The General Data Protection Regulation (GDPR) gives EU data protection authorities a range of powers when an organization infringes it. These include warnings, reprimands, orders to bring processing into line, temporary or permanent bans on processing, and administrative fines, alone or alongside other measures. People who suffer damage caused by an infringement can claim compensation.
Administrative Fines
The GDPR sets two maximum fine levels, depending on the provision infringed:
- Up to €10 million or, for an undertaking, up to 2% of its total worldwide annual turnover in the preceding financial year, whichever is higher. This level covers obligations such as data protection by design and by default, records of processing, security of processing and notification of personal data breaches.
- Up to €20 million or up to 4% of total worldwide annual turnover, whichever is higher. This level covers the basic principles for processing (including the conditions for consent), data subjects’ rights, international transfers of personal data and failure to comply with an authority’s order.
These are maximums. Each fine must be effective, proportionate and dissuasive. Authorities consider factors including the nature, gravity and duration of the infringement, whether it was intentional or negligent, steps taken to reduce harm, previous infringements, cooperation with the authority and the categories of personal data affected.
Fines are not automatic. In Deutsche Wohnen (C-807/21, December 2023), the EU Court of Justice held that a fine may be imposed only where an infringement was committed intentionally or negligently. That includes cases where the organization could not have been unaware that its conduct was infringing. Where the organization is part of an “undertaking” in the EU competition-law sense, meaning a single economic unit that may consist of several companies, the maximum fine is calculated on the turnover of that undertaking as a whole.
Examples of GDPR Fines
1. Google: €50 million (France, 2019)
In January 2019, France’s data protection authority, the CNIL, fined Google LLC €50 million for a lack of transparency, inadequate information and the lack of valid consent for ad personalization, in a case concerning Android users.
2. British Airways: £20 million (UK, 2020)
In October 2020, the UK Information Commissioner’s Office (ICO) fined British Airways £20 million under the GDPR, which then applied in the UK, for failing to put appropriate security measures in place, after an attacker potentially accessed the personal data, including payment card details, of approximately 429,612 people.
3. Marriott International: £18.4 million (UK, 2020)
Also in October 2020, the ICO fined Marriott International £18.4 million for failing to keep personal data secure, following a cyber-attack on the systems of the Starwood hotel group that began in 2014. Marriott estimated that 339 million guest records worldwide were affected.
Cookie Fines Under ePrivacy Rules
Cookie consent rules come mainly from national laws implementing the EU ePrivacy Directive, and authorities can impose fines under those laws too. In September 2025, the CNIL fined Google a total of €325 million under French rules, for displaying advertisements between Gmail users’ emails without consent and for placing advertising cookies without valid consent when users created Google accounts.
Compensation and Reputation
Anyone who suffers material or non-material damage because of a GDPR infringement has the right to compensation from the controller or processor. Infringements can also damage an organization’s reputation and the trust of its customers.
Conclusion
GDPR fines can reach €10 million or 2% of worldwide annual turnover, or €20 million or 4%, depending on the provision infringed. They are decided case by case, require intent or negligence, and sit alongside other corrective powers.
This article is general information, not legal advice.