What's the difference between Tier 1 and Tier 2 GDPR fines?
Tier 1 (Art. 83(4)) covers controller/processor obligations like records of processing, security, breach notification, and DPO designation — capped at €10M or 2%. Tier 2 (Art. 83(5)) covers core data-protection principles, lawful basis, consent, data-subject rights, and international transfers — capped at €20M or 4%.
Do small companies pay percentage-based fines?
DPAs apply proportionality. Smaller companies usually see the fixed cap or below, but the 'undertaking' concept means parent-company revenue can be pulled into the base — a small subsidiary of a large group can trigger 4% of the parent's global turnover.
Is this calculator legal advice?
No. This is an upper-bound estimator based on Article 83. Actual fines reflect 11 statutory factors including nature, gravity, duration, mitigation, and cooperation. Use ComplianceIQ's audit for a real gap analysis.