At Body of Knowledge depth, how are the GDPR's two administrative-fine tiers commonly described?
Select an answer to reveal the explanation.
Short Explanation
Two speed limits, not one: some breaches top out around the 2%/€10M band, the heavier ones around 4%/€20M—whichever figure is higher. It's a tiered stick, not a flat parking ticket.
Full Explanation
At Body of Knowledge depth, the GDPR’s two administrative-fine tiers are commonly described as lower-tier infringements up to €10 million or 2% of worldwide annual turnover, and higher-tier infringements up to €20 million or 4%, whichever figure is higher in each band. Those caps signal how seriously the Union treats accountability failures that can harm people at scale. A single flat fee of exactly €500 for every infringement worldwide fails by inventing a parking-ticket model the Regulation does not use. Fines only in US dollars assessed exclusively by the FTC fails by wrong currency and wrong enforcer for GDPR administrative fines. Unlimited personal prison sentences issued directly by the EDPB for typographical errors fails by conflating administrative fines with criminal sentencing and inventing Board criminal power over typos. Exam caveat: the applicable tier depends on which provisions are infringed; percentage caps reference undertaking turnover, and authorities still apply Article 83 factors for proportionality within the ceiling. Operational check: classify potential infringements against the 2%/€10M versus 4%/€20M bands, estimate group turnover exposure, and stress-test remediation budgets against realistic fine scenarios—not folklore flat fees.