Articles 83 & 84 GDPR : Criteria and Statutory Ceilings for Administrative Fines

The Two Tiers of Administrative Fines (Arts. 83(4) & 83(5) GDPR)

Article 83 establishes two tiers of maximum administrative financial penalties calculated on the total worldwide annual turnover of the preceding financial year of the undertaking (economic concept of an undertaking under Articles 101 and 102 TFEU):

• Tier 1 (Art. 83(4)) — Up to €10,000,000 or 2% of total worldwide annual turnover: Infringements of governance and security obligations (Privacy by Design Art. 25, processor contracts Art. 28, records Art. 30, security Art. 32, breach notification Arts. 33-34, DPIA Arts. 35-36, DPO appointment Arts. 37-39);
• Tier 2 (Art. 83(5)) — Up to €20,000,000 or 4% of total worldwide annual turnover: Infringements of core principles (Art. 5), legal grounds (Art. 6), sensitive data (Art. 9), data subjects' rights (Arts. 12 to 22), or international transfer rules (Arts. 44 to 49).

Harmonised Methodology for Calculating Fines (EDPB Guidelines 04/2022)

In accordance with EDPB Guidelines 04/2022, supervisory authorities apply a harmonised five-step methodology to determine the final amount of the administrative fine:

• Step 1: Identifying the processing operations and classifying the established infringements;
• Step 2: Determining the starting amount based on the gravity of the infringement (low, medium, high) and the turnover/economic size of the undertaking;
• Step 3: Evaluating aggravating and mitigating circumstances (Art. 83(2));
• Step 4: Verifying compliance with statutory legal maximum ceilings (Arts. 83(4) and 83(5));
• Step 5: Final assessment of whether the total fine is effective, proportionate and dissuasive.

Verified Official Sources

See Also in the Legal Framework