Article 83 GDPR · EDPB Guidelines 04/2022
Estimate your maximum GDPR fine exposure.
Caps are the higher of €20M / 4% turnover (Art 83(5)) or €10M / 2% (Art 83(4)) — the tool shows a statutory ceiling and a published indicative starting interval. Final fines require an individual assessment; no fixed factor percentages are prescribed. Run your figures below.
Scenario inputs
Five-step EDPB methodology · Art 83 GDPR · ICO 2024 for UK
Article 83 GDPR · EDPB 04/2022 v2.1
Statutory ceiling and indicative starting interval
Statutory maximum
€10,000,000
The higher of the fixed cap and the applicable turnover percentage. This is a ceiling, not a predicted fine.
- Seriousness interval
- €1,000,000 to €2,000,000
- Starting interval
- €3,000 to €40,000
- Ceiling
- €10,000,000
Published indicative intervals, not a predicted fine. No midpoint is selected. The authority assesses seriousness and whether a turnover adjustment is appropriate; the final fine can fall outside this starting interval, up to the statutory maximum.
EDPB ¶71 rejects predetermined factor percentages. ICO Step 4 assesses each case. Neither guidance publishes fixed factor weights or a final ×0.6 / ×1.6 band. No final fine is calculated from these inputs, including when all factors are zero.
Official guidance: individual assessment, not fixed factor percentages
Calculation and limits
- 1.
Published seriousness interval — 10–20% of the statutory maximum: €1,000,000 to €2,000,000. The authority determines seriousness; no midpoint is selected.
- 2.
Published indicative turnover interval — 0.3–2% (2–10M turnover): €3,000 to €40,000. These endpoints describe the guidance's starting interval, not the final fine or a guarantee that this adjustment applies.
- 3.
Aggravating / mitigating: case-specific — EDPB ¶71 does not prescribe fixed percentages. ICO Step 4 requires individual assessment. These contextual inputs do not numerically adjust this calculation; seriousness factors must not be counted twice (EDPB ¶72).
- 4.
Statutory maximum — €10,000,000. This ceiling is not a prediction of a fine.
- 5.
Final fine: not calculated — EDPB Chapter 7 and ICO Step 5 require an individual proportionality assessment. Neither publishes a final ×0.6 / ×1.6 band.
Notes
- Limitation period: not assessed. No common EU/UK 60-month threshold is applied; applicable national time limits require separate assessment.
- Turnover-size step (0.3–2% (2–10M turnover), EDPB ¶65–66 / ICO Step 2 Table B) provides an indicative starting interval. The authority may depart from it; it does not limit the final fine.
Official legislation: no common EU/UK 60-month threshold is applied. National limitation periods are not assessed here.
How the GDPR fine cap works
The short answer (reviewed 2026-10-13): The calculator shows statutory caps and published indicative starting intervals from EDPB guidance adopted 24 May 2023 (v2.1 corrected 29 June 2023) or ICO 2024 guidance. No fixed factor weights or final multiplier band are prescribed by these methodologies; the final fine requires individual assessment and is not calculated. GDPR fines are capped at the higher of €20,000,000 or 4% of worldwide annual turnover for Article 83(5) infringements, and €10,000,000 or 2% for Article 83(4) (the “whichever is higher” rule). In the UK the caps are £17,500,000 / £8,700,000. But the actual amount is set by the Article 83(2) factors — gravity, intent, mitigation, cooperation, categories of data — built from a starting amount (a % of that maximum set by seriousness) that may then be reduced to a fraction of itself based on turnover (EDPB ¶65–66 / ICO Step 2): an undertaking with €2–10M turnover has an indicative 0.3–2% adjustment of the starting amount, not the headline cap.
Sources: Regulation (EU) 2016/679 Art 83 (EUR-Lex) · EDPB fining guidelines 04/2022 · ICO Fining Guidance (Mar 2024)
- Statutory tiers
- 2
- Cap rule
- Higher of
- Art 83(2) factors
- 11
- Methodology steps
- 5
EU vs UK methodology
Both regulators publish five-step methodologies. Statutory caps, currency and turnover adjustment ranges differ. The guidance supplies indicative starting intervals and allows the authority to adjust the starting amount for smaller undertakings — there is no fixed tariff (ICO ¶108).
| Threshold | EU (GDPR Art 83) | UK (ICO 2024) |
|---|---|---|
| Lower tier (Art 83(4)) | €10,000,000 or 2% turnover | £8,700,000 or 2% turnover |
| Upper tier (Art 83(5)) | €20,000,000 or 4% turnover | £17,500,000 or 4% turnover |
| Methodology | EDPB Guidelines 04/2022 v2.1 | ICO Fining Guidance, March 2024 |
→ Enter your turnover and seriousness level to see the statutory ceiling and indicative starting interval. The final fine is not calculated: EDPB ¶71 and ICO Step 4 require case-specific assessment, not fixed factor percentages.
Recent enforcement context
Historical amounts imposed, confirmed against official regulators on 2026-10-13. These do not establish payment or final judicial outcomes and are not used to calculate your result.
| Year | Regulator | Subject & article | Fine |
|---|---|---|---|
| 2023 | DPC (Ireland) | Meta Platforms Ireland Ltd — international data transfersArt 46(1) GDPR | €1,200,000,000 |
| 2022 | DPC (Ireland) | Meta Platforms — Instagram children's data exposureArt 5(1)(a),(c) · Art 6(1) · Art 12(1) · Art 25 | €405,000,000 |
| 2023 | DPC (Ireland) | TikTok Technology Ltd — children's dataArt 5(1)(a),(c),(f) · Art 24(1) · Art 25 · Art 12 · Art 13 | €345,000,000 |
| 2022 | ICO (UK) | Clearview AI Inc — biometric scrapingUK GDPR Art 5, 6, 9, 14 · DPA 2018Penalty £7,552,800 (May 2022). Quashed by the First-tier Tribunal on jurisdiction (Oct 2023); the Upper Tribunal found for the ICO on jurisdiction (Oct 2025) and remitted the remainder to the FTT — but has since granted Clearview permission to appeal that jurisdiction ruling to the Court of Appeal (Dec 2025); The ICO statement of 25 February 2026 reports an awaited Court of Appeal hearing. Subsequent UK appeal outcome UNKNOWN; no later official outcome located during the 13 October 2026 review; historical imposed amount, not a settled comparable. ICO update | £7,552,800 |
| 2024 | Autoriteit Persoonsgegevens (Netherlands) | Uber B.V. — driver data transfers to USArt 44 GDPR | €290,000,000 |
Source: official regulators (historical amounts checked 2026-10-13; methodology reviewed 2026-10-13).
Frequently asked questions
What is the maximum GDPR fine?
The higher of €20 million or 4% of total worldwide annual turnover of the preceding financial year for Article 83(5) infringements, and €10 million or 2% for Article 83(4). For an undertaking the percentage is calculated on group turnover, which is why “4% of turnover” can exceed the fixed cap for large companies.
Does the headline cap mean a small business pays €20 million?
No. The cap is a ceiling, not the expected fine. Both the EDPB (¶65–66) and the ICO (Step 2, Table B) allow the authority to reduce the starting amount to a fraction of itself based on turnover — an undertaking with €2–10M turnover is in the 0.3–2% band. These ranges are indicative: the authority may depart from them and the final fine may be higher or lower.
Which violations are upper tier (Art 83(5)) vs lower tier (Art 83(4))?
Upper tier (€20M / 4%): basic principles and lawfulness (Art 5, 6, 7, 9), data-subject rights (Art 12–22) and international transfers (Chapter V). Lower tier (€10M / 2%): security of processing (Art 32), breach notification (Art 33–34), DPIAs (Art 35) and processor obligations (Art 28). The calculator validates the pairing both ways.
How is the seriousness percentage decided?
The EDPB (¶60) and ICO (Step 1) set ranges as a percentage of the applicable maximum: low 0–10%, medium 10–20%, high 20–100%. There is no fixed tariff (ICO ¶108); the tool shows interval endpoints and does not choose a midpoint or determine the seriousness of your case.
What is the difference between the EU and UK calculations?
Both methodologies have five steps, but their turnover adjustment ranges differ. The statutory caps differ (£17.5M / £8.7M in the UK) and the currency is GBP. The UK turnover bands (ICO Table B) top out at £435M for the lower tier and £437.5M for the upper tier; the EU bands (EDPB ¶65–66) top out at €500M, above which no turnover adjustment applies.
Is this calculator legal advice?
No. It shows statutory ceilings and indicative starting intervals from public regulator guidance. Actual fines remain the supervisory authority’s discretion under Article 83(2), which weighs factors a calculator cannot fully model. Consult a qualified DPO or counsel before relying on any figure for board reporting or DPA correspondence.
Related EU compliance tools
- Digital Services Act (DSA) obligations checker — see which DSA duties apply to your platform or marketplace.
- EU AI Act risk classifier — classify an AI system into prohibited / high / limited / minimal risk.
- NIS2 entity scope check — check whether NIS2 cybersecurity obligations cover your entity.
- All SellerGuardrails EU seller compliance tools
Reducing the gaps that draw fines
Many GDPR penalties trace back to consent and privacy-notice gaps (Art 6/7) or records failures (Art 30). Consent-management platforms such as iubenda can help maintain a cookie banner and privacy policy. This is a third-party service, not an endorsement. This direct link is not an affiliate link; the separate sponsored link above carries an affiliate disclosure. Evaluate any tool against your own processing and your supervisory authority’s guidance.
Disclaimer
Results are orientative estimates derived from public regulator guidance. They do not constitute legal, tax, or financial advice. Consult a qualified Data Protection Officer or counsel before relying on any figure for board reporting or DPA correspondence.
Corrected official turnover ranges
EDPB ¶65–66: €2–10M: 0.3–2%; €10–50M: 1.5–10%; €50–100M: 8–20%; €100–250M: 15–50%; €250–500M: 40–100%. Quote: “0.3%”, “1.5%”, “8%”, “15%”, “40%”. EDPB v2.1, paragraphs 65–66.
ICO Table B, notes 89–91: “£435 million” (lower tier), “£437.5 million” (upper tier). ICO final guidance.
The tool shows the endpoints of the indicative starting interval; it does not choose a midpoint or calculate a final fine. The old factor weights, final band and common 60-month limitation threshold have no documented numerical derivation: UNKNOWN. Their inputs remain visible; no fine is calculated with them.