SkypherVisit Website →
← Back to blog

€20M at Stake: What Compliance Officers Must Do After a GDPR Violation

September 29, 2026
€20M at Stake: What Compliance Officers Must Do After a GDPR Violation

A GDPR violation happens when an organization processes personal data without a valid legal basis, fails to secure it, or breaches the rights and obligations set out in the regulation. Under Article 83, penalties fall into two tiers, up to €10 million or 2% of global turnover, and up to €20 million or 4%. Every fine is discretionary and calculated case by case.

TL;DR:

  • Fines depend on whether the breach involves internal accountability failures or core principles, with lower-tier penalties capped at €10 million or 2% of turnover.
  • The five-step methodology used by regulators considers culpability, aggravating and mitigating factors, and aims at effectiveness and dissuasiveness, not solely turnover-based fines.
  • Common violations leading to large fines include consent failures, unlawful international data transfers, security breaches, and ignoring data subject rights.
  • Enforcement actions can include orders, bans, or warnings, with processing bans potentially more disruptive than monetary fines.
  • Maintaining detailed, up-to-date records, a strong incident response process, and evidence automation tools can significantly reduce risk and aid compliance.
Skypher
Streamline Your Compliance Responses
Skypher helps teams automate security questionnaire responses, organize evidence, and collaborate across complex enterprise environments.
Explore Skypher

Table of Contents

GDPR fines framework and legal basis under Article 83

Article 83 of the GDPR splits infringements into two tiers of consequence, and understanding which tier applies to a given failure is the first step in assessing your organization's exposure. The lower tier, described in Article 83(4), caps fines at €10 million or 2% of annual worldwide turnover, whichever is higher, and typically applies to administrative and organizational failures.

We find it helps to think of the two tiers in terms of what they protect:

  • Lower tier (2%): failures tied to internal accountability, such as missing records of processing, inadequate data protection impact assessments, or failing to appoint a data protection officer when required.
  • Upper tier (4%): violations of core principles, unlawful processing, ignoring data subject rights, or unlawful international transfers.

There is no statutory minimum fine, and turnover matters only as a ceiling, not as a guaranteed multiplier. A small company with a serious violation can still face a fine calculated on the percentage basis if that figure exceeds the flat cap, which is why the "whichever is higher" clause deserves close attention from finance and legal teams reviewing risk exposure. If your organization operates across markets, our primer on GDPR's reach for US organizations is a useful companion to this section, since the regulation's extraterritorial scope surprises many companies that assume it only applies within the EU.

How fines are decided and calculated: the EDPB five-step methodology

Once a supervisory authority has confirmed a violation occurred, it does not simply consult a table and pick a number. The European Data Protection Board's guidelines on imposing administrative fines describe a five-step methodology that authorities across the EU now apply in a harmonized way.

  1. Confirm the infringement is fineable. Not every technical breach of the GDPR results in a fine; the authority first checks whether Article 83 applies at all.
  2. Identify who can be fined. This step establishes the correct legal entity, which matters for corporate groups and processors acting on a controller's instructions.
  3. Assess culpability. The authority weighs whether the conduct was intentional or negligent, since intent generally points toward a higher fine.
  4. Weigh aggravating and mitigating factors. Prior infringements, cooperation with the investigation, and steps taken to limit damage all shift the number up or down.
  5. Check for effectiveness, proportionality, and dissuasiveness. The final figure must be meaningful enough to deter future violations without being disconnected from the facts of the case.

The EDPB's calculation guidelines reinforce that turnover is only one relevant element among several; it is not a formula that mechanically produces a fine amount. Authorities also weigh the seriousness and duration of the infringement, the categories of personal data involved, and whether the organization tried to mitigate harm before or during the investigation. Common aggravators we see across enforcement decisions include repeat offenses, a documented pattern of ignoring prior warnings, and a lack of any remediation effort once the issue surfaced.

Pro Tip: Document every mitigation step you take during an incident, even informal ones. The EDPB's own guidance treats a demonstrated, good-faith response as a mitigating factor that can meaningfully reduce a fine.

Enforcement cases and notable fines: what past decisions teach compliance officers

Enforcement patterns across published decisions point to a small set of recurring failure modes rather than a wide, unpredictable spread of causes. Reviewing them case by case is less useful than recognizing the shape they take, since most large fines trace back to one of a handful of root causes.

  • Consent failures: organizations that rely on pre-ticked boxes, bundled consent, or vague purpose descriptions repeatedly draw scrutiny; the lesson is to make consent specific, granular, and easy to withdraw.
  • International transfer violations: transferring personal data outside the EEA without a valid mechanism, or relying on a mechanism that no longer holds up, remains one of the more consequential categories of upper-tier fines.
  • Security failures leading to breaches: inadequate encryption, weak access controls, or delayed patching that allows an attacker to reach personal data tends to draw fines proportional to how foreseeable the failure was.
  • Ignoring data subject rights: failing to honor access, deletion, or objection requests within the required timeframe signals a broader governance gap to regulators, not just an isolated oversight.

The pattern across these cases is consistent: it is rarely the initial mistake alone that produces the largest fines, it is the absence of a system to catch, document, and correct the mistake before it compounds. Organizations that can show a working incident response process, current records of processing, and a genuine attempt to limit harm tend to fare better than those that cannot, even when the underlying facts are similar.

Corrective powers beyond fines: orders, bans, and warnings

Fines are the most visible consequence of a GDPR violation, but they are not always the most damaging one. Article 58(2) gives supervisory authorities a broader toolkit, and regulators often reach for these measures either alongside a fine or instead of one, particularly when the goal is to stop ongoing harm rather than punish past conduct.

  • Warnings and reprimands for organizations that show good faith and a credible plan to fix the issue.
  • Orders to bring processing into compliance, sometimes within a fixed deadline.
  • Temporary or permanent limitations on processing, including outright bans, which can halt a product or feature entirely.
  • Withdrawal of certifications issued under GDPR-approved certification schemes.

A processing ban can be more disruptive to a business than a fine of similar or greater monetary value, because it stops revenue-generating activity rather than simply reducing it. Timelines vary by supervisory authority and jurisdiction, but organizations typically receive a formal decision with a compliance deadline, and most national frameworks allow an appeal through administrative or judicial courts, which can pause enforcement while the case is reviewed.

Practical mitigation: prioritized actions for compliance officers

Reducing your exposure to a GDPR violation is less about any single control and more about building a documented, repeatable process that regulators can see was in place before an incident, not assembled afterward.

  1. Run and update data protection impact assessments for any high-risk processing activity, and keep the records current as systems change.
  2. Maintain accurate records of processing under Article 30, since this documentation is often the first thing an authority requests.
  3. Map lawful basis to every processing activity, and revisit that mapping whenever a new tool, vendor, or data flow is introduced.
  4. Vet vendors and processors with the same rigor you apply internally, since a vendor's failure can become your liability.
  5. Build a breach response runbook that supports the 72-hour notification requirement, including who signs off, what gets logged, and how remediation is proven after the fact.

Pro Tip: Treat every security questionnaire your team completes as a live inventory of your controls. If you cannot answer a question quickly and accurately, that is usually a sign your documentation, not your security, needs work.

The hardest part of breach response is rarely the technical fix, it is producing evidence fast enough to meet the notification clock and satisfy an investigating authority afterward. Manually chasing logs, past questionnaire answers, and vendor attestations across spreadsheets and email threads is where many teams lose time they cannot get back. Automation tools that centralize evidence, track document versions, and surface the right answer on demand can shorten that gap considerably, which matters both for meeting notification deadlines and for showing a regulator that mitigation was genuine and prompt, as explained in Why brands should use SaaS SEO: sustainable growth & lower costs. Our guide on technology-specific GDPR exposure in SaaS products walks through where these gaps tend to appear.

Centralized evidence workflow illustration

We see three trends worth tracking closely: the EDPB's push toward harmonized fining methodology across member states, growing scrutiny of international transfers and AI-driven profiling, and a shift toward embedding privacy into product design rather than bolting it on after launch. Compliance officers who treat privacy as a governance function, not a paperwork exercise, will handle whatever comes next.

— Gaspard

Skypher: an adjacent tool to speed evidence collection and response

None of this replaces legal judgment, but the slowest part of proving compliance is usually assembling the evidence, not deciding what to do. Skypher was built to fill that gap.

Skypher

  • The Questionnaire Automation Tool helps automate responses to security questionnaires using existing documentation.
  • The Trust Center offers a customizable interface to share compliance posture with customers and auditors.
  • Integrations with multiple third-party risk management platforms help keep evidence updated as controls evolve.

If your team spends hours per week reconstructing answers you have already given before, it is worth seeing how Skypher's Questionnaire Automation Tool handles it instead.

Sources

For decisions and methodology, go directly to the primary sources rather than summaries.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What is a GDPR violation?

A GDPR violation is any failure to meet the regulation's requirements, from missing a lawful basis for processing to failing to secure personal data adequately. Consequences range from a warning to fines under Article 83, depending on the severity and the authority's assessment.

What does GDPR mean?

GDPR stands for the General Data Protection Regulation, the European Union's law governing how personal data is collected, processed, and protected. The full legal text is published on EUR-Lex

What is considered a breach of GDPR?

A breach typically means unauthorized access, loss, or disclosure of personal data, but a GDPR violation more broadly includes any failure to meet the regulation's obligations, such as unlawful processing or ignoring data subject rights. Authorities assess breaches against the specific tier of infringement they fall under.

What are the 7 main principles of GDPR?

Definitions vary slightly by source, but the commonly cited principles are lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. These principles underpin most of the specific obligations enforced under Article 83.