GDPR Fine Exposure Calculator

Five-step methodology of the EDPB Guidelines 04/2022 on the calculation of administrative fines (version 2.1). Starting points and maxima are computed from the Guidelines; Steps 3 and 5 are your discretionary inputs.

Chapters 3 and 6The addressee

The turnover is that of the undertaking as a single economic unit, so the consolidated group turnover where there is a group (paras 120 to 122, 130). Use the financial year preceding the final decision (para 131).

Addressee

Steps 1 to 4Infringements

Group infringements into conducts. Infringements of the same or linked processing operations form one conduct, and their total cannot exceed the highest legal maximum among them (Art. 83(3), paras 39 to 43). Separate conducts are fined separately and can exceed a single maximum (para 45). If one infringement precludes another (specialty, subsidiarity, consumption), keep only the superseding one (para 31).

Step 3Aggravating and mitigating circumstances

Chapter 5 gives no percentages and says none can be predetermined (para 71). Use this checklist to document the direction of each factor, then enter the net adjustment in each infringement above. Art. 83(2)(a), (b) and (g) are already priced into the seriousness level, so do not count them again (para 72).

Step 5Effectiveness, proportionality, dissuasiveness

A final check on the whole fine. Increase it if it is not dissuasive enough, for example with a deterrence multiplier (para 144), or reduce it for proportionality or inability to pay, which needs exceptional circumstances and objective evidence (paras 139 to 141). Do not repeat the turnover-based adjustment already made in Step 2 (para 64). The result is capped at the legal maximum (para 134).

Positive to increase, negative to decrease.

These are starting points for further calculation, not price tags. The Guidelines state that a fine can be any amount up to the legal maximum, that supervisory authorities need not follow every step, and that precise prediction of a fine is not possible (paras 5, 6, 47, 69, 145). This tool is a modelling aid for exposure analysis, not a forecast.

The mapping of each provision to Art. 83(4) or 83(5)/(6) comes from the text of Art. 83 GDPR, not from the Guidelines, and can be overridden for every infringement. Check it against the Regulation. Seriousness ranges follow para 60, size adjustments paras 65 and 66, maxima paras 114 to 116, and the Annex tables serve as the cross-check.