GDPR Penalty and Fine Calculator — Estimate Your Fine Exposure

GDPR fines can reach EUR 20 million or 4% of global annual turnover — whichever is higher. For non-EU businesses, understanding potential fine exposure is the first step toward taking compliance seriously. This guide explains how fines are calculated, enforced, and what your specific risk might be.

Two Tiers of GDPR Fines (Article 83)

Lower tier (Article 83(4)): Up to EUR 10 million or 2% of global annual turnover for violations of Articles 8, 11, 25-39, 41-43, and other administrative/technical requirements. This covers: failure to appoint a DPO (Article 37), inadequate data protection by design (Article 25), insufficient security measures (Article 32).

Upper tier (Article 83(5)): Up to EUR 20 million or 4% of global annual turnover for violations of core GDPR principles, data subject rights, cross-border transfer rules, or failure to appoint an EU Representative (Article 27). Note: not having an EU Representative falls in the upper tier.

How Fines Are Calculated

EU DPAs consider the following factors when determining fines (Article 83(2)):

• Nature, gravity, and duration: Was the violation intentional or negligent? How many data subjects affected?
• Number of data subjects: More subjects = higher baseline fine
• Categories of data: Special category data (health, biometrics) increases the multiplier
• Mitigating factors: Voluntary disclosure, cooperation, remediation — can reduce fines by up to 50%
• Aggravating factors: Previous violations, failure to respond to DPA inquiries — increase fines
• Turnover: 4% is calculated on the preceding fiscal year’s global annual turnover

Fine Exposure Example

A non-EU SaaS company with EUR 5 million annual turnover serving 10,000 EU users without an EU Representative: upper-tier violation (missing EU Rep) + potential data processing violations = maximum exposure of EUR 200,000 (4% of turnover). Realistic first-offense reduction could bring this to EUR 20,000-50,000. Compare to EUR 490/year for an EU Representative.

GDPR Enforcement Trends

Through 2024-2026, EU DPAs have issued over EUR 5 billion in total fines, with increasing focus on mid-market non-EU companies. The trend is clear: regulators are moving beyond Big Tech. Full enforcement timeline →

Get your EU Rep from EUR 490/year →