EU regulatory register · GDPR
Article 83General conditions for imposing administrative fines
CELEX 32016R0679 · Read on 2026-08-18 · Chapter VIII
How high can GDPR fines be?
Under Article 83 of the GDPR (EU) 2016/679 there are two tiers. Breaches of, among others, controller and processor obligations can lead to fines of up to EUR 10 million or 2 percent of global annual turnover. Breaches of the core principles, legal basis, data subject rights and transfer rules can reach EUR 20 million or 4 percent. Whichever is higher applies.
EUR-Lex · Source: NovaCopilot
Short answer
1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-83 · Short answer as data · Official text
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
(a)
the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;
(b)
the intentional or negligent character of the infringement;
(c)
any action taken by the controller or processor to mitigate the damage suffered by data subjects;
(d)
the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;
(e)
any relevant previous infringements by the controller or processor;
(f)
the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
The article continues in the official text.
Follow-up questions
Other articles in this chapter
Judgments of the Court of Justice
5 decisions
- C-383/23Court of Justice of the European Union
Criminal proceedings against ILVA A/S
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 83(4) to (6) and (9) – Concept of an ‘undertaking’ – Parent company and subsidiary – Infringement of that regulation by a subsidiary – Calculation of the amount of the fine – Consideration of the total turnover of the group of which that subsidiary forms part.
Ask NovaCopilot - C-590/22Court of Justice of the European Union
AT and BT v PS GbR and Others
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82(1) – Right to compensation for damage caused by data processing which infringes that regulation – Concept of ‘non-material damage’ – Impact of the seriousness of the damage suffered – Assessment of the amount of compensation – Claim for compensation for non-material damage based on fear – Inapplicability of the criteria laid down for administrative fines in Article 83 – Dissuasive function – Assessment where that regulation and national law are infringed simultaneously.
Ask NovaCopilot - C-741/21Court of Justice of the European Union
GP v juris GmbH
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82 – Right to compensation for damage caused by data processing that infringes that regulation – Concept of ‘non-material damage’ – Impact of the seriousness of the damage suffered – Liability of the controller – Possible exemption in the event of default of a person acting under his or her authority within the meaning of Article 29 – Assessment of the amount of compensation – Inapplicability of the criteria laid down for administrative fines in Article 83 – Assessment in the event of multiple infringements of that regulation.
Ask NovaCopilot - C-683/21Court of Justice of the European Union
Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Article 83 – Imposition of administrative fines – Conditions – Requirement that the infringement be intentional or negligent – Responsibility and liability of the controller for the processing of personal data carried out by a processor.
Ask NovaCopilot - C-807/21Court of Justice of the European Union
Deutsche Wohnen SE v Staatsanwaltschaft Berlin
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Article 58(2) – Powers of supervisory authorities to apply corrective measures – Article 83 – Imposition of administrative fines on a legal person – Conditions – Discretion of the Member States – Requirement that the infringement be intentional or negligent.
Ask NovaCopilot
Judgments applying this article
16 judgments in the register cite the article in their text. EU 12 · DE 4
- eu:c-807-21
- eu:c-683-21
- eu:c-383-23
- eu:c-590-22
- eu:c-741-21
- eu:c-507-23
- eu:c-654-23-62023cj0654
- eu:c-768-21
- eu:c-484-24-62024cj0484
- eu:c-60-22
- eu:c-655-23-62023cj0655
- eu:c-687-21
Source: NovaCopilot
Recitals that carry the interpretation
The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.
Skäl 148 · Article 83
Fines must be effective, proportionate and dissuasive in each individual case.
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit