EUComply › compliance checklist › GDPR Fine Calculator
GDPR Fine Calculator
What could a GDPR violation actually cost your business? Enter your annual turnover and see both penalty tiers under Article 83 — plus the ranges regulators hand out to small sites in practice.
Lower tier — Art. 83(4): higher of €10M or 2% of turnover
Upper tier — Art. 83(5): higher of €20M or 4% of turnover
The cheapest fix: most small-site fines come from cookie consent and tracking failures you can find yourself in two minutes.
Run a free compliance scan on your site →This calculator shows theoretical maximums under Regulation (EU) 2016/679 Art. 83 and typical published enforcement outcomes. It is indicative only and not legal advice. Actual fines depend on the Art. 83(2) factors: nature and duration of the infringement, intent, mitigation, and cooperation with the supervisory authority.
How GDPR fines are calculated
GDPR has two penalty tiers. The tier depends on which article was violated, not on how much harm was done:
| Tier | Cap | Typical violations for websites |
|---|---|---|
| Lower — Art. 83(4) | €10M or 2% of annual worldwide turnover, whichever is higher | Inadequate processing records, weak security, failure to notify a data breach within 72 hours |
| Upper — Art. 83(5) | €20M or 4% of annual worldwide turnover, whichever is higher | No valid consent for cookies or advertising pixels, unlawful transfers of EU data abroad, violating core data-subject rights |
Note the word higher: a company with €100,000 turnover faces the same €10M / €20M flat caps as everyone else. The percentage only matters once it exceeds the cap — from €500M turnover up, in practice.
What small businesses actually get fined
Data protection authorities rarely impose anything near the caps on first-time offenders. Published decisions show a consistent pattern:
- Missing or non-compliant cookie banners: fines in the range of roughly €1,000–€50,000 are common for small and mid-sized sites — the banner must let visitors reject as easily as they accept, and it must appear before any tracking scripts fire.
- Advertising pixels without consent (Meta Pixel, Google Ads): similar range, often combined with a reprimand ordering immediate removal.
- Missing privacy policy or contact information: usually resolved with warnings or low four-figure fines when the site owner cooperates.
- Caps do apply to everyone: the theoretical exposure is real, but authorities weigh cooperation, size, and first-offense status heavily under Art. 83(2).
The practical takeaway: the violations that actually reach small websites — consent setup, pixels, policies — are all technical checks you can run yourself before any regulator ever looks at you.
Frequently asked questions
Can I be fined if my business is outside the EU?
Yes. GDPR applies to any business offering goods or services to people in the EU or monitoring their behaviour — regardless of where the business is registered.
Is the UK different?
The structure is identical: UK GDPR caps at £17.5M or 4% (upper tier) and £8.75M or 2% (lower tier), enforced by the ICO.
Does one fine cover everything?
No — each distinct violation can be fined separately. A single website with broken consent, unlawful transfers, and missing records can accumulate multiple fines from one investigation.
How do I check whether my site has these problems?
Our free scanner checks cookie banner behavior, tracking scripts loaded without consent, and other common violation triggers on any website — WordPress, Shopify, Wix, Webflow, or hand-coded HTML.
Need the paperwork that goes with a clean result?
The scanner finds technical problems. Pro adds the documents that go with them — an editable starter for a data processing agreement, NIS2/DORA vendor clauses and an accessibility statement, plus an HTML report from your latest scan and the same report as a PDF. 79 USD per website per year, and it is a license in the free WordPress plugin. Your site's scan history is part of it — it stays in your own WordPress, and the report can be shared with a client as a read-only link that expires, or attached as an HTML or PDF file. Hosted re-scans from our servers and the live badge are not part of it.