GDPR fines: what a small-team business really risks (real cases)

The figure everyone quotes is €20 million or 4% of worldwide annual turnover. It is the GDPR’s maximum fine, and it tells a team of six almost nothing about what it actually risks.

GDPR fines for small-team businesses depend on the size, the finances and the behaviour of the business. In France, simple cases go through a procedure in which the fine cannot exceed €20,000. In the published cases below, two doctors in private practice were fined €3,000 and €6,000, a translation company with nine employees €20,000 and a UK pharmacy £92,000 after appeal.

This guide covers the EU GDPR, the UK GDPR and the UK’s marketing rules (PECR), for businesses in the EU and for those outside it with customers or users there. For the wider picture, start with my GDPR guide for small-team businesses.

What the GDPR says about fines

Article 83 of the GDPR sets two ceilings, and the UK GDPR has the same two in pounds:

Whichever amount is higher applies, so the percentage only matters for large groups. For a business turning over €2 million, 4% is €80,000, so the maximum stays at €20 million. It is a maximum, not a starting point.

What the regulator weighs

Article 83(2) lists what decides the amount:

• how serious it is, how long it lasted and how many people it affected;
• whether it was deliberate or negligent;
• what you did to limit the damage, and your security measures;
• previous infringements, and whether you complied with earlier orders;
• your cooperation, and how the regulator found out (including whether you reported a breach yourself);
• the kind of data involved (health data weighs more) and any profit made.

Size and finances come in through proportionality. In two of the cases below, the regulator set or lowered the amount after looking at the company’s accounts.

A fine is only one of the tools

Under Article 58(2), a regulator can also issue a warning or a reprimand, order you to answer someone’s request or to fix your processing by a deadline, order you to tell people about a breach, or limit or ban a processing activity. For a small team, an order backed by a daily penalty, or a ban on using a prospect list, can hurt more than the fine.

How GDPR fines work for small teams in France and the UK

France: the CNIL’s simplified procedure

Since the law of 24 January 2022, the CNIL can deal with simple cases through a simplified sanction procedure (page in French). The chair of its sanctions committee, or a member they appoint, decides alone, without a public hearing. The possible measures are a reprimand, a fine of up to €20,000 and an order to comply with a penalty of up to €100 per day of delay.

This is now the CNIL’s main route. In 2025 it issued 83 sanctions: 67 under the simplified procedure, so capped at €20,000 each, and 16 under the ordinary one, according to its 2025 enforcement review (in French). The year’s total, €486.8 million, came almost entirely from two cookie decisions against Google (€325 million) and Shein (€150 million). The main themes of the year were cookies, employee monitoring and data security.

United Kingdom: the ICO and PECR

The ICO, formally the Information Commission since 30 September 2026, enforces both the UK GDPR and PECR, the rules on marketing calls, texts, emails and cookies. Many of its fines are PECR fines against companies that make marketing calls or send texts: in 2023, for example, it fined Crown Glazing £130,000 and Maxen Power Supply £120,000 for calling numbers registered with the TPS or the CTPS, the opt-out lists for individuals and for companies. Since February 2026, under the Data (Use and Access) Act 2025, PECR fines can reach £17.5 million or 4%, against £500,000 before.

UK GDPR cases can also end with a reprimand or an enforcement notice rather than a fine. You can browse them on the ICO’s enforcement page.

Real cases: what small organisations were fined for

UNIONTRAD COMPANY. A camera filmed the translators at their desks all day, the computers had no passwords and staff shared one password for a common mailbox. Employees complained; the CNIL sent a formal notice in July 2018, which the company did not comply with. The amount (deliberation SAN-2019-006 of 13 June 2019) took into account the company’s size, nine employees, and its loss in 2017.

Two doctors in private practice. During an online check in September 2019, the CNIL found thousands of MRI, CT and X-ray images on the two doctors’ servers open on the internet, not always encrypted, with patients’ names and dates of birth. One had opened ports on their internet router to view images remotely. The CNIL also found a failure to notify the breach (decisions SAN-2020-014 and SAN-2020-015 of 7 December 2020) and did not publish their names.

Doorstep Dispensaree. The medicines regulator, the MHRA, alerted the ICO after finding the pharmacy’s sensitive documents in containers that were not locked, where the public could reach them. The ICO’s notice of intent proposed £400,000, reduced to £275,000 in the penalty of 17 December 2019 after representations about the pharmacy’s finances. In August 2021 the First-tier Tribunal cut it to £92,000 because less personal data was involved than assumed; the Court of Appeal dismissed the last appeal on 9 December 2024.

None of these fines was about the wording of a privacy policy. They were about a camera, an open server and boxes nobody locked: everyday shortcuts that a complaint, a check or another authority brought to light.

What puts a small team on a regulator’s radar

Cases usually start in one of these five ways.

A complaint. Complaints to the CNIL rose sharply in 2025, according to its annual report. A complaint can come from a customer whose access request went unanswered, from someone who still gets your marketing after saying stop, or from an employee who feels watched, as in the UNIONTRAD case. Access requests have a one-month deadline: here is how to answer a subject access request.

A data breach. A breach that puts people at risk must be reported to the regulator within 72 hours (Article 33), and failing to report is an infringement of its own, as the two doctors found. Two of my clients called me after their website was hacked; at that point the GDPR question is what personal data the attacker could reach. See what to do in the first 72 hours.

Marketing. One objection I hear about cold emailing is that it is illegal: in B2B it is not, in France or in the UK, as long as you follow each country’s rules, which my cold email compliance checklist sets out. The PECR fines above, by contrast, were for calls to numbers registered on opt-out lists.

The regulator’s own checks. The CNIL found the doctors’ images itself. Cookies are the easiest thing to check from outside, since anyone can open your site and see what loads before consent: see what cookie banners must do.

Another authority, or a client. The pharmacy was reported by another regulator. And if you handle personal data for clients, Article 28 requires a contract with each of them, a data processing agreement; a data incident can cost you that client long before a regulator acts.

If your business is outside the EU

The GDPR applies to a business outside the EU that offers goods or services to people in the EU or monitors their behaviour (Article 3(2)): a Swiss online shop delivering to France, a Canadian app with users in Belgium, a Moroccan training company selling courses to people in Paris. Such businesses usually need an EU representative (Article 27). In May 2021 the Dutch regulator announced a €525,000 fine against Locatefamily.com, a website with no EU establishment, for not appointing one; people had also struggled to get their details removed. My guide to EU representatives covers who needs one.

The same logic runs both ways with the UK. A UK business selling to customers in the EU answers to EU regulators for them, and a French business selling to UK customers falls under the UK GDPR.

How to keep your risk low, and when to call a lawyer

You do not need a consultant for most of this list:

1. Answer access, erasure and objection requests within one month (Article 12(3)), and keep a note of what you sent.
2. Stop marketing to anyone who objects, at once, and screen UK call lists against the TPS and the CTPS.
3. Make refusing cookies as easy as accepting them, and load no advertising cookies before consent. Cookie banners, privacy policies and legal notices are part of the websites I build, but you can check yours today.
4. Do not film staff at their desks all day, and tell employees in writing what any camera covers and why.
5. Give everyone their own password, turn on two-factor authentication and keep anything with customer or patient data off the open internet.
6. Write down your breach procedure, including who decides, so the 72 hours do not start with a hunt for the right person.
7. Sign data processing agreements with the tools that hold your customers’ data: web host, CRM, emailing tool.
8. In the UK, make complaints easy: since 19 June 2026, organisations must help people complain, acknowledge complaints within 30 days and investigate them.
9. If a regulator writes to you, answer within the deadline and do what the letter asks: cooperation and compliance with earlier orders count when a fine is set.

This article explains the rules and published decisions; it is not legal advice. Bring in a data protection lawyer as soon as a regulator opens a procedure (a formal notice, a notice of intent, an inspection), when a breach involves health data or many people, or when a dispute with an employee turns on monitoring. A DPO is compulsory when your core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of sensitive data (Article 37).