The board asks the person responsible for compliance how much the company will realistically pay if last week’s data leak ends in proceedings before the Polish supervisory authority. The answer “up to 20 million euros” reassures nobody and says little, because it is a ceiling, not a rate. In a specific case, the authority calculates the amount using a method you can trace in the statements of reasons of its decisions.
GDPR fines depend on the category of the infringement, its seriousness, the size of the company and how it behaved before and after the incident. Two of these factors are within the company’s control in advance: the level of security, which is the daily work of the team responsible for cybersecurity, and the way it responds to a breach. Three decisions of the President of the Polish Personal Data Protection Office (UODO) from 2024–2026 show how those factors translate into specific amounts.
How high can GDPR fines be?
GDPR fines reach EUR 10,000,000 or 2% of an undertaking’s total worldwide annual turnover for infringements under Article 83(4) GDPR, and EUR 20,000,000 or 4% of turnover for infringements under Article 83(5) and (6), whichever is higher. Turnover is taken from the preceding financial year.
UODO calls the turnover-based ceiling the “dynamic maximum amount of the fine”. In decision DKN.5131.4.2025 of 2 January 2026, it exceeded the static EUR 10,000,000, so it set the cap. Polish law converts the euro amounts into zloty at the National Bank of Poland’s average exchange rate of 28 January each year (Article 103 of the Polish Personal Data Protection Act).
Legal status as of 23 September 2026: Article 83 GDPR applies in its 2016 wording, and Articles 101–103 and 105 of the Polish Personal Data Protection Act apply as worded in the 2019 consolidated text, which the 2026 amendments did not change. Rules on fines for public bodies and on payment are Polish law; other EU Member States set their own. Our GDPR guide gives a general overview of the consequences of breaching the GDPR, including compensation and criminal liability.
Which infringements carry the lower cap and which the higher one?
The lower cap applies to organisational and technical obligations, the higher one to basic principles, data subjects’ rights and data transfers. Article 83(4)(a) covers the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43: among others data protection by design, processing agreements, the record of processing activities, security of processing, breach notification and the position of the data protection officer.
Article 83(5) covers the processing principles and conditions for consent (Articles 5, 6, 7 and 9), data subjects’ rights (Articles 12 to 22), transfers of personal data to third countries (Articles 44 to 49) and non-compliance with orders of the authority. Paragraph 6 repeats the higher cap for failing to comply with an order under Article 58(2).
The line between the categories is often thinner than the list suggests. In decision DKN.5131.5.2025, UODO classified the missing safeguards under Articles 25, 28 and 32 as falling under Article 83(4), but their consequence, a breach of the confidentiality and accountability principles in Article 5, as falling under Article 83(5). Where several provisions are infringed in the same or linked processing operations, the total fine may not exceed the amount for the gravest infringement (Article 83(3)).
How much can a public authority in Poland be fined?
A Polish public finance sector unit pays at most PLN 100,000 or PLN 10,000, depending on the type of unit. Article 83(7) GDPR lets each Member State decide whether and to what extent public authorities and bodies can be fined. Poland did so in Article 102 of its Personal Data Protection Act.
UODO can impose up to PLN 100,000 on public finance sector units listed in Article 9(1)–(12) and (14) of the Public Finance Act, research institutes and the National Bank of Poland, and up to PLN 10,000 on units listed in Article 9(13) of that Act. Both fines are imposed on the basis of and under the conditions of Article 83 GDPR, so the calculation method is the same and only the cap changes.
Other entities, including private companies, are fined under the general rules (Article 101 of the Act). Article 101a adds an obligation that is easy to forget during proceedings: at UODO’s request, they must provide the data needed to determine the basis for the fine within 30 days. If a company fails to do so, the authority estimates the basis, taking into account the size of the entity, the specifics of its business and publicly available financial data.
What determines the amount of a fine under Article 83(2)?
The amount of a fine depends on eleven factors listed in Article 83(2)(a) to (k) GDPR, which the authority assesses separately in each case. They include the nature, gravity and duration of the infringement, intent or negligence, action taken to mitigate the damage, measures under Articles 25 and 32, previous infringements, cooperation with the authority, the categories of data and the way the authority learned of the infringement.
In the statements of reasons of its decisions, UODO divides these factors into two groups. The “seriousness” of the infringement consists of points (a), (b) and (g), the objective side: what happened, whether it was intentional and which data it concerned. The remaining factors concern the perpetrator and its conduct before, during and after the infringement, and act as aggravating or mitigating factors.
Above all of this stands Article 83(1): the fine must be effective, proportionate and dissuasive in each individual case. That requirement returns at the end of the calculation as a separate test.
How does a supervisory authority calculate a fine step by step under EDPB Guidelines 04/2022?
The authority calculates the fine in five steps described in EDPB Guidelines 04/2022 on the calculation of administrative fines, adopted after public consultation on 24 May 2023 (version 2.1). The steps are as follows:
- Identifying the processing operations and assessing whether Article 83(3) applies (several infringements in linked operations).
- Setting the starting amount: the category of infringement, its seriousness in the circumstances of the case and the undertaking’s turnover.
- Taking aggravating and mitigating factors into account.
- Checking the caps in Article 83(4) to (6).
- Assessing whether the amount is effective, proportionate and dissuasive, with any adjustment within the cap.
Step two is the key one. For a low level of seriousness, the starting amount lies between 0 and 10% of the fine cap, for a medium level between 10 and 20%, and for a high level between 20 and 100%. For smaller undertakings, the guidelines allow the amount to be reduced: with turnover up to EUR 2 million to 0.2–0.4% of the identified amount, with turnover from EUR 2 to 10 million to 0.3–2%, and from EUR 10 to 50 million to 1.5–10%.
The EDPB stresses that calculating a fine is “no mere mathematical exercise” and that the circumstances of the case determine the amount.
Key takeaways:
- The cap is 2% or 4% of turnover (or EUR 10 or 20 million), and for Polish units covered by Article 102 of the Act PLN 100,000 or PLN 10,000.
- The starting amount depends on seriousness: 0–10%, 10–20% or 20–100% of the fine cap.
- Mitigating factors work in percentages: in decision DKN.5131.5.2025 they reduced the fine by 30%.
What does the calculation look like in a real decision of the Polish DPA?
You can follow the calculation step by step in decision DKN.5131.5.2025 of 25 May 2026, in which a district head (starosta) was fined PLN 21,000. The proceedings began with a breach notification: in January 2023, a work laptop of an employee of the processor that handled data for the district office was stolen from a car boot. The laptop’s disk was not encrypted.
As of 23 September 2026: decisions DKN.5131.5.2025, DKN.5131.1.2024 and DKN.5131.4.2025 are marked as non-final in the UODO decisions portal.
UODO found that the district head had not implemented risk-based measures for laptops, had not ensured regular testing of their effectiveness and had not checked whether the processor offered sufficient guarantees. The infringement was assessed as highly serious, so the starting amount had to fall between PLN 20,000 and PLN 100,000. The authority set it at PLN 30,000, which is 30% of the cap under Article 102(1).
The authority found no aggravating factors. As a mitigating factor, it accepted the steps taken to improve the security of processing and reduced the fine by 30%, to PLN 21,000. The effectiveness, proportionality and dissuasiveness test required no further adjustment. In the same decision, the processor received a separate fine of PLN 12,500, reduced by 50% for ending the infringement, for infringing Article 32(1) and (2) in conjunction with Article 28(3)(c) and (f). Article 32(1)(a) GDPR lists encryption as an example of a security measure, and in the decision the missing control on a portable device is not described as bad luck but as the result of failing to implement measures based on risk analysis.
Why does a large company pay millions even for a low-seriousness infringement?
A large company pays millions because the percentage from step two is applied to the fine cap set by its turnover, not to EUR 10 or 20 million. In decision DKN.5131.1.2024 of 20 August 2024, a bank was fined PLN 4,053,173 for not notifying customers of a data breach (Article 34(1) and (2) GDPR). An employee of the processor had sent customers’ bank documents to another bank, and the data included PESEL national identification numbers and ID card series and numbers.
UODO assessed the infringement as having a low level of seriousness and set the starting amount at 2% of the dynamic maximum amount of the fine. The authority did not reduce that amount, as the guidelines allow for smaller companies, because for a very large entity its size is already reflected in the dynamic maximum amount. It treated intent as aggravating, because the bank had made a conscious decision not to notify customers, and found no mitigating factors.
A similar mechanism works in decision DKN.5131.4.2025 of 2 January 2026. A company was fined PLN 978,128 for failing to ensure the independence of its data protection officer and allowing a conflict of interest (Article 38(3) and (6)). The authority assessed the seriousness as medium and set the starting amount at 10% of the fine cap, and the long duration of the infringement, more than 6 years after the GDPR became applicable, increased the fine.
Is a fine the only sanction the Polish DPA can impose?
A fine is not the only sanction: UODO has the corrective powers of Article 58(2) GDPR and imposes a fine in addition to or instead of them. Among other things, the authority can issue a reprimand, order processing to be brought into compliance or data subjects to be notified of a breach, and limit or ban processing.
An order comes at a price. Failing to comply with it is subject to the higher cap in Article 83(6), up to EUR 20,000,000 or 4% of turnover, regardless of what the original infringement concerned. A company that has received an order should treat its compliance deadline like a payment deadline.
Where does the money from fines go, and when do you have to pay?
In Poland, the money from fines goes to the state budget, and since 3 April 2026 half of the revenue from fines for infringing data security provisions has funded the Cybersecurity Fund. This change to Article 104 of the Polish Personal Data Protection Act was introduced by the amendment to the Act on the National Cybersecurity System (Journal of Laws 2026, item 252). The 50/50 split applies to fines for infringing Article 5(1)(f), Article 25(1) and (2), Article 28(3)(c) and Article 32(1) and (2) GDPR.
The fine is payable within 14 days of the deadline for filing a complaint or of the day the administrative court’s judgment becomes final (Article 105(1) of the Act). At the request of the fined entity, and in view of its important interest, UODO may postpone the deadline or spread the fine into instalments, with interest on the unpaid amount.
Which Article 83(2) factors can you prepare before a breach happens?
You can prepare in advance mainly the factors that concern your company’s conduct: security measures, incident response, cooperation with the authority and financial data. The seriousness of an infringement cannot be changed after the fact, but mitigating factors and the absence of aggravating ones depend on decisions taken earlier. The table below links the Article 83(2) criteria to what the authority examined in the decisions discussed.
| Factor | What the authority assesses | What to prepare in advance | Evidence in proceedings |
|---|---|---|---|
| Degree of responsibility, measures under Articles 25 and 32 (point d) | whether safeguards were based on risk analysis and tested | risk analysis for portable devices and providers, disk encryption, a testing plan | test results, device configuration report |
| Mitigating the damage (point c) | what was done for the data subjects | response procedure: remote lock, password resets, information for data subjects | action log with times |
| How the authority learned of the infringement (point h) | whether and when the breach was notified | procedure for assessing a breach within 72 hours (Article 33) | entry in the internal breach register, copy of the notification |
| Intent (point b) | whether an omission was a conscious decision | documented risk assessment behind a decision not to notify data subjects (Article 34) | memo with the assessment, author and date |
| Cooperation with the authority (point f) | timeliness and completeness of replies | one contact person, organised documentation | correspondence with dates |
| Other factors (point k) | remedial action after the incident | remediation plan with owners and deadlines | record of implemented changes |
| Data for calculating the fine (Article 101a of the Polish Act) | basis for the fine | financial statements ready to hand over | data provided within 30 days |
The intent row follows directly from the bank case: the decision not to notify customers was conscious, so such a decision needs a documented risk assessment, not one person’s intuition.
How can nFlo help you reduce the risk of a GDPR fine?
nFlo helps prepare the factors that the authority assesses in proceedings as part of the Comprehensive GDPR Review and Advisory service in the “Governance, risk and compliance” area. The service covers an inventory of data processing, a review of data processing agreements, an assessment of technical measures, a gap analysis report, a prioritised remediation plan and documentation templates, including breach handling procedures.
Combining the assessment of technical measures with the response procedure brings the most value, because in two of the three decisions described the outcome turned on security measures and breach response. nFlo does not provide legal advice and does not represent companies in proceedings before the supervisory authority or the courts. If you want to check how your organisation would fare in such proceedings, contact us. A definition of the Regulation itself is in the GDPR glossary entry.
What else is worth knowing about GDPR fines?
Can a GDPR fine exceed EUR 20 million?
Yes, for an undertaking: up to 4% of worldwide annual turnover if that amount exceeds EUR 20,000,000 (Article 83(5) GDPR).
Can you be fined for not keeping a record of processing activities?
Yes. Article 30 GDPR falls under Article 83(4)(a): a fine of up to EUR 10,000,000 or up to 2% of turnover.
What is the maximum GDPR fine for a public authority in Poland?
It depends on the type of unit: up to PLN 100,000 for public finance sector units listed in Article 9(1)–(12) and (14) of the Public Finance Act, research institutes and the National Bank of Poland, and up to PLN 10,000 for units listed in Article 9(13) (Article 102 of the Polish Personal Data Protection Act).
When do you have to pay a fine imposed by the Polish DPA?
Within 14 days of the deadline for filing a complaint or of the day the administrative court’s judgment becomes final (Article 105(1) of the Act). At the request of the fined entity, UODO may postpone the deadline or spread the fine into instalments.
How can you tell how the Polish DPA calculated a fine?
From the statement of reasons of the decision published on the UODO decisions portal. In recent decisions, the authority describes each step under EDPB Guidelines 04/2022, from the category of infringement to the effectiveness test.
