GDPR Fine Calculator: Article 83 Risk Assessment

GDPR fines (Article 83): legal ceiling and worked estimate

Article 83 GDPR sets two ceilings: €10M or 2% of annual worldwide turnover for operational obligations (records, security, DPO), and €20M or 4% for the principles, consent, data subject rights and transfers, whichever is higher. The tool computes this ceiling, then a likely fine based on a severity index from 5 to 100.

Legal ceiling

• Tier 1 (Art. 83(4): records, security, DPO): the higher of €10M and 2% of annual worldwide turnover.
• Tier 2 (Art. 83(5): principles, consent, data subject rights, transfers outside the EU): the higher of €20M and 4%.

Likely fine as the tool computes it

Base severity: 20 (tier 1) or 45 (tier 2); +25 if deliberate, +15 for sensitive data, +15 for repeat offences; −10 if the breach was notified within 72 hours, −10 for cooperation; result kept between 5 and 100. Likely fine = turnover × severity ÷ 100 × rate (2% or 4%) × 1.5, plus €25,000 if severity exceeds 50 (otherwise €5,000), capped at the ceiling.

Examples

€5M turnover, tier 2, negligence, notification and cooperation: severity 45 − 10 − 10 = 25; likely fine = 5,000,000 × 0.25 × 0.04 × 1.5 + 5,000 = €80,000; ceiling €20M, since 4% is only €200,000. Same company, deliberate breach involving health data, not notified: severity 75, likely fine €250,000. At €1bn turnover with every aggravating factor, the formula gives €60M and the tool caps it at €40M.

Limits

The formula is the tool's own heuristic. EDPB Guidelines 04/2022 start from 0–10%, 10–20% or 20–100% of the ceiling depending on seriousness, reduce it for smaller undertakings, then adjust for the Article 83(2) criteria, so real fines can differ widely. No legal advice. The DSA simulator covers platforms and cookies; the retention guide covers deletion deadlines.

Sources and dates: GDPR Art. 83(2), (4) and (5), applicable since 25/05/2018 (CNIL, GDPR Chapter VIII); Art. 33(1), 72-hour notification (CNIL, GDPR Chapter IV); EDPB Guidelines 04/2022, final version of 24/05/2023 (EDPB, calculation of fines) (checked 14/10/2026).

Frequently Asked Questions

What is the maximum GDPR fine?

For the most serious infringements (Article 83(5)), a fine can reach €20M or 4% of annual worldwide turnover in the preceding financial year, whichever is higher. A company with €1bn of turnover therefore risks up to €40M. Below €500M of turnover, the fixed €20M ceiling applies.

Which infringements fall under the €10M or 2% ceiling?

Article 83(4) covers the obligations of controllers and processors: children's consent (Art. 8), data protection by design, records of processing, security, breach notification, impact assessments and data protection officers (Art. 25 to 39), and certification (Art. 42 and 43). The ceiling is the higher of €10M and 2% of worldwide turnover.

How quickly must a data breach be notified?

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals. A later notification must give the reasons for the delay. In the tool, timely notification removes 10 points from the severity index.

How do authorities calculate a GDPR fine?

EDPB Guidelines 04/2022 (final version of 24/05/2023) set a starting amount of 0–10%, 10–20% or 20–100% of the legal maximum depending on seriousness, reduced for smaller undertakings. It is then adjusted for the aggravating or mitigating factors of Article 83(2) and checked against the ceiling and proportionality. The tool does not reproduce this method; it uses its own simplified formula.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.