GDPR - Art. 83

GDPR Fine Calculator

Estimate the statutory cap and an indicative applied fine under GDPR Article 83 tiers.

The two tiers

Tier	Maximum (whichever is higher)	Covers, for example
Article 83(4)	EUR 10 million or 2% of worldwide annual turnover	Controller and processor obligations, including security of processing (Art 32), breach notification (Art 33-34), records and data protection by design
Article 83(5)	EUR 20 million or 4% of worldwide annual turnover	The basic principles, legal bases and consent, data subjects' rights, international transfers, and ignoring a regulator's order

Below EUR 500 million turnover, the fixed EUR 20 million sets the Article 83(5) ceiling; above it, 4% does. The Court of Justice confirmed in February 2025 (Case C-383/23, ILVA) that the percentage is based on the turnover of the whole undertaking, which usually means the group, not just the entity that broke the rules.

How regulators set the amount

The caps are ceilings. Authorities weigh the eleven factors in Article 83(2), including the nature, gravity and duration of the infringement, intent or negligence, steps taken to mitigate damage, previous infringements and cooperation. Since 2023 EU authorities follow the EDPB's Guidelines 04/2022 on calculating fines, which start from the seriousness of the infringement and the size of the company.

Security failures are fined too

A breach caused by weak security is an Article 32 infringement in its own right. In 2020 the UK regulator fined British Airways £20 million and Marriott £18.4 million for security failures. See GDPR Article 32, explained.

The calculator above applies the tier you choose to your turnover and shows an indicative range for the enforcement band you pick. It does not score the Article 83(2) factors, so treat the result as an order of magnitude.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Statutory cap: the higher of a fixed amount and a share of total worldwide annual turnover for the preceding financial year - EUR 10 million or 2% for Art 83(4) infringements, EUR 20 million or 4% for Art 83(5). The tool applies the tier you pick to the turnover you enter.
Indicative applied fine: a slice of that cap chosen by the enforcement band you pick - 0% to 1% of the cap for warning/low, 3% to 20% for mid, 20% to 100% for severe.
The colour follows the band (warning/low green, mid amber, severe red). The tool does not score the eleven Art 83(2) factors; it lists them so you can see what an authority weighs.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Warning / low band: 0%-1% of the cap
Mid band: 3%-20% of the cap
Severe band: 20%-100% of the cap

Worked example

The calculator run on its default inputs:

Annual global turnover (€ millions): €25 million
Violation tier: Art 83(5) - e.g. unlawful processing, consent, data-subject rights, transfers
Enforcement severity band: Mid - first enforcement, partial cooperation

Statutory cap (Art 83(5))

€20,000,000

Fixed ceiling: €20,000,000
4% of worldwide turnover: €1,000,000
Cap = higher of the two: €20,000,000
Indicative applied fine (Mid band): €600,000 - €4,000,000

With EUR 25 million turnover and an Art 83(5) infringement, 4% of turnover is EUR 1,000,000, below the EUR 20,000,000 fixed amount, so the cap is EUR 20,000,000. The mid band takes 3% to 20% of that cap: EUR 600,000 to EUR 4,000,000. Below EUR 500 million turnover the fixed EUR 20 million sets the Art 83(5) cap; above it, the 4% figure does.

Sources

GDPR Art. 83 - Regulation (EU) 2016/679 (EUR-Lex) - the fine ceilings in Art 83(4)-(5) and the Art 83(2) factors
EDPB Guidelines 04/2022 on the calculation of administrative fines - the method EU authorities follow to set a fine (final version adopted 24 May 2023)
CJEU, ILVA, Case C-383/23 (13 February 2025) - the percentage cap is based on the turnover of the whole undertaking, usually the group

Sources last checked September 2026.

Limitations

Authorities follow the EDPB guidelines, which start from the seriousness of the infringement and the size of the undertaking and then adjust for the Art 83(2) factors; the bands here are a rough stand-in for that method. The tool does not cover Art 83(6) (ignoring an order of the authority) or national rules on fining public bodies. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.