What is the maximum fine for a GDPR breach?
There are two levels of GDPR fine:
Lower level of GDPR penalties
Fines of up to £8.7 million under the UK GDPR, €10 million under the EU GDPR or 2% of annual global turnover can be issued for infringements of articles:
- 8 (conditions for children’s consent);
- 11 (processing that doesn’t require identification);
- 25 – 39 (general obligations of processors and controllers);
- 42 (certification); and
- 43 (certification bodies).
Higher level of GDPR penalties
Fines of up to £17.5 million under the UK GDPR, €20 million under the EU GDPR or 4% of annual global turnover can be issued for infringements of articles:
Who gets the money from GDPR fines in the UK?
All fines collected by the ICO go to HM Treasury’s Consolidated Fund to be spent on health and social care, education, policing and justice, and the like.
The money collected from the annual data protection fee that data controllers must pay is used to fund the ICO’s work.
How are GDPR fines calculated?
GDPR fines are discretionary rather than mandatory. They must be imposed on a case-by-case basis and should be “effective, proportionate and dissuasive”.
Any fine you might receive will depend on:
- The type of infringement, how severe it was and how long it lasted;
- Whether it was deliberate or accidental;
- The action you took to reduce the damage to individuals (data subjects);
- Your security measures;
- Whether this is your first GDPR infringement;
- How cooperative you were when fixing the issue;
- The types of personal data involved;
- Whether you notified the supervisory authority yourself; and
- Whether you adhere to any approved codes of conduct or certification schemes.
Can an individual be fined under the GDPR?
Yes. The GDPR applies to the processing of personal data “wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system”.
It does not apply to processing carried out by individuals “in the course of a purely personal or household activity”.
How to avoid GDPR fines and penalties
How personal data is processed and secured is the very essence of the GDPR. This is reflected in the action that the ICO and the European regulators have taken since the Regulation took effect.
The vast majority of GDPR fines have related to violations of Articles 5, 6 and 32.
- Article 5 (data processing principles) states that personal data must be:
- Processed lawfully, fairly and transparently.
- Collected only for specific legitimate purposes.
- Adequate, relevant and limited to what is necessary.
- Accurate and, where necessary, kept up to date.
- Stored only as long as necessary.
- Processed in a manner that ensures appropriate security.
- Article 6 (lawfulness of processing) states that personal data can only be processed:
- If the data subject has given their consent.
- To meet contractual obligations.
- To comply with legal obligations.
- To protect the data subject’s vital interests.
- For tasks in the public interest.
- For the legitimate interests of the organisation.
- Article 32 (security of processing) requires data controllers and processors to implement “appropriate technical and organisational measures” to secure the personal data they process.
GRC Solutions has everything you need to help ensure your GDPR compliance, including:
- Demonstrating that you have a lawful basis for processing;
- Following the six data processing principles; and
- Implementing appropriate technical and organisational measures to keep personal data protected.
Useful external links
Achieve GDPR compliance with our all-in-one solutions
Whether you’ve just started your implementation project or are already on the way to compliance, our cost-effective solutions will help streamline your GDPR project.
Find out more
