When a company mishandles personal data, the headline number is usually the maximum fine. Under GDPR fines can reach £17.5 million or 4% of worldwide turnover in the UK, and 20 million EUR or 4% of worldwide turnover in the EU. Those figures sound abstract, but they exist to protect you. This guide explains what they mean in plain English.

The Maximum GDPR Fines in the UK and EU

The two regimes follow the same basic design. Each sets a fixed cap in its own currency and a percentage of the organisation's worldwide turnover.

  • UK: up to £17.5 million or 4% of worldwide turnover
  • EU: up to 20 million EUR or 4% of worldwide turnover

The percentage matters because it scales with the size of the organisation. A fixed sum would be trivial for a very large company, so the turnover-based option lets regulators set a penalty that actually bites. Top-ranking guides on the topic describe the rule as "whichever is higher" for the lower tier, and the same logic is what makes the headline cap meaningful for big firms.

These are ceilings, not standard penalties. Most fines land well below the maximum, and a regulator has to justify where a case falls.

Which Breaches Fall in Each Tier

GDPR uses a two-tier structure. The higher tier, the one carrying the £17.5 million or 20 million EUR cap, is reserved for the more serious infringements. The lower tier covers less severe failings and carries a smaller cap. Publicly available summaries put the EU lower tier at 10 million EUR or 2% of worldwide annual turnover.

In broad terms, the higher tier is aimed at violations that strike at the core of your rights, such as breaking the basic principles for processing data or denying people the rights the law gives them. The lower tier is generally associated with more procedural or organisational duties. For a deeper walkthrough of how the split works, see our explainer on how the two-tier GDPR penalty system works.

How Regulators Set the Actual Fine

The maximum is only the starting frame. Regulators weigh the circumstances of each case, and the process is not a simple lookup table.

One rule worth knowing: where several violations occur together, the total fine should not exceed the amount specified for the gravest infringement. In practice, that means the applicable cap is tied to the most serious violation in the case, not the sum of every cap.

Severity, the organisation's size and the nature of the failure all play into the final figure. That is why two companies with similar breaches can receive very different penalties, and why the headline maximums should be read as an upper boundary rather than a prediction.

What This Means For You

Fines go to regulators, not to affected individuals, so the penalty itself will not put money in your pocket. Their value for you is indirect, but real.

  • They create a deterrent. A cap tied to worldwide turnover gives even large organisations a reason to take data protection seriously.
  • They back up your rights. The high-tier penalties are linked to the violations that matter most to you, including how your data is used and whether your rights are respected.
  • They give you a route to act. If you think an organisation has misused your data, you can raise the issue with the organisation first, then take it to the data protection regulator in your country. In the UK, that regulator is the ICO.

It also helps to keep expectations realistic. A very large maximum does not mean every breach produces a very large fine. Our coverage of GDPR fines and the two-tier system explores why the eye-catching numbers can mislead.

Practical Takeaways

Understanding GDPR fines is useful mostly because it shows you where your leverage sits. A few steps put that knowledge to work:

  1. Know the difference between UK and EU rules. The UK cap is £17.5 million or 4%, and the EU cap is 20 million EUR or 4%. Which applies depends on where the organisation operates and where you are.
  2. Keep records. If you contact a company about your data, save the emails, dates and responses. They matter if you later complain to a regulator.
  3. Use your rights. You can ask organisations what data they hold about you and raise concerns when something looks wrong.
  4. Escalate when needed. If a company does not resolve your concern, the national data protection regulator is the next step.
  5. Reduce your exposure. Share only the data a service really needs, and use strong, unique passwords and two-factor authentication.

GDPR fines, whether £17.5 million in the UK or 20 million EUR in the EU, are the visible edge of a wider system designed to keep your personal data under your control. Knowing how that system works makes it easier to use it.