GDPR Fine Calculator

Yes. GDPR Article 83 applies to controllers and processors of any size. The statutory caps - the higher of EUR 10 million or 2%, and EUR 20 million or 4% of total worldwide annual turnover - are maximums, not thresholds, and supervisory authorities set the actual fine proportionately under Article 83(2). For a small or mid-sized organisation the absolute euro figure usually bites before the percentage, and most enforcement against smaller organisations involves far lower amounts - but the obligation and the exposure apply regardless of size.

No. The calculator estimates statutory maximum exposure and illustrative ranges. Supervisory authorities decide actual fines case by case using Article 83(2), EDPB methodology, national guidance, proportionality, aggravating factors, and mitigating factors.

No. The turnover value entered into the calculator is processed locally in the browser and is not sent to Acompli servers.

The Data Protection Commission (DPC) follows the European Data Protection Board's EDPB Guidelines 04/2022 on the calculation of administrative fines. The five-step method identifies the processing operations and Article 83 infringements, then sets a starting point on a seriousness scale (low, medium, high) using Article 83(2)(a), (b) and (g), adjusts for turnover so the fine is dissuasive for the undertaking, applies aggravating and mitigating factors under Article 83(2), and checks against the statutory caps in Article 83(4)–(6). The DPC's own published decisions — including the EUR 1.2 billion Meta Ireland Schrems II transfer decision (May 2023) — show this methodology applied in practice. UK estimates use the ICO's separate Data Protection Fining Guidance, which mirrors the structure but uses GBP caps and a UK turnover concept.

Treat the exposure number as a board-level discussion input, not a forecast. The Article 83(4)/(5) statutory caps give a hard ceiling — the higher of EUR 10m / 2% or EUR 20m / 4% of total worldwide annual turnover of the undertaking. From there, use the EDPB Guidelines 04/2022 seriousness scale and Article 83(2) factors (nature, gravity, duration, categories of data, mitigation, cooperation, prior history) to bracket a defensible range. The calculator above is intentionally an exposure estimator, not a prediction; the DPC and ICO both decide actual fines case by case after an inquiry. Records that reduce exposure — Article 30 RoPA, completed DPIAs, Schrems II Transfer Impact Assessments, breach logs — should be ready before any inquiry begins.

Since 1 January 2021 the UK ICO enforces the UK GDPR and Data Protection Act 2018 with sterling caps — GBP 8.7m or 2% (lower) and GBP 17.5m or 4% (upper) — under its Data Protection Fining Guidance. The DPC enforces the EU GDPR (Regulation 2016/679) with EUR caps under Article 83(4)–(6) and follows EDPB Guidelines 04/2022. For Ireland-headquartered groups, the DPC is the lead supervisory authority under the one-stop-shop, and concerned EU authorities can escalate to the EDPB Article 65 dispute-resolution procedure — which has raised DPC-proposed fines in cases such as Meta (Instagram, WhatsApp, Schrems II transfers). A UK-only breach is ICO territory; a cross-border EU/EEA breach by an Irish-established controller is DPC territory.

Article 83(4)–(6) GDPR refers to "total worldwide annual turnover of the preceding financial year" of "an undertaking." The EDPB Guidelines 04/2022 confirm the competition-law concept of an "undertaking" applies: the relevant turnover is the consolidated worldwide group turnover, not just the controller's legal entity. Court of Justice case law (Deutsche Wohnen, C-807/21) confirms supervisory authorities may apply the undertaking concept when calculating both the cap and the dissuasiveness adjustment. The calculator above uses the figure you enter — for a defensible board-level estimate, use the most recent consolidated group turnover from the parent undertaking's accounts.

Article 83(2) lists the aggravating and mitigating factors the DPC and ICO weigh. Records that demonstrate mitigation include: a current Article 30 Record of Processing Activities, completed Article 35 DPIAs (and Annex III AI-system documentation where relevant), Article 28 processor contracts and due-diligence files, Schrems II Transfer Impact Assessments, EDPB Guidelines 04/2022-aligned breach logs, prior remediation, evidence of cooperation with the supervisory authority, codes of conduct or certifications (Article 40/42), and the technical and organisational measures evidence required by Article 32. EDPB Guidelines 04/2022 explicitly call out cooperation, mitigation actions, and the manner in which the infringement became known as mitigating circumstances. Acompli's platform centralises these records so they can be produced quickly during a DPC or ICO inquiry.

Yes. Article 83(3) states that where a controller or processor intentionally or negligently infringes several GDPR provisions during the same or linked processing operations, the total fine cannot exceed the amount specified for the "gravest infringement." In practice this means a breach that touches both Article 32 security (lower tier, Article 83(4)) and Article 5 principles or Chapter V international transfers (upper tier, Article 83(5)) is capped at the upper-tier ceiling — EUR 20m / 4% of worldwide turnover. The DPC applied this approach in the Meta Schrems II transfer decision (May 2023), where multiple Chapter V infringements were assessed together under the upper-tier cap. EDPB Guidelines 04/2022 Section 4 sets out the methodology for grouping multiple infringements before the cap test.