What it asks for. Member States must ensure fines for breaches of Article 21 or 23 are effective, proportionate and dissuasive. For essential entities the maximum is at least 10 million euro or 2 percent of total worldwide annual turnover in the preceding financial year, whichever is higher. For important entities it is at least 7 million euro or 1.4 percent, whichever is higher.
In practice. Fines are imposed in addition to other enforcement measures and take account of the factors in Articles 32 and 33, such as severity, duration, previous infringements, damage caused, cooperation and adherence to approved codes or certification. Member States may also impose periodic penalty payments and decide whether public administration entities can be fined. Organisations should understand the turnover basis that applies to them, link Article 21 and 23 compliance to board risk reporting, and keep evidence of good-faith cooperation with authorities.
Common gaps. Organisations often model fines on the entity's own turnover when group turnover may be considered, and underestimate the reporting obligations under Article 23 as a direct source of fines.