Breached The GDPR? Calculate Your Own Fine!

The General Data Protection Regulation (GDPR) is a difficult piece of legislation to comply with, and not meeting some of its requirements may lead to hefty fines of up to 4% of global annual revenues of the preceding year or 20 million euros, whichever is highest. Organisations may find it difficult to calculate risk exposure when confronted with a potential breach of the GDPR, leading to frustration and often focussing on worst case scenarios only.

The European Data Protection Board (EDPB) recently issued guidelines on how Member States' data protection authorities (DPAs) should calculate fines for infringements. The guidelines follow a step-by-step approach and provide a consistent methodology for all DPAs to follow. Although these guidelines are directed toward DPAs, they also allow companies to assess their risk exposure more accurately and realistically.