Key Concept 6 — Consequences of Non-Compliance

Fines are only one of the risks — trust is often the bigger loss.

Most enforcement cases start with something avoidable: a security gap, a missing legal basis, an unanswered request from a customer or a complaint from an employee.

Typical consequences

  • Fines by the data protection authority, often based on turnover or on a fixed unit
  • Orders from authorities: stop a processing activity, delete data, change a system — which can halt a business process overnight
  • Claims for damages by the affected people, in some countries also through class actions or consumer associations
  • Loss of trust of customers, employees and business partners, and negative press
  • Business impact: lost tenders, failed due diligence and stricter requirements from customers
  • Personal liability of managers and employees under some laws

Sanctions in your jurisdiction

European Union (GDPR)

Supervisory authority: The national supervisory authority of each EU/EEA member state; the European Data Protection Board (EDPB) ensures consistent application

  • Fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher
  • Orders by the authority, e.g. to stop or change a processing activity
  • Claims for material and non-material damages (Art. 82 GDPR)
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: European Union (GDPR) Slide 8 of 10