GDPR fines for startups: what Article 83 actually says

6 min read · Updated 2026-11-12

Article 83 of the GDPR sets the framework for administrative fines. The ceilings are high, and authorities have used them. That does not mean every gap in a startup's paperwork leads to a maximum fine. Understanding the actual rule helps you plan calmly and ignore marketing that sells fear.

The two ceilings

For certain infringements, including of the principles, lawful bases, data subject rights and the rules on transfers, the ceiling is up to 20 million euros or 4% of total worldwide annual turnover in the preceding financial year, whichever is higher. For other infringements, including of some organisational and processor duties, the ceiling is up to 10 million euros or 2% of that turnover, whichever is higher.

Turnover is your group's real turnover, not a slogan. For a pre-revenue company the euro ceiling is the relevant cap, but the AP must still apply the criteria in Article 83(2).

How a fine is decided

Article 83(2) requires the authority to look at the facts: the nature, gravity and duration of the infringement, whether it was intentional or negligent, any action you took to mitigate damage, previous infringements, the categories of data, how the authority found out, your degree of cooperation, and whether you made a profit from the breach, among other factors. Fines are supposed to be effective, proportionate and dissuasive.

The AP publishes its fining policy and its decisions. Many enforcement files start with a complaint, a breach notification, or a media report, not with a random audit of every startup. A prompt, honest response and a real remediation plan matter. Hiding a qualifying breach is a separate problem: Article 33 requires notification to the AP without undue delay and, where feasible, within 72 hours of becoming aware of it.

A proportionate response

Do the basics well: a truthful privacy notice, a lawful basis you can explain, processor agreements, a record of processing, a breach plan, and no tracking before consent. That is more useful than buying a 'certified' badge from a body that is not accredited under Articles 42 and 43.

DPOne will not promise that you will avoid a fine. We will help you produce evidence of what you actually do, within a stated scope, and have critical findings reviewed by a person.

Frequently asked questions

Can the AP fine a very small company?

Yes. The size of the company is a factor in proportionality, not a free pass. The AP has fined small organisations when the facts justified it.

Is a data breach automatically a fine?

No. A breach must be notified when it is likely to result in a risk to people. A fine may follow, or it may not, depending on the Article 83(2) criteria and on whether you met your notification and security duties.