GDPR Tier 2 Fines: Article 83(5) Maximum Penalties Explained

Article 5 establishes six fundamental principles: (a) lawfulness, fairness, transparency; (b) purpose limitation; (c) data minimisation; (d) accuracy; (e) storage limitation; (f) integrity and confidentiality. Plus (g) accountability. Violations of any — collecting more data than necessary, retaining data beyond its stated purpose, failing to maintain data accuracy, or processing without transparency — trigger Tier 2 exposure. Article 5 violations are the most frequently cited in DPA decisions and are commonly bundled with other Tier 2 findings.

Processing personal data without a valid lawful basis under Article 6 is the fundamental GDPR violation. For consent-reliant processing under Article 7: consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, bundled consent, and consent that conditions a service on data processing are invalid. Special categories under Article 9 — health, biometric, racial/ethnic, religious data — require explicit consent or an enumerated exception. Invalid consent affecting millions of users routinely generates eight-figure fines.

GDPR grants data subjects eight rights: access (Article 15), rectification (Article 16), erasure (Article 17 — right to be forgotten), restriction (Article 18), data portability (Article 20), objection (Article 21), not to be subject to automated decisions (Article 22), and the right to information (Articles 13–14). Systematic failure to respond to access requests within 30 days, denying erasure requests without valid grounds, or refusing portability for data subjects triggers Tier 2 liability — especially when the failure affects large numbers of users.

Transferring EU personal data to countries outside the EEA without an adequate protection mechanism is a core GDPR violation. Valid transfer mechanisms include: EU adequacy decision (UK, Canada, Japan, etc.), Standard Contractual Clauses (SCCs updated 2021), Binding Corporate Rules, or derogations. Transferring EU data to the US relying solely on the invalidated Privacy Shield — after the CJEU Schrems II ruling in 2020 — resulted in the largest GDPR fine in history. Even with post-Schrems II SCCs, companies must conduct Transfer Impact Assessments to assess the legal framework in the destination country.

Understand Your GDPR Penalty Exposure

Use ComplianceStack's free tools to identify gaps before regulators do.

What is the difference between GDPR Tier 1 (Article 83(4)) and Tier 2 (Article 83(5)) violations?

Tier 1 (Article 83(4)) applies to technical and organizational obligations: DPIA failures, DPO violations, breach notification delays, and controller/processor obligations — maximum €10M or 2% of turnover. Tier 2 (Article 83(5)) applies to substantive violations of data subjects' rights and core principles: invalid lawful basis, unlawful consent, violations of access/erasure/portability rights, and unauthorized international transfers — maximum €20M or 4% of turnover. Many serious enforcement cases involve both Tier 1 and Tier 2 violations simultaneously. The highest-profile fines — Meta, Amazon, LinkedIn — have been predominantly Tier 2 violations.

How do DPAs calculate fines for companies with billions in global turnover?

The 4% calculation applies to total worldwide annual turnover of the preceding financial year for the undertaking — the entire economic unit in the competition law sense, including parent companies and subsidiaries. For Meta, this meant 4% of Meta Platforms Inc.'s global revenue (approximately $117B in 2022), producing the €1.2B fine. EDPB Guidelines 04/2022 establish a five-step methodology: (1) identify all violations and their fine cap; (2) set starting point based on gravity; (3) adjust up/down based on Article 83(2) factors; (4) apply the effective, proportionate, dissuasive standard; (5) apply the turnover/€20M cap as ceiling. For large technology companies, fines are routinely calculated as a percentage of global turnover rather than multiples of specific losses.

Can a company reduce a GDPR Tier 2 fine through early cooperation or remediation?

Yes — cooperation and remediation are among the most significant fine reduction factors under Article 83(2)(c) and (f). DPAs across the EU have reduced fines by 25–50% for entities that self-reported the violation, implemented corrective measures immediately, cooperated fully without prolonged legal challenges, and provided full access to systems and records. Conversely, prolonged litigation challenging DPA jurisdiction, appeals that delay compliance, and failure to implement ordered remediation within DPA-set timelines have resulted in follow-on enforcement actions and enhanced penalties.