Supervision and penalty

Who decides the penalty, and how high can the amount go?

EU

Dataskyddsförordningen

art. 83

The supervisory authority of the main establishment decides, with cooperation and dispute resolution in the European Data Protection Board.

California Consumer Privacy Act och Federal Trade Commission Act

Cal. Civ. Code § 1798.155 och 15 U.S.C. § 45

The state regulator sets a penalty per violation, and the federal regulator acts against deceptive and unfair practice.

Deadline: No deadline stated
Penalty: Order and civil penalty for deceptive or unfair practice
Supervision: California Privacy Protection Agency och Federal Trade Commission
Read: 2026-08-22

Personal Information Protection Law

art. 66

The authority may order rectification, withdraw permits and impose fines, and responsible individuals may be held personally liable.

Deadline: No deadline stated
Penalty: Up to CNY 50 million or five percent of the previous year's turnover
Supervision: Cyberspace Administration of China
Read: 2026-08-22

This page restates written law with the provision and the official source. It is not legal advice in an individual matter.

Next step

Three ways to put the register to work in your own practice.

Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.