When calculating a GDPR fine capped as a percentage of annual turnover, which high-level concept should privacy counsel treat as the relevant turnover base?
Select an answer to reveal the explanation.
Short Explanation
Fine math is not about one tiny subsidiary’s spare change. GDPR percentage caps track the undertaking’s turnover—often the economic group, competition-law style. Counsel should not pretend the fine base is just the desk that made the mistake.
Full Explanation
When calculating a GDPR fine capped as a percentage of annual turnover, privacy counsel should treat the relevant base as the undertaking’s annual turnover in the competition-law sense, which may look beyond a single legal entity to the economic group. That approach prevents artificial fine shrinkage by parking risk in a tiny affiliate while the wider economic unit profits from the processing. Using only the personal salary budget of the employee who clicked the wrong button fails by inventing an individual-pay fine base Article 83 does not use. Counting worldwide revenue of every vendor that ever touched any personal data, regardless of control, fails by over-inclusively treating unrelated vendors as the undertaking. Using the supervisory authority’s own annual operating budget fails as an irrelevant proxy. Exam caveat: whether entities form a single undertaking is fact-specific; percentage caps still interact with the €10M/€20M floors/ceilings and Article 83 factors inside the maximum. Operational check: map corporate control and decision-making for undertaking analysis, estimate group turnover exposure in risk registers, and avoid relying on low-turnover affiliate optics when briefing boards.