What is the penalty for violating the GDPR?
Asked by: scraper | Last update: August 19, 2026Score: 0/5 (0 votes)
GDPR breach fines can be severe, reaching up to €20 million or 4% of a company’s total worldwide annual turnover, whichever is higher, for serious violations. Lesser violations can result in fines of up to €10 million or 2% of annual global turnover. The record-breaking fine is €1.2 billion against Meta (2023).
How serious is a violation of the GDPR punished?
GDPR fines can reach up to $23.72 million or 4% of global annual turnover, making noncompliance a serious financial risk. Regulators consider severity, intent, duration, cooperation, and prior violations when deciding fine amounts.
What is the penalty for breaching the GDPR?
For especially severe violations, listed in Art. 83(5) GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher.
Can you get fined for breaking GDPR?
83(4) GDPR sets forth fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover of the preceding fiscal year, whichever is higher.
What is the biggest GDPR penalty?
The single biggest fine on record: $1,371M (€1.2B) against Meta (Facebook) in 2023, for illegally routing European users' personal data to US servers. Amazon follows at $852.5M (€746M), and TikTok (ByteDance) claimed third place in May 2025 with a $605.6M (€530M) penalty for transferring EU user data to China.
The Top 5 GDPR Fines of 2025 (And How to Avoid Them)
What companies have breached GDPR?
Top 20 GDPR breach fines
- Meta Platforms Ireland Ltd. - €1.2bn fine (2023)
- Amazon Europe - €746m fine (2021)
- TikTok - €530m fine (2025)
- Meta - €479m fine (2025)
- Meta Platforms, Inc. - €405m fine (2022)
- Meta Platforms Ireland Ltd. - €390m fine (2023)
- TikTok Ltd - €345m fine (2023)
- LinkedIn - €310m fine (2024)
Can a company be fined up to 1 million under GDPR?
Two tiers of GDPR fines. The GDPR states explicitly that some violations are more severe than others. The less severe infringements could result in a fine of up to €10 million, or 2% of the firm's worldwide annual revenue from the preceding financial year, whichever amount is higher.
Is a GDPR breach criminal?
Under s170, it is a criminal offence to: Knowingly or recklessly obtain, disclose or procure personal data without the consent of the data controller. Sell that data. Recklessly retain personal data – even if it was obtained lawfully – without the consent of the data controller.
What are some famous GDPR breach examples?
20 biggest GDPR fines so far
- Meta GDPR fine- €1.2 billion. ...
- Amazon GDPR fine – €746 million. ...
- Meta GDPR fine – €405 million. ...
- Meta GDPR fine – €390 million. ...
- TikTok GDPR fine- €345 million. ...
- Linkedin GDPR fine – €310 million. ...
- Uber GDPR fine – €290 million. ...
- Meta GDPR fine – €265 million.
What is the 72 hour rule for data breach?
By law, you've got to report a personal data breach to the ICO without undue delay (if it meets the threshold for reporting) and within 72 hours. You might end up not needing to report it, but start a log anyway, to record what happened, who is involved and what you're doing about it.
What happens if you accidentally breached GDPR?
Such an event should be reported within the next 72 hours. Apart from that, those whose lives could be affected should be notified about the data breach in the next 72 hours. Failure to do so could result in substantial fines being imposed on a business that is responsible for the processing of personal data.
What is the minimum fine for GDPR?
The GDPR does not specify a “minimum fine” as such; instead, it outlines two tiers of fines based on the severity of the GDPR data breach. For less severe breaches, companies can be fined up to €10 million or 2% of the firm's global annual turnover of the previous financial year, whichever is higher.
What happens if I don't comply with GDPR?
More serious violations can lead to penalties of up to four per cent of a company's global turnover or €20 million (£17.05 million), whichever is greater. These fines are much more severe than the penalties that could be imposed under the previous regime, when the ICO could only fine organisations up to £500,000.
How big are GDPR fines?
GDPR fines are calculated using a two-tiered system based on the severity of the violation, with penalties reaching up to €20 million or 4% of a company's global annual revenue (whichever is higher). Actual fine amounts are scaled proportionally and determined on a case-by-case basis.
What is considered a GDPR violation?
A GDPR breach (personal data breach) is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or processed. It covers both malicious attacks (hacking) and human errors, such as sending emails to the wrong recipient.
What is the most hacked website in the world?
Some of the largest breaches of all time include the following:
- The 2025 Credentials Crisis: 16 billion+ records exposed.
- Yahoo: 3 billion records lost.
- National Public Data: 2.9 billion records lost.
- River City Media: 1,. ...
- Aadhaar: 1.1 billion records lost.
- Indian Council of Medical Research (ICMR): 815 million records lost.
What exactly constitutes a GDPR breach?
In short, a personal data breach is a security incident that negatively impacts the confidentiality, integrity, or availability of personal data; meaning that the controller is unable to ensure compliance with the principles relating to the processing of personal data as outlined in Article 5 GDPR.
What if my SSN was part of a data breach?
If your Social Security Number (SSN) was part of a data breach, act immediately to prevent identity theft. Freeze your credit with all three major bureaus (Equifax, Experian, TransUnion) to prevent new accounts from being opened, file a report at IdentityTheft.gov, and monitor your credit reports for fraudulent activity.
How common are GDPR breaches?
Going back to the most common types of security breaches, the most frequent type is “unintended incidents”. 80,62% of all reports are based on unintended incidents caused by human error. It might seem like a small problem, but a whopping 26,248 out of the 32,557 reports fit in this category.
Which company got the highest fine so far under the GDPR?
The fine imposed on Amazon in 2021 of 746 million euros was surpassed, and the top of the fine leaderboard is now occupied by Facebook's parent company, Meta, with a decision of 1.2 billion euros.
What are the three biggest data breaches of all time?
The Largest Data Breaches Ever Recorded (Ranked)
- Mother of All Breaches (MOAB) (2024) Records Exposed: 26 billion. ...
- CAM4 (2020) Records Exposed: 10.8 billion. ...
- RockYou2021 (2021) ...
- 4. Yahoo (2013–2014) ...
- Aadhaar (India ID Database) (2018) ...
- 7. Facebook (Meta) (2019/2021) ...
- Marriott / Starwood (2014–2018) ...
- LinkedIn (2012)
Can I sue for a GDPR breach?
The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both “material damage” (e.g. you have lost money) or “non-material damage” (e.g. you have suffered distress).
What happens if I accidentally breach GDPR?
In itself, a data breach doesn't automatically give rise to a GDPR penalty. But if the safeguarding measures you had in place are not deemed “adequate”, or if your action (or lack of it) negatively impacts the rights of individuals, you may find yourself having to the deal with the data regulator.
Can individuals violate GDPR?
Can individuals be fined under GDPR? Yes, individuals can be fined for GDPR violations. According to GDPR Chapter 1 Article 4, “any natural or legal person, public authority, agency or body” can be charged for GDPR violations.