Article 83 sets maximum fine ceilings, not a tariff. The authority identifies the infringement, assesses its seriousness and the undertaking's turnover, applies aggravating or mitigating factors, checks the legal maximum, and tests the result for effectiveness, proportionality, and deterrence.
Use this guide to map the GDPR tier, CJEU fault condition, EDPB calculation steps, Article 58 corrective powers, and evidence for the individual case.
Structured answer sets in this page tree.
Cited legal and guidance references.
A GDPR cannot be predicted from the EUR 10 million or EUR 20 million headline alone. Article 83 sets two legal ceilings and case-specific factors. The EDPB's final Guidelines 04/2022 provide a five-step calculation method, while the CJEU requires an intentional or negligent infringement before an Article 83 fine may be imposed. Article 58 also allows non-monetary corrective measures that may be imposed instead of or alongside a fine.
First identify each infringement and the conduct from which it arises, then identify the applicable legal maximum. Article 83(4) covers several operational obligations, including controller and processor duties in Articles 8, 11, 25 to 39, certification duties, and monitoring-body duties. That tier can reach EUR 10,000,000, or for an undertaking, 2 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
Article 83(5) covers higher-tier infringements: basic processing principles and consent conditions, data-subject rights, international-transfer rules, certain Member State law obligations under Chapter IX, and non-compliance with Article 58 access, limitation, suspension, or order powers. Article 83(6) also puts non-compliance with a supervisory-authority order in the higher tier. The higher tier can reach EUR 20,000,000, or for an undertaking, 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
The EDPB's final Guidelines 04/2022 explain a common calculation method for supervisory authorities. The Guidelines do not replace Article 83 or produce an automatic amount. The facts of the case and national procedural law still matter.
The method first identifies the processing operations and sanctionable conduct, including whether conduct gives rise to one or several infringements. It then selects a starting point using the nature of the infringement, its seriousness, and the undertaking's turnover. The authority adjusts for aggravating and mitigating circumstances, identifies the applicable legal maximum, and checks whether the resulting fine is effective, proportionate, and dissuasive.
Article 83(2) requires the supervisory authority to consider the circumstances of the individual case when deciding whether to impose a fine and when setting the amount.
In Deutsche Wohnen, C-807/21, the CJEU held that an Article 83 fine may be imposed only where it is established that the controller intentionally or negligently committed an infringement. A legal person can be fined directly as controller without first identifying an infringement by its management body. When the fine is imposed on a controller that forms part of an undertaking, the CJEU held that the percentage-based maximum is calculated using the turnover of the undertaking as a whole under the EU competition-law concept.
In ILVA, C-383/23, the CJEU distinguished the statutory maximum from the amount imposed in the individual case. Article 83(2) factors characterise the controller's or processor's conduct and the infringement, but the authority may also consider whether the addressee forms part of an undertaking when assessing its actual or material economic capacity and whether the amount is effective, proportionate, and dissuasive.
Do not treat an as the only enforcement result. Article 58 gives supervisory authorities investigative powers, corrective powers, and advisory or authorization powers. Article 83 says fines may be imposed in addition to, or instead of, several Article 58 corrective measures depending on the individual case.
For response planning, the most disruptive Article 58 outcomes may be non-monetary: an order to comply, a temporary or definitive processing limitation, a processing ban, an erasure or restriction order, a breach-communication order, or suspension of data flows.
The evidence file should prove the Article 83 factors, not merely assert compliance. Build it around the processing operation, the controller or processor role, the affected data categories, the specific infringement question, and the corrective steps taken.
The cited sources support accountability evidence for controllers and processors: Article 5(2) requires controllers to be able to demonstrate compliance, Article 24 requires appropriate technical and organisational measures that are reviewed and updated where necessary, Article 31 requires cooperation with supervisory authorities, and Article 83 applies administrative-fine tiers to controller and processor obligations where relevant.
No. Article 83 sets maximum ceilings, not fixed penalties. The authority assesses the individual case, and the EDPB method considers the conduct, seriousness, undertaking turnover, aggravating and mitigating factors, legal maximum, and whether the final amount is effective, proportionate, and dissuasive. The CJEU also requires an intentional or negligent infringement before an Article 83 fine may be imposed.
Yes. Article 58 allows warnings, reprimands, compliance orders, processing limits or bans, erasure or restriction orders, breach-communication orders, certification withdrawal, fines, and suspension of data flows. Article 83 also treats compliance with earlier Article 58 measures on the same subject matter as a fine-assessment factor.
No. Article 58 corrective measures can apply instead of or alongside a fine. Article 82 separately allows compensation for material or non-material damage caused by an infringement, subject to its conditions, and Article 84 requires Member States to lay down rules for other penalties. National procedure, appeals, and public-authority rules must be checked in the relevant Member State.
Use a conduct-level worksheet rather than multiplying the number of cited GDPR provisions by a headline maximum. For each processing operation, identify the controller or processor, the facts, the infringed provision, the Article 83 tier, the evidence of intent or negligence, the Article 83(2) factors, and any Article 58 measure already issued.
Concurrence matters. Article 83(3) caps the total fine for intentional or negligent infringements arising from the same or linked processing operations at the maximum for the gravest infringement. The EDPB method still requires the authority to identify all infringements and decide which conduct is separately sanctionable before applying that cap.
: a monetary Article 58 corrective measure calculated under Article 83. It is case-specific, uses a legal ceiling rather than a tariff, and remains separate from compensation, national penalties, and non-monetary orders.
Supervisory authority: an independent Member State authority with Article 58 investigative and corrective powers. Cross-border cases require a separate competence and cooperation analysis rather than an assumption that one authority always acts alone.
Undertaking: the EU competition-law economic unit used for the percentage-based maximum and, where appropriate, the addressee's economic capacity. It can contain several legal persons, but it does not replace identification of the controller or processor that infringed the GDPR.
Controller: the person or body that determines the purposes and means of processing. A legal-person controller can be fined directly when its intentional or negligent infringement is established.
Processor: the person or body processing personal data on behalf of a controller. A processor has direct duties, but exposure must be mapped to the particular processor obligation and conduct.
Article 83 administrative fines are one part of GDPR enforcement. Article 82 concerns compensation for material or non-material damage caused by an infringement. Article 84 requires Member States to provide rules for other penalties, especially for infringements not subject to Article 83 fines. Those routes have different conditions and should not be combined into one maximum-exposure number.
This page stays at the GDPR, final EDPB guidance, and cited CJEU judgment level. It does not determine national penalty procedures, criminal sanctions, public-authority exceptions, appeal deadlines, settlement procedures, or the outcome of a specific case. Check the law and supervisory-authority procedure in each relevant Member State.
Sorena can help convert the Article 83 tiers, Article 58 powers, and accountability evidence on this page into owner assignments, evidence requests, and review-ready response records.
Ask questions tied to cited sources about Article 83 tiers, Article 58 powers, breach evidence, and accountability records using the cited sources on this page.
Review your GDPR fine-exposure evidence file, Article 83 factor mapping, and authority-response workflow with Sorena.
"appropriate procedural safeguards"
"Personal data breach notification"