Use this guide to separate GDPR administrative-fine tiers from the factors supervisory authorities weigh before imposing a fine.
Grounded in Article 83, Article 58, GDPR accountability provisions, breach-notification guidance, and CJEU case-law summaries on fine conditions.
Structured answer sets in this page tree.
Cited legal and guidance references.
GDPR fine exposure is not just a maximum-number lookup. Article 83 sets two administrative-fine tiers, requires fines to be effective, proportionate, and dissuasive, and lists case-specific factors that can raise or reduce the amount. Article 58 also matters because a supervisory authority can use warnings, reprimands, compliance orders, processing bans, erasure orders, data-flow suspensions, and fines depending on the facts.
Start with the tier, then test the facts. Article 83(4) covers several operational obligations, including controller and processor duties in Articles 8, 11, 25 to 39, certification duties, and monitoring-body duties. That tier can reach EUR 10,000,000, or for an undertaking, 2 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
Article 83(5) covers higher-tier infringements: basic processing principles and consent conditions, data-subject rights, international-transfer rules, certain Member State law obligations under Chapter IX, and non-compliance with Article 58 access, limitation, suspension, or order powers. Article 83(6) also puts non-compliance with a supervisory-authority order in the higher tier. The higher tier can reach EUR 20,000,000, or for an undertaking, 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
The fine tier is only the ceiling. Article 83(2) requires the supervisory authority to consider the circumstances of the individual case when deciding whether to impose a fine and when setting the amount.
A useful internal assessment should mirror the Article 83(2) list: what happened, how long it lasted, how many people were affected, what harm occurred, whether conduct was intentional or negligent, what mitigation happened, what technical and organisational measures existed, whether there were previous infringements, and how the organisation cooperated with the authority.
Do not treat an administrative fine as the only enforcement result. Article 58 gives supervisory authorities investigative powers, corrective powers, and advisory or authorization powers. Article 83 says fines may be imposed in addition to, or instead of, several Article 58 corrective measures depending on the individual case.
For response planning, the highest-risk Article 58 outcomes are not always monetary: an order to comply, a temporary or definitive processing limitation, a processing ban, an erasure or restriction order, a breach-communication order, or suspension of data flows can be more urgent than the fine amount.
The evidence file should prove the Article 83 factors, not merely assert compliance. Build it around the processing operation, the controller or processor role, the affected data categories, the specific infringement question, and the corrective steps taken.
The grounding supports accountability evidence for controllers and processors: Article 5(2) requires controllers to be able to demonstrate compliance, Article 24 requires appropriate technical and organisational measures that are reviewed and updated where necessary, Article 31 requires cooperation with supervisory authorities, and Article 83 applies administrative-fine tiers to controller and processor obligations where relevant.
No. Article 83 sets maximum tiers and requires case-by-case assessment. The authority must consider factors such as gravity, duration, affected data subjects, damage, intent or negligence, mitigation, responsibility, prior infringements, cooperation, data categories, notification, earlier Article 58 measures, codes or certifications, and other aggravating or mitigating factors.
Yes. Article 58 allows warnings, reprimands, compliance orders, processing limits or bans, erasure or restriction orders, breach-communication orders, certification withdrawal, fines, and suspension of data flows. Article 83 also treats compliance with earlier Article 58 measures on the same subject matter as a fine-assessment factor.
This page intentionally stays at the GDPR and grounded EU-source level. It does not list national penalty procedures, authority-specific fine formulas, criminal sanctions, public-authority exceptions by Member State, appeal deadlines, settlement procedures, or enforcement statistics because those facts are not grounded for this artifact.
When a matter depends on local procedural law, the safe record is to cite Article 83(7), Article 83(8), or Article 83(9) only at the level the GDPR supports, then route the local question to jurisdiction-specific counsel or grounded national authority material.
Sorena can help convert the Article 83 tiers, Article 58 powers, and accountability evidence on this page into owner assignments, evidence requests, and review-ready response records.
Ask source-linked questions about Article 83 tiers, Article 58 powers, breach evidence, and accountability records using the cited sources on this page.
Review your GDPR fine-exposure evidence file, Article 83 factor mapping, and authority-response workflow with Sorena.
"intentionally or negligently"
"appropriate procedural safeguards"
"Personal data breach notification"