> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.laposta.org/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.laposta.org/_mcp/server.

# How high are the fines for GDPR violations?

> What penalties apply to violating privacy legislation and how the supervisory authority assesses this.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises compliance with the General Data Protection Regulation (GDPR) and can impose fines. The maximum fine is 20 million euros or 4% of the worldwide annual turnover, whichever is higher. According to European rules, sanctions must be effective, proportionate, and dissuasive. That last point is probably the reason why the ceiling for the fines is set so high.

## Two categories of violations

The GDPR distinguishes between two categories of violations:

* First category: violating the more fundamental obligations under the GDPR, punishable by a fine in the highest category. Examples include violating the rights of a data subject, such as the right of access, the right to erasure, and the right to data portability, or transferring personal data to countries or organisations outside the EU.
* Second category: failing to follow procedures under the GDPR. Examples include failing to appoint a data protection officer, failing to [report data breaches](/datalekken), or taking insufficient security measures.

## When does the supervisory authority impose a fine?

Under the GDPR, a supervisory authority must carefully weigh up whether a financial penalty is appropriate for the violation. Supervisory authorities are free to draw up their own fining policy at their own discretion. In the case of a minor infringement, the supervisory authority may also opt for a reprimand instead of imposing a financial penalty straight away.

Would you like to know what you need to pay attention to yourself? Take a look at the overview on [complying with the GDPR](/hoe-zorg-ik-ervoor-dat-ik-voldoe-aan-de-avg).

## Related articles

#### [What are the legal bases for email marketing under the GDPR?](/grondslagen-voor-verwerking)

Which legal requirements from the GDPR and the Telecommunications Act apply to…

#### [What does the GDPR mean for your newsletter?](/privacywetgeving)

Which rules apply to collecting email addresses and how Laposta protects your data.

#### [Where can you find Laposta's privacy statement?](/privacystatement)

How Laposta processes and secures personal data, and where you can report a security…

#### [When do you need to ask subscribers for permission again?](/moet-ik-mijn-relaties-opnieuw-om-toestemming-vragen)

Read when you need to ask existing subscribers for permission again and when it is not…