GDPR Fine Risk Simulator (2D) — Article 83 Enforcement Model

Violation Inputs

Annual global turnover €108M

Data subjects affected 56,234

Severity / culpability score 5.5 / 10

Cooperated with the DPAArt. 83(2)(f) — active cooperation cuts the fine ~30%

Enforcement Outcome

Infringement tier

Lower — Art. 83(4)

Statutory cap

€10.00M

max(€10M, 2% of turnover)

Estimated fine

€4.62M

4.27% of annual turnover

How it works

GDPR Article 83 sets two statutory ceilings for administrative fines. Which one applies depends on which provisions were breached — this model maps that choice onto a single 0–10 severity/culpability score, the same factors a Data Protection Authority actually weighs under Art. 83(2): nature, gravity and duration, intentional vs. negligent character, and the number of data subjects affected.

Lower tier  (Art. 83(4)): cap = max(€10M,  2% × global turnover)
Higher tier (Art. 83(5)/(6)): cap = max(€20M, 4% × global turnover)
tier = severity ≥ 6  →  Higher, else Lower

reach   = clamp( log10(subjects) / 7, 0.1, 1 )   // 100 subjects → floor, 10M → saturates
weight  = severity/10 × (0.5 + 0.5 × reach)
cooperation multiplier = 0.7 if cooperated else 1.0

fine = min( cap, cap × weight × cooperation multiplier )

Bars panel (top) — the statutory cap (amber) against the computed fine estimate (red), on the same €0–20M-equivalent scale.
Subjects ring (bottom-left) — the affected population rendered on the log scale used in the reach term; drag it left/right to spin the ring. Dot count scales with reach, not the raw subject count, because the formula itself compresses population on a log axis.
Weight breakdown (bottom-right) — the two multiplicative terms that build weight: the severity fraction and the reach fraction, plus the cooperation multiplier as a separate meter.

drag ring to rotate