Why the EDPB fining methodology hits small and medium enterprises the hardest

We showed a year ago that the European Data Protection Board’s fining methodology would likely lead to much higher fines… but at the time it seemed like SMEs would not be that strongly affected. The newest version of the fines just seems to confirm that everyone will be affected, and even more so than before.

For instance, undertakings with an annual turnover between 10m EUR and 50m EUR could have a starting amount that was “down to 2% of the identified starting amount” – but the newest version published today says “sum between 1.5% and 10% of the identified starting amount”.

Undertakings with a turnover between 250m EUR and 500m EUR could now have their starting amount as a sum “between 40% and 100% of the identified starting amount” – previously that was “down to 50% of the identified starting amount”.

We will soon be updating our fine calculator DeFine – www.khlaw.com/define – and our fine comparison analysis (accessible through DeFine).
In the meantime, if you need any insights, you know how to reach us!

Link to the updated EDPB guidelines in the comments

gdpr data protection fines