for the same processing, each one can be held liable for the full damages. The company that pays can then seek reimbursement from the others based on their share of responsibility. That joint liability rule keeps individuals from having to untangle corporate blame themselves.⁹

Criminal Penalties Are a Separate Matter

GDPR itself imposes only administrative fines. Article 84 tells each EU member state to add its own penalties for violations not already covered by the administrative fine framework, and many countries have layered criminal sanctions on top. Those national offenses typically target things like deliberately accessing personal data without authorization, obstructing an investigation, or knowingly giving false information to a regulator, and they can reach the individuals responsible, not just the company. The €20 million or 4% ceiling caps the administrative fine on the organization; criminal exposure under national law sits outside that ceiling.

Appealing a Fine

Any company or individual hit with a GDPR fine has a right to challenge it in court. Article 78 guarantees an effective judicial remedy against any legally binding decision of a supervisory authority.¹¹

Appeals have had mixed outcomes. Some fines are upheld in full, some reduced, and a few thrown out. The practical problem is that the process takes years, legal costs are substantial, and the fine typically needs to be paid or provisioned in the meantime. Judicial review still acts as a check on regulators, forcing them to document their reasoning and follow the EDPB’s calculation methodology carefully.

1
legislation.gov.uk. Regulation (EU) 2016/679 of the European Parliament and of the Council
2
General Data Protection Regulation (GDPR). GDPR Art. 83 – General Conditions for Imposing Administrative Fines
3
General Data Protection Regulation (GDPR). GDPR Recital 150 – Administrative Fines
4
Information Commissioner’s Office. The Concept of an Undertaking for the Purpose of Imposing Fines
5
European Data Protection Board (EDPB). Guidelines 04/2022 on the Calculation of Administrative Fines Under the GDPR
6
European Data Protection Board. 1.2 Billion Euro Fine for Facebook as a Result of EDPB Binding Decision
7
European Data Protection Board. Following EDPB Decision, TikTok Ordered to Eliminate Unfair Design Practices Concerning Children
8
General Data Protection Regulation (GDPR). Art. 58 GDPR Powers
9
GDPR-Info.eu. Art. 82 GDPR Right to Compensation and Liability
10
Court of Justice of the European Union. Judgment of the Court in Case C-300/21 – Osterreichische Post
11
General Data Protection Regulation (GDPR). Art. 78 GDPR Right to an Effective Judicial Remedy Against a Supervisory Authority