GDPR fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher
Verified Confidence: high
Primary source found; it says the same thing, the scope matches, and it is reasonably current.
- Commonly cited as
- "GDPR fines up to 4% of global revenue"
- True origin
- European Union (GDPR Art. 83) — Art. 83 GDPR – General conditions for imposing administrative fines
- Type
- Reference fact: A frequently needed number or rule taken directly from a primary source (e.g. Pew, Census, IAB/PwC, FTC), with its as-of date.
- Year
- 2016
- Data as of
- Regulation (EU) 2016/679, applicable since May 25, 2018
- Last checked
- What the source says
administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher
- Method & sample
- Regulation text. A lower tier (€10 million or 2%) applies to other infringements listed in Art. 83(4).
- Drift between quote and source
- The 4% tier covers core infringements (principles, consent, data-subject rights, transfers); other breaches cap at €10M or 2%
- Interest
- n/a (statute or regulation).
Safe rephrasing
Under GDPR Article 83, the most serious infringements can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher; other infringements cap at €10 million or 2%.
Sources we opened
- GDPR Art. 83 (gdpr-info.eu) (primary)
Machine-readable: /api/claims/gdpr-fines-20-million-or-4-percent-turnover.json · Last checked 2026-10-16