What is the cost of a personal data incident?
When an attack exfiltrates personal data, it is no longer just an IT event. It is a regulatory event with notification obligations, supervision, and fines under GDPR. Calculate your exposure below.
of total global annual turnover can be imposed for serious infringements.
The higher amount of 4% and 20 M EUR is the cap.
Calculate your exposure.
Enter turnover, number of affected individuals, and circumstances. The result is an indicative estimate based on Art. 83 GDPR and practice from IMY, CNIL, and Ireland DPC.
Company size
Annual turnover sets the legal cap
- 1Formula 1 - Statutory capHigher of 4% of 250 M or 20M EUR230,000,000 kr
- 2Formula 2 - Base amountTurnover × 0.3% × scale for 25,000 affected3,298,455 kr
- 3Formula 3 - Data categoryRegular personal data · ×1.03,298,455 kr
- 4Formula 4 - Aggravating & mitigating+35 % · ±0 %4,452,914 kr
- 5Likely outcomeBelow statutory cap4,452,914 kr
This is what has actually been imposed.
Two categories of sanctions.
Of total global annual turnover. The higher amount applies.
- - Security deficiencies (Art. 32)
- - Insufficient incident notification (Art. 33-34)
- - Missing data protection impact assessment (Art. 35)
- - Missing or incorrect DPO (Art. 37-39)
Of total global annual turnover. The higher amount applies.
- - Unlawful processing (Art. 5-7, 9)
- - Infringement of data subjects' rights (Art. 12-22)
- - Unlawful transfers to third countries (Art. 44-49)
- - Breach of supervisory decisions
How the calculator works.
The model is a transparent estimate - not a legal forecast. Each figure is a calibration against practice from IMY, CNIL, Ireland DPC, and CNPD, not an official benchmark.
The cap is the higher of 4% of total global annual turnover or 20 M EUR (Art. 83(5) GDPR)[1]. We use an exchange rate of 11.5 SEK/EUR to compare the two in SEK[5].
cap = max(omsättning × 0,04, 20 000 000 × 11.5)The base is derived from 0.3% of turnover, multiplied by a logarithmic scale of the number of affected individuals[2]. 100 affected individuals gives ~0.3×, 10,000 gives ~1×, 1 million gives ~1.5× of the base factor. The total base factor is scaled by 4 so typical realistic outcomes are in the same ballpark as actual supervisory decisions.
skala = max(0,3, log10(max(100, drabbade)) / 4)
bas = omsättning × 0,003 × skala × 4Sensitive data (Art. 9) and children's data weigh more in the supervisory authority's assessment[3]. The multipliers are calibrated against published decisions.
- Regular personal data×1.0
- Sensitive data (Art. 9)×1.7
- Children's data×1.4
Aggravating circumstances add to the base. Mitigating circumstances deduct[4]. Mitigating circumstances can never lower the outcome below 40% of the base.
agg = 1 + Σ(försvårande %)
mit = max(0,4, 1 - Σ(förmildrande %))
utfall = min(cap, bas × agg × mit)- Probable: the result of the formula above, clamped to the statutory cap.
- Lowest probable: 55% of probable outcome - reflects that supervision often results in lower figures at the first infringement.
- Worst case: the statutory cap according to Art. 83(5).
- - Static exchange rate 11.5 SEK/EUR, no daily update.
- - We use the higher category (Art. 83(5)) as the cap, as exfiltration of personal data is practically handled there.
- - The model does not consider group structure, sector (healthcare, finance), or if the incident is repeated.
- - Damages under Art. 82, civil claims, and indirect costs are not included.
- - Swedish sanctions from IMY have historically been below the EU average - the outcome may be lower in Sweden.
- - The result is indicative and does not replace legal advice.
Click on an assumption to see exact references to GDPR, EDPB, and IMY. Footnotes [1]-[7] in the text above link here.
Avoid the fine: a ransomware response that satisfies the regulator
Documented containment, notification timelines and evidence trail. Pick the edition that matches your jurisdiction.
Lower the risk before IMY calls.
The Acronis stack stops exfiltration at an early stage, and Skyddad arbetsplats provides you with the documentation supervision asks for. Book a review and we will go through your current situation.