Key points
- Under Article 83 of the GDPR, non-compliance exposes you to fines of up to €10 million or 2% of total worldwide annual turnover, or even €20 million or 4% for the most serious infringements.
- In France, Article 226-17 of the French Criminal Code (Code pénal) provides for up to five years’ imprisonment and a €300,000 fine for processing carried out without the security measures required by the GDPR (Articles 24, 25, 30 and 32).
- Law No. 2018-493 of 20 June 2018 adapted the French Data Protection Act (loi “Informatique et Libertés”) to the GDPR; the penalties are set out in Articles 226-16 et seq. of the Criminal Code.
- This article cites penalties imposed by the CNIL (French data protection authority): €50 million against Google in 2019, €27 million against Free Mobile and €5 million against France Travail (French public employment service) in 2026.
- Common breaches involve a lack of transparency, failure to respect individuals’ rights and poor management of internal policies.
- Prevention relies on regular compliance audits and training employees on GDPR requirements.
The GDPR is an essential issue for every business, but it can seem complex to master. You are probably concerned about the risk of financial penalties for non-compliance. Are you wondering how to avoid these heavy fines? European regulation imposes fines of up to €20 million or up to 4% of annual turnover. This may seem daunting, but understanding the most common infringements and knowing how to prevent them can make all the difference. In the event of a breach, the consequences go well beyond mere financial penalties. They can include prison sentences. Your business must therefore not only comply with GDPR standards, but also know how to apply them day to day. To help you, we set out here the main penalties and the preventive measures you need to know to approach this legislation with peace of mind.
GDPR fines for non-compliance
The GDPR provides for several types of financial penalties that can be imposed on businesses for infringements. The administrative fines imposed can vary according to the nature and seriousness of the infringement.
Under Article 83 of the GDPR, infringements can lead to fines of up to €10 million or, in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
Seriousness of the infringements
Where the infringement concerns the basic principles for processing, data subjects’ rights, transfers outside the European Union or non-compliance with an order of the supervisory authority, fines can reach €20 million or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
Conversely, failure to comply with data protection by design and by default (Article 25) falls under the €10 million or 2% ceiling (Article 83(4)); it can nevertheless lead to a substantial fine, which underlines the importance of putting adequate security measures in place. For businesses seeking to strengthen their compliance, it is worth consulting a GDPR lawyer.
- Lack of transparency towards data subjects.
- Failure to respect individuals’ rights (right of access, right to be forgotten, etc.).
- Poor management of internal data protection policies.
Criminal penalties for GDPR breaches in France
In France, failure to comply with the GDPR can also lead to criminal penalties. Articles 226-16 et seq. of the French Criminal Code, applicable since the French Data Protection Act (loi “Informatique et Libertés”) was adapted by Law No. 2018-493 of 20 June 2018, provide for specific penalties for breaches of obligations relating to data protection.
Imprisonment and fines
Article 226-17 of the Criminal Code punishes carrying out, or having carried out, processing of personal data without implementing the measures provided for in Articles 24, 25, 30 and 32 of the GDPR with five years’ imprisonment and a fine of €300,000.
Article 226-16 of the same code provides for the same penalties for processing carried out, including through negligence, without complying with the prior formalities required by law.
Recent GDPR fines
Since the GDPR came into force, several companies have received heavy penalties for their lack of compliance. These cases are important reminders of the significance of the legal obligations in force.
Notable examples
| Company | Infringement | Amount of the fine |
|---|---|---|
| Insufficient transparency and lack of valid consent for ad personalisation | €50 million | |
| Free Mobile | Insufficient security measures and information given to subscribers after an intrusion in October 2024 | €27 million |
| France Travail | Insufficient security measures (Article 32 of the GDPR) | €5 million |
Failing to appoint a DPO where the GDPR requires one also exposes you to an administrative fine of up to €10,000,000 or 2% of total worldwide annual turnover (Article 83(4)). Our article When is a DPO mandatory? sets out the cases concerned. The role can be entrusted to an outsourced DPO.
How can you avoid GDPR fines?
To avoid the heavy penalties associated with GDPR non-compliance, you should implement a clear set of good practices and keep constant watch over compliance.
A good starting point is to know how to bring your terms and conditions and privacy policy into compliance.
Practical tips
- Carry out regular compliance audits to identify and remedy potential weaknesses.
- Train your employees on GDPR requirements and data protection best practice.
- Put in place robust technical and organisational measures to ensure data security.
- Appoint a competent and well-informed Data Protection Officer (DPO).
- Establish clear and accessible internal policies on the processing of personal data.
Frequently asked questions about GDPR fines
What are the maximum fines for GDPR non-compliance?
Can you be imprisoned for GDPR non-compliance in France?
How can you avoid GDPR fines?
- Carry out regular compliance audits.
- Raise awareness and train internal staff.
- Put in place rigorous security measures.
- Appoint a Data Protection Officer (DPO).
- Establish and circulate clear internal policies on personal data.
