All articles
30. 7. 2018
1 min read

Exaggerated fears of fines for GDPR violations are (so far) unnecessary

With the GDPR coming into force, a wave of emotions, doubts and uncertainty has risen. Questions that are currently being addressed by almost every administrator: are we doing it right? Are we breaking the legislation? And if we are and the supervisory authority finds wrongdoing, how will we deal with any fine?


All of the above questions are certainly in place, but we can reassure you – the Data Protection Authority does not primarily plan to punish for minor misconduct or negligent errors.At least initially, it wants to focus primarily on educating and raising awareness among data controllers about appropriate data protection. In practice, this means that the goal of any public inspection will be to call for the correction of infringements, not to impose fines.

The DPA mentions that the reason they want to focus on explaining rather than fining is that this has worked best in practice. This is because in the case of a report of a deficiency or violation of legislation, they say, the correction and change of procedure by the controller occurs almost immediately.

The question remains to what extent we can rely on these promises. We certainly recommend that you fine-tune the GDPR to perfection and avoid the inconvenience of a fine, which would likely put your business out of business.

How high is the fine in case of a GDPR breach?

We’re not going to rub honey around your mouth. The fines are very high indeed. We can simplistically divide the offenders into two groups, which in itself reflects the importance of the breached obligations and their impact on the data protection rights of the victims.

In the lower rate group, you can be fined either up to €10,000,000 (or up to 2% of the total annual worldwide turnover if it is a business). The second group will pay even more – €20,000,000 (or up to 4% of the total annual worldwide turnover if it is a company).

Are you struggling with data protection confusion? Have you encountered an unusual situation or are you concerned about GDPR for a completely different reason? Do not hesitate to contact us, we will be happy to discuss everything with you and propose an ideal solution.

Have a project?

Get in touch and we'll discuss how we can help.
Contact us

More articles

1 Aug 2026

Cyber Resilience Act: New Rules for Secure Software and Digital Products

The European Union is introducing another important regulation in the field of cybersecurity. It is called the Cyber Resilience Act, or CRA for short, and applies to all products with a digital component. This means not only smart devices, but also software, applications, and systems that connect to a network or communicate with another service…
Read the article
15 Jul 2026

Withdrawal button – Wontilles responds in advance to new legislative requirements

The legislative environment in the field of e-commerce is undergoing constant changes, which place high demands on online shop operators.
Read the article
1 Jun 2026

Railsformers at the Faculty of Arts at the OU: Ruby on Rails in practice and now also in IT business

At the Faculty of Science of the University of Ostrava, we have long been giving students practical experience with Ruby on Rails development and showing them what it looks like to work on real web applications. From the original pilot course, we have developed a stable course Ruby on Rails I and II, which we…
Read the article