GDPR fines explained

We often hear of businesses lamenting the cost of GDPR compliance, but as the bedding-in period passes and national supervisory authorities such as the UK’s Information Commissioner’s Office (ICO) tighten up their stance, the cost of non-compliance can be much greater.

The introduction of the EU GDPR (General Data Protection Regulation) in May 2018 gave individuals much more control over the extent of business’s usage of their personal data, and more power to authorities such as the ICO to enforce these tougher data protection rules.

What are the penalties for non-compliance with GDPR?

Since the GDPR took effect, the authorities’ extended powers have enabled them to levy the following GDPR fines:

• Violations relating to internal record keeping, data processor contracts, data security and breach notification, data protection officers, and data protection by design and default – up to 2% of annual worldwide turnover of the preceding financial year or 10 million euros (whichever is the greater)
• Violations relating to breaches of the data protection principles, conditions for consent, data subjects’ rights and international data transfers – up to 4% of annual worldwide turnover of the preceding financial year or 20 million euros (whichever is the greater)

What is the minimum fine for GDPR?

In the early post-GDPR stages, the ICO was more lenient than it is now, understanding that GDPR compliance has been labour-intensive and sometimes costly for businesses (particularly SMEs). However, now we’re two years into the regime, the ICO’s stance is understandably stricter. Fellow businesses and individuals are now more informed and aware of their own data protection rights, too; The Guardian reported that data protection complaints surged from 21,019 to 41,661 in July this year, compared with the same period in 2018.

There is no minimum GDPR fine; rather, the ICO decides the appropriate fine for a breach in each case. They say, “any penalty that we issue is intended to be effective, proportionate and dissuasive, and will be decided on a case by case basis”.

Are there any other sanctions?

What is potentially more worrying than financial penalties is that national supervisory authorities have the power to restrict or suspend your data processing activities altogether if you are not complying with the GDPR. In a worst case scenario, this could prevent you from trading altogether. 

Is there a list of GDPR fines and penalties?

The ICO publishes a great deal of information, from decision notices, audit and monitoring reports of how long businesses take to reply to freedom of information requests and data security incident trends, on its website.

These fines make for a concerning read, but prevention is better than a cure. For peace of mind that your organisation’s data processing practices are GDPR compliant, get in touch with our specialist team.

Matthew leads our employment law and business immigration team. He is also a director of our affiliated company, Willans Data Protection Services, which provides organisations operating on a multi-national basis with UK and Article 27 Representative solutions, Data Protection Officer services and GDPR training solutions. Matthew has over 20 years’ experience in the employment law field and is qualified as CIPP/E with the International Association of Privacy Professionals.