Skip to content 
DSGVO-Bußgeld
In brief
A GDPR fine is a monetary penalty imposed by a data protection supervisory authority under Art. 83 GDPR for violations of the General Data Protection Regulation. Depending on the violation, the range extends up to 10 million euros or 2% or up to 20 million euros or 4% of worldwide annual turnover, whichever amount is higher. In IT retirement, fines threaten, for example, after data breaches caused by uncleared old devices.
How high can a fine under Art. 83 GDPR be?
| Level | Examples of violations | Maximum limit |
|---|---|---|
| Art. 83 (4) | Obligations of the controller and processor, such as security of processing (Art. 32) and notification of data breaches (Art. 33, 34) | €10 million or 2% of annual turnover |
| Art. 83 (5) | Principles of processing (Art. 5), legal bases, rights of data subjects | €20 million or 4% of annual turnover |
Within this range, the authority takes into account, among other things, the nature, gravity and duration of the infringement, intent or negligence, protective measures taken and cooperation with the authority. According to the case law of the European Court of Justice, a fine can be imposed directly on the company without a specific responsible person having to be named. In Germany, the supervisory authorities do not impose fines on public bodies under § 43 BDSG.
What this means for retired IT
If data from old devices ends up in the wrong hands, the authority mainly examines whether appropriate measures under Art. 32 GDPR were in place and whether the Data breach was reported in time. Erasure and destruction evidence per device helps to prove your own due diligence. Which evidence counts in the audit is explained in our guide Disposing of data carriers under the GDPR. Second IT provides a digitally signed erasure certificate per device for this purpose. This entry does not replace legal advice.
Frequently asked questions about the GDPR fine
Which turnover counts in the calculation?
The worldwide annual turnover of the preceding financial year is decisive. For corporate groups, according to the case law of the European Court of Justice, the turnover of the entire group of undertakings can be used as the basis.
Are there other consequences besides fines?
Yes. Data subjects can claim damages under Art. 82 GDPR. In addition there are orders from the authority and possible reputational damage.
Can a fine be imposed even without a data breach?
Yes. Missing protective measures or missing documentation can also be an infringement, even if no data has yet leaked.
Who imposes a GDPR fine and what determines the amount?
The competent data protection supervisory authority imposes a GDPR fine under Art. 83 GDPR. Within the range, factors that count include the nature, gravity and duration of the infringement, intent or negligence, protective measures taken and cooperation with the authority.
How do you prevent GDPR penalties for retired IT?
Prove that appropriate protective measures under Art. 32 GDPR were in place, and report data breaches in time. For old devices, erasure and destruction evidence per device helps. It shows the authority that you acted with the necessary care.
Evidence instead of risk: an erasure certificate for every device.
Send us your device list. You will receive your offer in 48 hours on average.