GDPR Fines

What are the GDPR fines for non-compliance?

Multi-tiered approach to GDPR fines and penalties

General Data Protection Regulation has introduced a tiered approach to fines, meaning that the severity of the breach will determine the penalty. Within the GDPR, there are two ways how a penalty may be implemented against the company:

  • Through the acts of the data subjects (natural persons)
  • Through the acts of the supervisory agency.

Any person who has suffered material or non-material damage as a result of an infringement of this GDPR shall have the right to receive compensation from the controller or processor for the damage suffered (civil law claims).

Data subjects have the right to turn to the supervisory agency and lodge a complaint against a company, if they find that the company has used their data in a way, that is not compliant with the GDPR or the company does not fulfill the data subject’s rights (e.g.. right to be forgotten).

This will provoke the supervisory agency to investigate the company and if they find, that the company infringes the GDPR, they may fine the company. Estonian supervisory agencies have said, that taking account the severity of the infringement and the actions of the company, they will give firstly a formal notice and if the company will not change its policies, they will give a monetary fine. Of course, if the infringement is in a large scale, they will fine the company immediately and may impose other restrictions on the company, such as a ban on processing.

Furthermore, supervisory agencies may fine a company if they have not followed the GDPR rules.

Amounts of GDPR fines

1. The maximum fine a company can face is 4% of their annual global turnover, of €20 million, whichever is higher.

2. Less such as having improper records or failing to notify of any breaches, can be fined a maximum of 2% of their annual global turnover, or €10 million, whichever is higher.

However, the national legislators will introduce local fines for companies who have no global turnover.

In order to have proper records required in GDPR Article 30, there’s a solution like GDPR Register, which has easy to use templates and reporting, which is approved by local Data Protection Agency.

See the full contents of corresponding GDPR Article 83.

Ban on data processing

One of the powers, that a supervisory agency shall have with the GDPR is the power to put a temporary or definitive limitation on a company, including a ban on data processing. This means that if a supervisory agency finds that the data processing does not follow the GDPR, then they can limit the data processing and if they find that the company is not going to follow or is too out of line to comply with the GDPR, they can put a permanent ban on data processing. The ban and limitations do not exclude the GDPR fines.

Share on facebook
Share on google
Share on twitter
Share on linkedin
Share on pinterest
Share on print
Share on email

Try our GDPR Compliance Tool GDPR Register for 14-days.

No credit card required.

Latest Posts
Data Processing Agreement (DPA)

Data Processing Agreement (DPA)

It’s practically not possible to run a business without processing personal data and exchanging it with other businesses. It may...
Templates for Records of Processing Activities

Templates for Records of Processing Activities

As we see every day, most companies and organisations still keep their Records of Processing Activities in spreadsheets. Through our...
Web plug-in requires visitor’s consent

Web plug-in requires visitor’s consent

In the light of the recent ruling of the European Court of Justice, website owners have to bear in mind...
First GDPR fine issued in Lithuania

First GDPR fine issued in Lithuania

A year after GDPR came into force, the Lithuanian Data Protection Authority (VDAI) has issued its first administrative fine. UAB ‘Mister Tango’,...
Finnish DPA ordered a company to change their data processing practises

Finnish DPA ordered a company to change their data processing practises

An article was published recently in the Helsingin Salomat about the Finnish Data Protection Authority who had ordered a payment and...
Data Protection Officer’s role and responsibilities

Data Protection Officer’s role and responsibilities

In light of the latest survey conducted by the CPO Magazine, we are looking into the role of the Data...
GDPR Compliance Checklist for 2019

GDPR Compliance Checklist for 2019

Just recently, a report was published based on a survey of 252 global privacy professionals working for a wide range...
Records of processing activities in GDPR Article 30

Records of processing activities in GDPR Article 30

What do companies have to include in the records of processing activities? GDPR requires companies to keep an internal record,...
GDPR in B2B Marketing

GDPR in B2B Marketing

There are two separate EU level regulations to follow when processing personal data for direct marketing in B2B and B2C...
Data Protection Impact Assessment Guide

Data Protection Impact Assessment Guide

The General Data Protection Regulation (GDPR) has introduced a new obligation, which requires companies and organizations to carry out data...

Zpracovává vaše společnost osobní údaje?


Zpracovávat vaše společnost osobní údaje fyzických osob, jako jsou:

  • Údaje zaměstnanců, zákazníků, uchazečů o zaměstnání nebo pacientů včetně:
    • Jméno nebo osobní identifikační číslo
    • Kontaktní údaje (e-mailová adresa, telefonní číslo, adresa)
    • Bankovní údaje, plat, údaje o pasu nebo jiné osobní údaje

 

Ar Jūsų įmonė renka ir tvarko fizinių asmenų asmens duomenis? 


Asmens duomenys gali būti:

  • Kliento, darbuotojo. paciento, kandidato į darbo vietą ir kt. 
    • Vardas ar asmens  numeris 
    • Kontaktinė informacija (el.pašto adresas, telefono numeris, adresas ir kt)
    • Banko sąskaitos  duomenys, atlyginimo dydis, paso duomenys ar bet kokia kita asmeninė informacija. 

Onko yrityksessäsi enemmän, kuin 250 työntekijää?


Kas teie ettevõte kogub ja töötleb isikuandmeid?


Kas teie ettevõte kogub ja töötleb füüsiliste isikutega seotud andmeid nagu näiteks:

Töötajate, klientide, tööle kandideerijate, patsientide:

  • Nimi, isikukood
  • E-posti aadress, telefoninumber, kodune aadress
  • Pangakontonumber, palgasumma, krediitkaardiandmed või mõnda muut tüüpi isiklikud andmed

Does your company collect any personal data?


Does your company collect and process any personal data of natural persons such as:

  • Employees, Customers, Job Applicants or Patients including:
    • Name or personal ID number
    • Contact details (Email address, Phone number, Address)
    • Bank details, Salary amounts, Passport details or any other personal data