What Could a Violation Cost Your Business?

The calculator estimates the theoretical maximum penalty permitted under a given privacy law. Under the GDPR and UK GDPR, this generally means the higher of a specified monetary amount or a percentage of annual worldwide turnover. Many US state privacy laws provide statutory penalties per violation. The calculator provides an indicative ceiling for awareness and planning, not a prediction of an actual penalty.

Not necessarily. The maximum statutory penalty is a ceiling, not an estimate of the fine a business is likely to receive. Actual penalties depend on factors such as the nature and severity of the violation, the number of people affected, applicable legal provisions, and the circumstances of the case. This tool is intended to illustrate potential exposure rather than predict an enforcement outcome.

Under the GDPR, certain infringements can attract administrative fines of up to €20 million or 4% of the undertaking's total worldwide annual turnover, whichever is higher. The applicable maximum depends on the type of infringement. Enter a hypothetical annual turnover in the calculator to explore the potential statutory ceiling.

Under India's Digital Personal Data Protection Act (DPDPA), penalties can reach up to ₹250 crore for specified breaches, depending on the applicable provision and circumstances. Select the DPDPA option in the calculator to explore the relevant theoretical maximum for your scenario.

Under the CCPA, administrative fines can generally be up to $2,500 per violation and $7,500 per intentional violation or violation involving the personal information of a person the business knows is under 16, subject to applicable law and enforcement circumstances. Penalty amounts and legal requirements may change, so check the current official guidance.