We often hear of businesses lamenting the cost of GDPR compliance, but as the bedding-in period passes and national supervisory authorities such as the UK’s Information Commissioner’s Office (ICO) tighten up their stance, the cost of non-compliance can be much greater.
The introduction of the EU GDPR (General Data Protection Regulation) in May 2018 gave individuals much more control over the extent of business’s usage of their personal data, and more power to authorities such as the ICO to enforce these tougher data protection rules.
What are the penalties for non-compliance with GDPR?
Since the GDPR took effect, the authorities’ extended powers have enabled them to levy the following GDPR fines:
Violations relating to internal record keeping, data processor contracts, data security and breach notification, data protection officers, and data protection by design and default – up to 2% of annual worldwide turnover of the preceding financial year or 10 million euros (whichever is the greater)
Violations relating to breaches of the data protection principles, conditions for consent, data subjects’ rights and international data transfers – up to 4% of annual worldwide turnover of the preceding financial year or 20 million euros (whichever is the greater)
What is the minimum fine for GDPR?
In the early post-GDPR stages, the ICO was more lenient than it is now, understanding that GDPR compliance has been labour-intensive and sometimes costly for businesses (particularly SMEs). However, now we’re two years into the regime, the ICO’s stance is understandably stricter. Fellow businesses and individuals are now more informed and aware of their own data protection rights, too; The Guardian reported that data protection complaints surged from 21,019 to 41,661 in July this year, compared with the same period in 2018.
There is no minimum GDPR fine; rather, the ICO decides the appropriate fine for a breach in each case. They say, “any penalty that we issue is intended to be effective, proportionate and dissuasive, and will be decided on a case by case basis”.
Are there any other sanctions?
What is potentially more worrying than financial penalties is that national supervisory authorities have the power to restrict or suspend your data processing activities altogether if you are not complying with the GDPR. In a worst case scenario, this could prevent you from trading altogether.
Is there a list of GDPR fines and penalties?
The ICO publishes a great deal of information, from decision notices, audit and monitoring reports of how long businesses take to reply to freedom of information requests and data security incident trends, on its website.
These fines make for a concerning read, but prevention is better than a cure. For peace of mind that your organisation’s data processing practices are GDPR compliant, get in touch with our specialist team.
Matthew leads our employment law and business immigration team. He is also a director of our affiliated company, Willans Data Protection Services, which provides organisations operating on a multi-national basis with UK and Article 27 Representative solutions, Data Protection Officer services and GDPR training solutions. Matthew has over 20 years’ experience in the employment law field and is qualified as CIPP/E with the International Association of Privacy Professionals.
On Christmas Eve, the nation was informed that the UK and EU had struck a Brexit deal. The transition period is now over, and a clearer picture of the future…
The media flurry around the introduction of the General Data Protection Regulation (GDPR) in May 2018 has quietened, but organisations shouldn’t be lulled into a false sense of security. The…
While the stir around the introduction of the General Data Protection Regulation (GDPR) has certainly died down since May 2018, the GDPR is still as relevant as ever to all…
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL cookies.
This website uses cookies to improve your experience while you navigate through our website. Out of these cookies, the cookies that are categorised as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyse and understand how you use our website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies but it may affect your browsing experience on our website. You can find our cookie policy here.
Necessary cookies are absolutely essential for our website to function and enable core functionality such as security and accessibility. These cookies do not store any personal information. You can block these cookies by changing your browser settings, but this may affect how the website functions.
We use performance cookies such as Google Analytics to help us count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. The cookies collect information in a way that does not directly identify anyone. For more information on how these cookies work, please see our cookie policy.