#GDPR fines

GDPR fines: how much, the Article 83 criteria and what Polish DPA decisions teach

“Up to EUR 20 million” is a ceiling, not a rate. The Polish supervisory authority calculates fines using the EDPB method: category of infringement, seriousness, turnover, aggravating and mitigating factors. In a May 2026 decision, the lack of risk-based safeguards for laptops at a processor cost a district head PLN 21,000 (non-final decision), while a bank was fined PLN 4,053,173 for not notifying its customers.