# How high can GDPR fines be?

For the most serious infringements, up to EUR 20 million or 4 % of total worldwide annual turnover of the preceding financial year, whichever is higher, under Article 83(5) of the GDPR. That upper tier covers breaches of the basic principles, the lawful basis, people’s rights and international transfers. A lower tier covers other obligations, such as security of processing and breach notification, with lower maximums set in the same article. These are ceilings, not tariffs: the authority decides case by case, weighing the nature, gravity and duration of the infringement, intent or negligence, what was done to limit the damage, earlier infringements and cooperation. Fines are only one consequence; authorities can also order processing to stop, and people can claim compensation. What lowers exposure is ordinary diligence you can prove: knowing your processing, documented security measures, a breach procedure that works, and timely notifications. NetSenX helps with one part, noticing a breach early and preparing the notification draft from the Starter plan; it cannot remove the risk of a fine.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-are-gdpr-fines

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [What is DORA, in plain terms?](https://netsenx.com/en/faq/what-is-dora-in-plain-terms)
- [What does DORA require from the management of a financial entity?](https://netsenx.com/en/faq/what-does-dora-require-from-management)
- [What is the Cyber Resilience Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-cyber-resilience-act)
- [Does the Cyber Resilience Act apply to software companies?](https://netsenx.com/en/faq/does-the-cra-apply-to-software-companies)
- [Does the Cyber Resilience Act apply to software as a service?](https://netsenx.com/en/faq/does-the-cra-apply-to-saas)