The GDPR establishes a two-tier system of administrative fines for infringements of its provisions,
depending on the nature, gravity, and duration of the infringement, as well as other factors such as
the intentional or negligent character of the infringement, the actions taken to mitigate the damage,
the degree of co-operation with the supervisory authority, and any previous infringements1. The
lower tier of fines can be up to 10 million euros or 2% of the total worldwide annual turnover of the
preceding financial year, whichever is higher1. The lower tier of fines applies to infringements of the
GDPR relating to the following aspects1:
The obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39, and 42 and
43;
The obligations of the certification body pursuant to Articles 42 and 43;
The obligations of the monitoring body pursuant to Article 41 (4). The higher tier of fines can be up
to 20 million euros or 4% of the total worldwide annual turnover of the preceding financial year,
whichever is higher1. The higher tier of fines applies to infringements of the GDPR relating to the
following aspects1:
The basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7, and
9;
The data subjects’ rights pursuant to Articles 12 to 22;
The transfers of personal data to a recipient in a third country or an international organisation
pursuant to Articles 44 to 49;
Any obligations pursuant to Member State law adopted under Chapter IX;
Non-compliance with an order or a temporary or definitive limitation on processing or the
suspension of data flows by the supervisory authority pursuant to Article 58 (2) or failure to provide
access in violation of Article 58 (1). Therefore, higher fines are assessed for GDPR violations due to
violations of a data subject’s rights, as these are among the infringements that fall under the higher
tier of fines. Data subjects’ rights are the rights granted to individuals whose personal data are
processed by controllers or processors, such as the right to access, rectify, erase, restrict, object, or
port their data, as well as the right to be informed, to withdraw consent, and to lodge a complaint1.
Violations of these rights can cause significant harm to the data subjects and undermine the
objectives of the GDPR. Therefore, option D is the correct answer. Reference: Art. 83 GDPR – General
conditions for imposing administrative fines, Article 83 GDPR - GDPRhub
