GDPR Fines: The Maximum Penalties in the UK and EU and How They're Set

Those are ceilings, not tariffs. The regulator decides each fine case by case, and it has to be effective, proportionate and dissuasive. Here's what the legislation and the Information Commissioner's Office (ICO) say, as of October 2026.

The two tiers side by side

	UK GDPR (ICO)	EU GDPR
Higher maximum	£17.5 million or 4% of worldwide turnover	20 million EUR or 4% of worldwide turnover
Standard maximum	£8.7 million or 2% of worldwide turnover	10 million EUR or 2% of worldwide turnover
Which applies	Whichever is higher, for an undertaking	Whichever is higher, for an undertaking

'Whichever is higher' is the part that matters for big groups: the turnover figure is worldwide and for the preceding financial year, so for a large company 4% can dwarf the fixed amount. For a small business, the fixed figure is the realistic ceiling.

What lands in the higher tier

• The basic principles for processing, including conditions for consent (Articles 5, 6, 7 and 9).
• People's rights, such as access, erasure and objection (Articles 12 to 21 in the UK text).
• Unlawful transfers of personal data abroad.
• Ignoring an order from the regulator, such as a processing ban.

What lands in the standard tier

• Controller and processor obligations such as data protection by design, records, security and breach notification (Articles 25 to 39).
• Children's consent rules (Article 8).
• Certification and monitoring body obligations.

In practice, a security failure that leads to a breach falls under the standard tier's articles, while processing without a lawful basis, or refusing access requests, falls under the higher one.

How the amount is decided

Article 83(2) lists what the regulator must consider. The ones that move a fine most:

1. The nature, gravity and duration of the infringement, how many people were affected and the damage they suffered.
2. Whether it was intentional or negligent.
3. What you did to reduce the harm.
4. Your technical and organisational measures, and any previous infringements.
5. How well you cooperated with the regulator, and whether you told it yourself.
6. The categories of personal data involved.
7. Codes of conduct or certification you follow, and any profit made or loss avoided.

There's also a cap that helps when one failure breaks several rules: for the same or linked processing, the total fine can't exceed the amount for the gravest infringement. The ICO's Data Protection Fining Guidance explains how it applies these factors and calculates a figure.

What changed with the Data (Use and Access) Act 2025

The Data (Use and Access) Act came into law on 19 June 2025 and amends the UK GDPR, the Data Protection Act 2018 and PECR, the rules on marketing emails and cookies. The ICO says it adds new duties: you must help people make complaints, for example with an electronic form, and acknowledge complaints within 30 days. It also lets some cookies be set without consent, such as those used for statistics. The ICO is reviewing parts of its guidance because of the Act. If you run analytics, our guide to Google Analytics and cookie consent covers the consent side.

Avoiding the conversation in the first place

• Know your lawful basis for each kind of processing and write it down.
• Answer access requests on time; they're a higher-tier right.
• Log breaches and report the serious ones yourself, which counts in your favour.
• Check whether you must register with the ICO: who has to register explains it.
• Check AI tools before you feed them customer data.

UK and EU: which one applies to you?

If you're based in the UK, the ICO enforces the UK GDPR and the sterling caps apply. If you offer goods or services to people in the EU, or monitor them, EU regulators can enforce the EU GDPR and its euro caps. Many UK businesses with European customers sit under both, so a single data breach can mean two regulators asking questions, each applying its own caps and its own fining guidance. The rules are close, but they aren't identical, and the UK text has been amended several times since the two split, so it's worth checking the version that applies to your processing rather than an old summary. When in doubt, start with the ICO's guidance for UK activity and your lead EU regulator's for the rest.

Fines aren't the regulator's only tool

Article 83 says fines can be imposed in addition to, or instead of, the regulator's corrective powers in Article 58(2), such as warnings, reprimands, orders to comply and limits or bans on processing. For many small firms, an order to change how they process data, or a ban on a particular use, is the bigger business problem. And ignoring such an order is itself a higher-tier infringement, which is why cooperating early is the cheapest route.

Written policies are part of showing you comply, and our list of policy management software weighs up tools that keep them current.

The verdict

For most small businesses, the turnover percentage isn't the number to worry about; the fixed £8.7 million and £17.5 million ceilings show how seriously the law treats data, and the Article 83 factors show how to keep any fine small. Cooperation, quick self-reporting and documented security measures all count, and they cost far less than a lawyer after the fact. The fastest win: put a complaints route on your site now, because the 2025 Act made that a duty.

Hiding personal data in test environments lowers the risk, and this list of data masking software covers tools that do it.

Frequently asked questions

What is the maximum GDPR fine in the UK?

£17.5 million or 4% of total worldwide annual turnover in the preceding financial year, whichever is higher.

What is the maximum GDPR fine in the EU?

20 million EUR or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

What are the two tiers of GDPR fines?

A standard maximum (£8.7 million or 2% in the UK) for obligations like security and records, and a higher maximum (£17.5 million or 4%) for principles, consent and individuals' rights.

How is a GDPR fine calculated?

Case by case, using the Article 83(2) factors, including gravity, intent, mitigation, cooperation and previous infringements.