Guidelines 04/2022 on the calculation of administrative fines under the GDPR

What it covers

These guidelines set out a five-step methodology that supervisory authorities use to calculate the amount of administrative fines under Article 83 GDPR, covering identification of processing operations, the starting point for calculation, aggravating and mitigating circumstances, the legal maximum, and the final assessment of effectiveness, proportionality and dissuasiveness. They complement the earlier WP253 guidelines on when to impose a fine.

Why it matters

It is the EDPB's authoritative methodology for quantifying GDPR fines, so it is central to understanding how enforcement outcomes and sanction amounts are derived in practice.

Refer to it when

• assessing how a fine amount was or should be calculated
• understanding aggravating or mitigating factors in enforcement
• researching the legal maximum fine for an infringement
• analysing corporate liability and turnover in fine calculation

Questions this document addresses

• What methodology do supervisory authorities use to calculate fines?
• How are aggravating and mitigating circumstances taken into account?
• How is the legal maximum fine determined?
• How is an undertaking's turnover assessed for fine purposes?

Topics

• Administrative fines
• Enforcement
• Supervisory authorities