How are fines determined under GDPR?

Authorities weigh nature, gravity, duration, intent, mitigation, and prior history; penalties may include significant fines and corrective orders.

What is GDPR?

Short answer: GDPR sets rules for processing personal data of people in the EU/EEA. You must have a lawful basis (e.g., consent, contract, legitimate interests), be transparent, collect only what’s necessary, protect it with appropriate security, respect individual rights (access, deletion, objection, portability, etc.), document decisions, manage vendors, report certain breaches within 72 hours, and govern cross-border transfers using approved mechanisms (e.g., SCCs, adequacy).

Core Principles Of GDPR Compliance

Scope & Applicability — Applies extraterritorially to organizations processing EU/EEA residents’ data, regardless of company location.

Personal Data Defined — Any information that identifies or can identify a natural person (e.g., name, email, ID, cookie IDs, IPs when identifiable).

Lawful Bases — Consent, contract, legal obligation, vital interests, public task, or legitimate interests with balancing test.

Data Subject Rights — Access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making.

Accountability — Maintain records (RoPA), assign responsibilities, conduct DPIAs for high-risk processing, and evidence compliance.

Security & Breaches — Implement appropriate technical/organizational measures; notify authorities within 72 hours if required.

Vendors & Contracts — Controller/processor contracts (DPAs) with clear instructions, confidentiality, and sub-processor controls.

International Transfers — Use adequacy decisions, SCCs, BCRs, or other permitted tools with supplementary measures as needed.

GDPR Compliance Playbook

A practical sequence to operationalize lawful, secure, and transparent data processing.

Step-By-Step

Map your data — Inventory systems, data categories, purposes, retention, and transfer locations; identify high-risk uses.
Define roles — Determine controller vs. processor responsibilities; appoint a DPO if legally required or advisable.
Select lawful bases — Document the basis per purpose; avoid “consent by default” where contract or legitimate interests fit better.
Update notices — Provide concise, layered privacy notices covering purposes, rights, contact, and transfer details.
Consent & preferences — Implement granular opt-in where needed, with easy withdrawal and auditable records.
Enable rights — Build intake, verification, fulfillment, and logging for access/erasure/portability/objection requests.
Security controls — Apply encryption, access management, data minimization, pseudonymization, and retention schedules.
Run DPIAs — Assess and mitigate risks for profiling, monitoring, large-scale sensitive data, or novel tech.
Vendor governance — Execute DPAs, review sub-processor lists, and monitor safeguards and SOC2/ISO certifications.
Cross-border transfers — Use adequacy, SCCs, or BCRs; add supplementary measures where risk requires.
Incident response — Establish detection, assessment, notification, and post-mortem processes aligned to 72-hour rules.
Audit & improve — Maintain RoPA, test controls, train staff, and refresh assessments on change.

Lawful Bases For Processing: When To Use Each

Lawful Basis	Best For	Documentation	Pros	Limitations	Examples
Consent	Non-essential cookies, marketing, sensitive data where permitted	Explicit records; easy withdrawal	Clear choice; strong transparency	Must be freely given; no bundling with services	Email campaigns with opt-in; optional personalization
Contract	Processing necessary to deliver a service the user requested	Terms and service scope	Straightforward for core features	No expansion beyond necessity	Account provisioning; shipping orders
Legal Obligation	Compliance with non-contractual laws	Citations to applicable laws	Required for regulators	Narrow scope; no secondary use	Tax records; AML checks
Vital Interests	Life-or-death emergencies	Risk rationale	Covers urgent scenarios	Exceptional; rarely applicable in B2B	Medical emergencies
Public Task	Official authority or public interest tasks	Legal mandate	Supports public functions	Primarily for public bodies	Public registries
Legitimate Interests	Reasonable business purposes after balancing test	LIA (purpose, necessity, balancing)	Flexible where risks are low	Not for sensitive data or children without caution	Fraud prevention; basic analytics

Client Snapshot: Privacy-By-Design Pays Off

A global B2B platform mapped data flows, implemented granular consent, migrated to server-side tagging, and standardized DPAs. Within two quarters, rights request SLAs dropped to 6 days on average, breach readiness drills cut response time by 41%, and audit findings fell to zero critical issues.

Embed privacy into every lifecycle stage so trust, security, and growth reinforce each other.

FAQ: Understanding GDPR

Straightforward answers for leaders, legal, security, and operations teams.

Who does GDPR apply to?

Organizations anywhere that offer goods/services to, or monitor behavior of, people in the EU/EEA—whether B2C or B2B.

What counts as personal data?

Any information that can identify a person directly or indirectly: names, emails, IDs, device identifiers, IP addresses when identifiable, location data, and more.

Do we need a Data Protection Officer (DPO)?

Appoint one if you are a public authority, conduct large-scale monitoring, or process special categories of data at scale; others may designate a privacy lead voluntarily.

How fast must we respond to rights requests?

Without undue delay and within one month (extendable by two months for complex or numerous requests, with notice).

How are fines determined?

Supervisory authorities consider nature, gravity, duration, intent, mitigation, and history. Breaches can trigger significant administrative fines and corrective orders.

How do international data transfers work?

Use an adequacy decision where available; otherwise apply Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or other lawful mechanisms with risk-appropriate safeguards.

Build Trust With Confident Compliance

We help you operationalize GDPR from strategy to execution—policies, tooling, and workflows that scale.

Assess Your Maturity Scale Operational Excellence

Explore More

Revenue Marketing Architecture Guide Revenue Marketing Index Customer Journey Map (The Loop™) Marketing Operations Services

Compliance & Regulations:
What Is GDPR?