Question 1

What are the two GDPR fine tiers under Article 83?

Accepted Answer

Article 83(4) covers lower-tier violations (e.g. processor obligations, children's consent): up to €10 million or 2% of global annual turnover, whichever is higher. Article 83(5) covers upper-tier violations (e.g. basic processing principles, data subject rights): up to €20 million or 4% of global annual turnover, whichever is higher.

Question 2

What is the largest GDPR fine ever issued?

Accepted Answer

Meta Platforms Ireland received a €1.2 billion fine from Ireland's DPC in 2023 for unlawful EU-US personal data transfers under Standard Contractual Clauses. Amazon (Luxembourg) received a €746 million fine in 2021 for unlawful behavioural advertising.

Question 3

Which authority do I notify for a GDPR data breach?

Accepted Answer

You must notify the supervisory authority of your EU establishment within 72 hours of becoming aware of a personal data breach (Article 33 GDPR). The lead supervisory authority is determined by your main EU establishment. Use our GDPR Breach Timer to countdown the deadline and find all 27 EU DPA contacts.

Entity	Fine	Year	Violation
Meta Platforms Ireland	€1.2B	2023	Unlawful EU-US data transfers
Amazon (Luxembourg)	€746M	2021	Unlawful behavioural advertising
WhatsApp (Ireland)	€225M	2021	Transparency failures

GDPR Fine Estimator