Enforcement and Fines Under the GDPR

The supervisory authorities are responsible for ensuring compliance with the GDPR in the respective EU jurisdictions. To fulfil this task, they have various investigative and remedial powers. From a company’s perspective, the most severe sanction comes in the form of fines, with the maximum amount of EUR 20,000,000.00 or up to 4% of annual global turnover. In addition to fines, data subjects can also hold companies liable. This chapter describes the tasks and powers of the supervisory authorities, the civil liability of companies, administrative sanctions and available legal remedies.