GDPR Fine Risk Calculator 2025/26

The maximum UK GDPR fine is £17.5 million or 4% of annual global turnover — whichever is higher — for the most serious infringements (such as failing to have a lawful basis for processing, inadequate security leading to a large data breach, or systematic violation of data subject rights). Lower-tier infringements carry a maximum of £8.7 million or 2% of global turnover. The ICO has the power to issue these fines, and in practice has issued fines ranging from a few thousand pounds to tens of millions.

The ICO focuses its major enforcement action on large organisations that affect many people or that show systematic non-compliance. Small businesses experiencing a first incident are more likely to receive a reprimand or improvement notice than a fine. However, serious breaches — particularly those involving health or financial data, or those caused by poor security that could have been prevented — can result in fines for organisations of any size. The ICO also considers the size of the organisation when calculating fine amounts.

The three main triggers for an ICO investigation are: (1) a self-reported data breach — organisations with 250 or more employees, or where a breach poses significant risk to individuals, must report to the ICO within 72 hours; (2) a complaint from an individual whose rights were not respected (subject access requests ignored, data used without consent, etc.); and (3) a proactive sector investigation — the ICO periodically investigates specific sectors it has identified as higher risk, such as direct marketing, healthcare and financial services.