Data Breach Regulatory Fine Calculator

Inputs explained for data breach fine estimates

The calculator only asks for a few values, but each one plays a different role depending on whether you are looking at GDPR or CCPA/CPRA exposure. Use the fields as a planning model for the breach, then think about whether the revenue cap, the fixed ceiling, or the record count is the part of the calculation that really drives the result.

Annual global revenue (GDPR)

For GDPR tiers, the relevant baseline is the organization’s worldwide annual revenue/turnover (typically the prior financial year). The calculator uses this input to produce the percentage-based part of the statutory cap, so larger organizations will usually see the revenue-driven amount rise quickly even before the fixed ceiling is considered.

Affected records

This is the number of impacted individuals, consumers, or records involved in the incident. For CCPA/CPRA penalty estimates, the calculator treats that count as a rough proxy for potential violations, which is why the output can scale so fast when a breach affects many rows, accounts, or consumer records. It is still only a simplified estimate, because real enforcement may count violations differently from one matter to the next.

Regulation and severity

Select the tier or severity that best matches the scenario you want to model. For GDPR, the lower and upper tiers point to different statutory maximums, and the calculator compares the revenue-based amount with the fixed cap for the selected tier. For CCPA/CPRA, the unintentional and intentional settings change the per-violation amount, which is why the same record count can produce very different totals depending on the posture of the breach.

Formulas used for GDPR and CCPA/CPRA estimates

The formulas below are intentionally simplified so the calculator can give a quick planning estimate for a data breach fine scenario. They reflect the structure of the commonly cited statutory maximums, but they do not attempt to model the full enforcement process, negotiation history, or legal arguments that may appear in a real case.

GDPR maximum fine (tiered cap)

GDPR administrative fines are commonly summarized as the maximum of a percentage cap and a fixed euro cap:

• F = estimated maximum fine (EUR)
• p = percentage cap (0.02 for “lower tier”, 0.04 for “upper tier”)
• R = annual global revenue/turnover (EUR)
• M = fixed cap (€10,000,000 for lower tier, €20,000,000 for upper tier)

CCPA/CPRA civil penalty estimate (per-record approximation)

This calculator uses a straightforward multiplication model:

F = c × N

• F = estimated civil penalties (USD)
• c = per-violation amount ($2,500 unintentional; $7,500 intentional)
• N = affected records

How to interpret data breach fine results

Once you calculate a breach scenario, the next step is to read the number in the right legal frame. The calculator is useful because it shows whether the result is being pulled upward by revenue, by the fixed statutory ceiling, or by the sheer number of affected records. That makes it easier to judge whether the output is mostly a cap check, a scale check, or both.

• GDPR output is a cap-style maximum: it shows the higher of “% of revenue” or “fixed amount” for the selected tier. In practice, the final assessed amount can be lower once the facts of the breach, cooperation, and mitigation are taken into account.
• CCPA/CPRA output is a scaling estimate: multiplying per-violation amounts by record counts can produce very large numbers, especially when the intentional setting is selected. Enforcement practice, settlement posture, cure periods where available, and the way a violation is counted can all change the result materially.
• Currencies are not converted: GDPR results are in EUR (€); CCPA/CPRA results are in USD ($). If you want to compare them on the same screen, convert externally with a chosen exchange rate and date instead of assuming the values are directly interchangeable.

Worked example: comparing GDPR and CCPA/CPRA breach exposure

This worked example shows how the data breach regulatory fine calculator behaves when the same incident is viewed through two different legal lenses. In the GDPR example, the fixed cap is the number that matters most; in the CCPA/CPRA example, the affected-record count is what pushes the estimate upward.

Assume:

• Annual global revenue: €50,000,000
• Affected records: 10,000

Example A: GDPR upper tier (4% or €20M, whichever is higher)

1. Percentage cap: 4% × €50,000,000 = €2,000,000
2. Fixed cap: €20,000,000
3. Maximum (higher of the two): €20,000,000

Interpretation: at this revenue level, the fixed statutory ceiling dominates the calculation. The revenue-based amount is still useful to show scale, but it does not exceed the higher GDPR tier cap in this example.

Example B: CCPA/CPRA intentional ($7,500 per record)

1. Penalty estimate: $7,500 × 10,000 = $75,000,000

Interpretation: the per-record model grows quickly once the record count rises. That is exactly why the calculator separates record volume from the legal tier: the same breach can look modest in one regime and extreme in another, depending on how the law treats each affected record.

Assumptions and limitations for data breach fine estimates

These assumptions are built into the calculator so that a fast estimate stays easy to read, but they also define the edges of what the tool can and cannot tell you. If your situation is unusual, the estimate should be treated as a starting point rather than a conclusion.

• Statutory maxima only: For GDPR, the calculator expresses the statutory maximum cap for the chosen tier, not a likely fine. For CCPA/CPRA, it applies the headline per-violation amounts as a simple multiplier.
• Not legal advice; enforcement is discretionary: Real determinations can incorporate severity, duration, negligence or intent, categories of data, mitigation, cooperation, prior history, and proportionality.
• “Per record” is an approximation for CCPA/CPRA: Whether each affected record equals a separate violation, and how violations are aggregated, can vary by facts, forum, and enforcement posture.
• Consumer statutory damages not included: The model does not include potential private litigation exposure, class action settlement dynamics, or contractual claims.
• No currency conversion: GDPR uses EUR and CCPA/CPRA uses USD; the calculator does not normalize currencies.
• No caps from ability-to-pay or negotiated outcomes: Settlements, corrective action plans, and practical collection considerations are not modeled.
• Use the result as a planning signal: If the estimate is driven mainly by one input, that input is usually the first place to double-check your assumptions and your legal classification of the breach.

Quick comparison of GDPR and CCPA/CPRA estimates

If you are trying to compare the two regimes at a glance, the table below shows what the calculator is emphasizing in each case: revenue versus fixed cap for GDPR, and record count versus per-violation amount for CCPA/CPRA.

Sources and reference points for breach fines

These starting points explain where the calculator's simplified GDPR and CCPA/CPRA numbers come from, but they are not a substitute for the primary legal text or case-specific advice.

• GDPR administrative fines are commonly discussed in relation to Article 83 (tiered maximums).
• CCPA/CPRA civil penalties are commonly summarized using $2,500 (unintentional) and $7,500 (intentional) figures in public guidance and commentary.

For compliance decisions, consult primary legal text and qualified counsel for your jurisdiction and facts.