What is my GDPR and DPDP fine exposure?

GDPR fines reach up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements under Article 83(5). India's Digital Personal Data Protection Act 2023 sets a headline penalty band of up to INR 250 crore per breach category (subject to revision in implementing Rules). Your dual exposure is a directional band — Low, Moderate, High, or Severe — driven by turnover, headcount, the monitoring data types you store, retention period, and whether you hold EU data subjects and India data principals. This estimator returns an indicative band only and is not legal advice — verify with counsel.

What is the maximum GDPR fine?

Under GDPR Article 83(5), the most serious infringements can attract administrative fines of up to EUR 20 million, or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. A lower tier under Article 83(4) caps at EUR 10 million or 2% of turnover. Actual fines are set by the supervisory authority on the facts.

What is the maximum DPDP Act penalty?

The Digital Personal Data Protection Act 2023 sets a headline penalty band of up to INR 250 crore per breach category. The exact penalty in any situation is determined by the Data Protection Board on the facts, and penalty tiers are subject to revision in the implementing DPDP Rules — verify with counsel.

Can a company face both GDPR and DPDP fines for the same incident?

Yes. An organisation that holds both EU data subjects and India data principals can face parallel exposure under GDPR and the DPDP Act 2023 for the same underlying processing failure, because the two regimes apply to different data populations and are enforced by different authorities. India IT-services exporters handling EU client workforce data are a common dual-exposure profile. Verify your specific position with counsel.

Does storing screenshots or keystrokes increase fine exposure?

Storing continuous screenshots, keystroke logs, location, or biometric data raises exposure under both regimes because it expands the volume and sensitivity of personal data, strains the lawful-basis and purpose-limitation tests, and increases the consequence of any breach. Minimising captured categories and retention is the most direct lever to reduce the band.

GDPR + DPDP Dual Fine Exposure Estimator — Interactive

GDPR + DPDP Dual Fine Exposure Estimator

Estimate your indicative dual fine-exposure band across two regimes — GDPR (up to EUR 20M or 4% of worldwide turnover, Article 83) and India's Digital Personal Data Protection Act 2023 (up to INR 250 crore, hedged) — in under 3 minutes. Six inputs: turnover band, employee count, monitoring data types stored, retention period, EU data subjects, and India data principals. Get a Low / Moderate / High / Severe band for each regime. Built for India IT exporters and EU-facing DPOs, CISOs, and COOs.

What is your GDPR + DPDP fine exposure? GDPR fines reach up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher, under Article 83(5); India's Digital Personal Data Protection Act 2023 sets a headline band of up to INR 250 crore per breach category (subject to revision). This free estimator returns an indicative dual band — Low, Moderate, High, or Severe — from six inputs: turnover band, headcount, the monitoring data types you store (screenshots, keystrokes, location, biometric), retention period, and whether you hold EU data subjects and India data principals. The output is qualitative and indicative only, not a precise figure or legal advice — verify with qualified counsel; penalty tiers are subject to revision.

Inputs6 (turnover, headcount, data, retention, EU, India)

OutputDual band per regime + steps

TimeUnder 3 minutes

FrameEUR 20M/4% · INR 250cr

How to use this

Pick one option per question — the dual exposure band updates the moment all six are answered. Q1–Q2 set turnover and headcount, Q3 lets you tick every monitoring data type you store, Q4 sets retention, and Q5–Q6 set whether you hold EU data subjects (GDPR applies) and India data principals (DPDP applies). Every figure is indicative only. GDPR runs up to EUR 20M or 4% of turnover (Article 83) and the DPDP Act runs up to INR 250 crore per breach category (subject to revision) — but the bands you see are directional risk reads, not calculated liabilities. Verify your exposure with qualified counsel before quoting any number.

Key facts (for citation)

Fact. GDPR Article 83(5) sets the upper fine tier at up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher; a lower tier (Article 83(4)) caps at EUR 10 million or 2%.

Fact. India's Digital Personal Data Protection Act 2023 sets a headline penalty band of up to INR 250 crore per breach category; the exact penalty is set by the Data Protection Board and tiers are subject to revision in the Rules.

Fact. An organisation holding both EU data subjects and India data principals can face parallel exposure under GDPR and the DPDP Act for the same underlying processing failure — verify with counsel.

Fact. This estimator returns a qualitative dual band from six inputs; it does not produce a precise EUR or INR figure and is not a substitute for legal advice.

✓

Instant dual band
GDPR + DPDP side by side as you answer

✓

Free to use
no email needed to see your band

✓

Full report (PDF)
dual exposure breakdown + remediation

GDPR + DPDP Dual Fine Exposure Estimator — 6 inputs

The interactive estimator above requires JavaScript. The six inputs are reproduced below. All output is indicative only and must be verified with qualified counsel; GDPR runs up to EUR 20M or 4% of turnover and the DPDP Act runs up to INR 250 crore per breach category (subject to revision).

Q1. Annual turnover band. (Under EUR 10M / EUR 10M–50M / EUR 50M–250M / Over EUR 250M)

Q2. Employee count band. (Under 100 / 100–500 / 501–2,000 / Over 2,000)

Q3. Monitoring data types stored (tick all): screenshots, keystroke logs, location / device telemetry, biometric or facial.

Q4. Data retention period for monitoring data. (Under 90 days / 90 days–1 year / Over 1 year or indefinite)

Q5. Do you hold EU data subjects (employees or contractors in the EU)? (Yes / No)

Q6. Do you hold India data principals (employees or contractors in India)? (Yes / No)

Indicative dual exposure band Not yet scored

Answer all 6

Framed against GDPR Article 83 and the DPDP Act 2023 penalty tiers.

Pick one option on each question — your indicative dual exposure band appears once all six are answered. Indicative only; verify with counsel.

Next step — close the gaps, then email the full report

Read the GDPR employee-monitoring compliance checklist for India IT exporters for the full dual-regime picture, then size your India-only penalty band with the DPDP Penalty Exposure Calculator. Want the dual exposure breakdown and remediation checklist as a PDF? Email it to yourself below, or book a 30-minute readiness review with the gStride team.

Book a 30-min readiness review