Article 84 - Penalties

Article 84 sets out the penalties for breaches of the GDPR, authorising supervisory authorities to impose administrative fines of up to €20 million or 4 % of an organisation's worldwide annual turnover, whichever is higher. The article provides a two-level fine structure, with lower fines for less serious infringements and higher fines for violations such as ignoring data-subject rights or failing to implement required technical and organisational measures.