What it asks for. The article requires supervisory authorities to make fines effective, proportionate and dissuasive, and lists factors to consider, including the nature, gravity and duration of the infringement, intent or negligence, mitigation, previous infringements, cooperation and the categories of data affected. It sets two tiers of maximum fines: up to 10 million euro or 2 percent of worldwide annual turnover, and up to 20 million euro or 4 percent, whichever is higher in each case.
In practice. Organisations reduce exposure mainly by being able to show accountability: documented decisions, effective controls, prompt breach handling and constructive cooperation with the authority. The factors in the article are a useful lens for risk registers and board reporting on privacy risk.
Common gaps. Organisations sometimes focus on maximum fines and overlook other powers, such as processing bans and orders, which can be more disruptive. Poor documentation weakens the mitigating factors an authority can take into account.