tool · calculator

How much is at stake, at most?

The GDPR and the AI Act have no price lists for fines - they have upper limits. Enter your annual turnover and the calculator shows the statutory caps under Art. 83 GDPR and Art. 99 AI Act, set against the annual cost of an external DPO. It is a scale of exposure, not a forecast of a fine.

input

For groups - the turnover of the whole group. Quick pick (in the selected currency):

We are an SMEFewer than 250 staff and turnover ≤ EUR 50 M or balance sheet ≤ EUR 43 M. Under the AI Act (Art. 99(6)) the lower of the two amounts applies to SMEs.
Compare with DPO as a ServiceAnnual cost of an external DPO per the Lex&Roll price list (net).

Computed locally in your browser. EUR/PLN rate 4.3545 - NBP mid-market rate of 21 Sep 2026 (table 183/A).

These are statutory maximum caps (upper limits), not a forecast of a fine. The actual amount depends on the circumstances in Art. 83(2) GDPR and Art. 99(7) AI Act; most fines imposed are far below the maximum. PLN conversion is indicative.

Fine caps for your turnover

See DPO as a Service Let's talk about the real risk →

How we calculate

  • GDPR, Art. 83(4) - up to EUR 10 M or 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher. Covers, among others, controller and processor obligations (Art. 25-39), certification and code monitoring.
  • GDPR, Art. 83(5) - up to EUR 20 M or 4 % of turnover, whichever is higher. Covers, among others, processing principles (Art. 5), legal bases (Art. 6), consent (Art. 7), data subject rights (Art. 12-22), transfers (Art. 44-49) and non-compliance with an authority's order.
  • AI Act, Art. 99(3) - prohibited practices (Art. 5): up to EUR 35 M or 7 % of turnover, whichever is higher.
  • AI Act, Art. 99(4) - other obligations of operators and notified bodies: up to EUR 15 M or 3 % of turnover, whichever is higher.
  • AI Act, Art. 99(5) - incorrect, incomplete or misleading information to authorities: up to EUR 7.5 M or 1 % of turnover, whichever is higher.
  • AI Act, Art. 99(6) - for SMEs and start-ups each of the above is the lower of the two amounts. The GDPR has no equivalent rule.
  • Why does the result often not change? The percentage of turnover exceeds the fixed amount only above roughly EUR 500 M of turnover. For most companies the cap is therefore the fixed amount - still tens of millions of euros of exposure.
Bases: Regulation (EU) 2016/679 (GDPR), Art. 83; Regulation (EU) 2024/1689 (AI Act), Art. 99, as in force in September 2026. Polish administrative fines for public bodies (Art. 102 of the Personal Data Protection Act) have separate, lower limits and are not included here.

Exposure is one thing. Probability is another.

An external DPO and tidy documentation lower both - and when setting a fine the authority weighs exactly what you did beforehand (Art. 83(2)(c) and (f) GDPR).

Consult your project Configure your stack →