How high are the fines for GDPR violations?
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises compliance with the General Data Protection Regulation (GDPR) and can impose fines. The maximum fine is 20 million euros or 4% of the worldwide annual turnover, whichever is higher. According to European rules, sanctions must be effective, proportionate, and dissuasive. That last point is probably the reason why the ceiling for the fines is set so high.
Two categories of violations
The GDPR distinguishes between two categories of violations:
- First category: violating the more fundamental obligations under the GDPR, punishable by a fine in the highest category. Examples include violating the rights of a data subject, such as the right of access, the right to erasure, and the right to data portability, or transferring personal data to countries or organisations outside the EU.
- Second category: failing to follow procedures under the GDPR. Examples include failing to appoint a data protection officer, failing to report data breaches, or taking insufficient security measures.
When does the supervisory authority impose a fine?
Under the GDPR, a supervisory authority must carefully weigh up whether a financial penalty is appropriate for the violation. Supervisory authorities are free to draw up their own fining policy at their own discretion. In the case of a minor infringement, the supervisory authority may also opt for a reprimand instead of imposing a financial penalty straight away.
Would you like to know what you need to pay attention to yourself? Take a look at the overview on complying with the GDPR.