Fact · Voice privacy and security
20 millioneuros, or 4 percent of worldwide turnover
Breaches of the GDPR's core processing rules can be fined up to 20 million euros, or up to 4 percent of total worldwide annual turnover for an undertaking.
Checked against its source on October 17, 2026
In the source's own words
“administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year”
Art. 83 GDPR: General conditions for imposing administrative fines, gdpr-info.eu (Intersoft Consulting), 2016, Article 83(5).
Open the original- What it measures
- The higher tier of fines covers infringements of the basic principles and the rules on special category data, which include Article 9.
- What it does not show
- These are maximums. Regulators set the actual fine for each case under the factors in Article 83(2).