Back to Module
9 of 18|History of Data Protection
video 15 min•GDPR Journey
GDPR Penalties
The massive fines that changed corporate behaviour globally.
🎯 Learning Objectives
- ▸ Understand the two-tier fine structure
- ▸ See real-world examples of GDPR fines
- ▸ Compare GDPR fines with DPDPA fines
The Two-Tier System
The GDPR distinguishes between less severe and more severe violations.
- • Tier 1 (Lower): Up to €10 million or 2% of global annual turnover (whichever is higher) for violations like failing to keep records or not notifying a breach.
- • Tier 2 (Upper): Up to €20 million or 4% of global annual turnover for violations of core principles, consent rules, and data subject rights.
Real-World Fines
Meta (Facebook) was fined €1.2 billion in 2023 for transferring EU user data to the US without adequate safeguards. Amazon was fined €746 million for targeted advertising violations.
India's DPDPA takes a different approach. Instead of turnover-based fines, it uses fixed maximums (up to ₹250 crore). For a small startup, a ₹50 crore fine is as devastating as a €20 million fine is for a multinational.
📖 Glossary
- Turnover-based fines
- Fines calculated as a percentage of a company's global annual revenue, ensuring the penalty scales with company size.
🔑 Key Takeaways
- Tier 1 fines: Up to €10 million or 2% of global turnover.
- Tier 2 fines: Up to €20 million or 4% of global turnover.
- Meta was fined €1.2 billion for data transfers.
📚 Further Reading
- GDPR Enforcement Tracker — CMS Law (2024)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...