What are the GDPR penalties and fines in 2022?

The European Union (EU) introduced the GDPR to address public concerns about data privacy. It is a set of privacy regulations and standards that covered entities like data processors and controllers must follow to protect the online information of EU citizens.

The GDPR is comprehensive and one of the most impactful data privacy laws of the last 20 years. Failure to comply with the GDPR leaves you at risk of not only tarnishing your company’s reputation but also potentially hefty penalties and fines.

GDPR penalties and fines: Two tiers to know

The purpose of fines is to deter large and small companies from skimping on GDPR security requirements. One of the most notable points that businesses should keep in mind is that non-compliance can result in fines of up to 4% of global revenue. Article 83 of the legislation lays out the penalties for infringements. No retribution is ideal, but not all infringements are equal. There are two tiers of penalties and fines to know.

• Tier 1: Less Severe Violations — Each supervisory authority is tasked to impose fines and penalties proportional to the infringement which occurred. A less critical infraction could result in a fine of up to €10 million ($11.5 million), or 2% of the firm’s worldwide annual revenue. A business may be subject to a tier-one penalty if it violates GDPR articles relating to: certification bodies, monitoring bodies, controllers and processors, or specific Articles 8, 11, 25-39, 41, 42, and 43.
• Tier 2: More Severe Violations — If a business violates GDPR articles relating to: principles for processing, consent conditions, data subjects’ rights, the transfer of data, or specific Articles 5, 6, 7, 9, 12-22, it could be subjected to severe penalties. Among these includes a fine of up to €20 million ($24.1 million) or 4% of the firm’s worldwide annual revenue. Authorities will choose whichever amount is the highest.

How GDPR penalties are determined

GDPR fines vary greatly in severity and price, as we have seen from Amazon’s $865 million GDPR fine compared with H&M’s $41 million fine. To determine the proportional punishment for GDPR infractions, supervisory authorities examine several areas laid out in Article 83. These include:

• The nature and magnitude of the compliance breach
• Intent and if negligence occurred
• If mitigation was done to limit the damage to data subjects
• If the business had precautions in place to deter the event from occurring
• History of non-compliance 
• If the organization cooperated during the remediation process
• The type and sensitivity of data jeopardized
• Whether the business notified impacted data subjects of the GDPR infringement
• If the business was following codes of conduct and meeting previous warnings
• Additional factors such as if the business financially benefited from breaching the GDPR

Use Ground Labs to avoid GDPR penalties & fines

There are several GDPR best practices organizations can begin implementing to meet compliance, many of which need to be conducted on an ongoing basis because meeting compliance is never a one-and-done event. Some of the best strategies to kickstart your compliance journey are hiring a data protection officer and utilizing a data discovery tool. With these measures in place, your company can ensure compliance by identifying risks, implementing technical controls, ensuring the consent of data use, and reporting breaches on time.

If your business is looking for a partner to help meet and maintain GDPR compliance, schedule a meeting with a Ground Labs expert today.