- The statutory maximum fine amounts that the Commissioner may impose under the UK GDPR and DPA 2018 apply across the full range of controllers and processors. This covers small businesses to multi-national corporations, as well as public bodies and not-for-profit organisations.
- Therefore, the Commissioner considers that it is appropriate to take into account the turnover of an undertaking when assessing the starting point for the fine. This is consistent with the need to ensure that the amount of any fine is effective, proportionate and dissuasive.83
- For undertakings, the Commissioner will first determine the undertaking’s total worldwide annual turnover in its previous financial year. The Commissioner will then consider whether to adjust the starting point to reflect the size of the undertaking. The Commissioner will decide whether to exercise discretion to reduce the starting point in this way on a case-by-case basis, having regard to the circumstances of the infringement.
- Where a controller or processor is not an undertaking and therefore does not have turnover, the Commissioner may instead have regard to other indicators of its financial position, such as assets, funding or administrative budget. 84
Determination of total worldwide annual turnover
- As explained in The concept of an ‘undertaking’ for the purpose of imposing fines above, an undertaking refers to any entity that is engaged in economic activity, regardless of its legal status or the way in which it is financed.
- The relevant turnover of the undertaking for the purpose of calculating the maximum amount of the fine is the total worldwide annual turnover in its previous financial year. 85 In this context, the Commissioner considers that ‘turnover’ means the amount derived from the provisions of goods or services after deduction of trade discounts, value added tax and any other relevant taxes. 86
- An undertaking’s previous financial year is the undertaking’s financial year preceding the date of the Commissioner’s decision (the date of the penalty notice). If a turnover figure is not available for that financial year, then the Commissioner will use the turnover figure for the financial year immediately preceding it.
- The Commissioner will generally base turnover figures used for the purpose of calculating the fine on the consolidated turnover recorded in an undertaking’s audited accounts. 87 However, there may be instances where the undertaking’s audited accounts are not yet available (for example, if the Commissioner’s decision to impose a fine closely follows the end of the undertaking’s financial year and accounts for that financial year are not yet completed). If this is the case, the Commissioner will use the turnover figure from the audited accounts for the financial year immediately preceding it. The Commissioner may adjust the turnover figure used to ensure it reflects the true scale of the undertaking (for example, by using more recent management accounts or forecast figures where available).
- Where an undertaking does not have audited accounts, for example where it is exempt from audit requirements because it is a micro or small enterprise, the Commissioner will instead use the undertaking’s unaudited accounts or other available financial information.
- If necessary, the Commissioner will obtain financial information using the statutory power to issue information notices under section 142 DPA 2018. However, there may still be situations where the Commissioner can only obtain limited evidence. In such cases, the Commissioner may exercise judgement as to the appropriate turnover amount to use in calculating the fine.
Adjustment to reflect the size of the undertaking
- As explained above, the Commissioner considers that it is appropriate to take into account the size of the undertaking when deciding on the starting point for the calculation of the fine.
- In order to distinguish between undertakings, the Commissioner uses the following ranges set out in Table B below to determine an appropriate starting point that reflects their different sizes and financial positions, using turnover as a proxy. The ranges for micro-, small- and medium-enterprises (SMEs) are derived from the definition of SMEs used by the UK government. 88
Table B: Ranges for adjustment based on the turnover of the undertaking
| Annual turnover of the undertaking | Range for adjustment based on turnover of the undertaking |
| Up to £2 million (micro-enterprise) | Between 0.2% and 0.4% |
| £2 million to £10 million (small-enterprise) | Between 0.4% and 2% |
| £10 million to £50 million (medium-enterprise) | Between 2% and 10% |
| £50 million to £100 million | Between 10% and 20% |
| £100 million to £250 million | Between 20% and 50% |
| £250 million to £435 million 89 / £437.5 million 90 | Between 50% and 100% |
| Above £435 million / £437.5 million | No adjustment to the starting point 91 |
- As a general rule, the Commissioner is likely to choose a higher amount for undertakings with higher turnover within the applicable range. However, these ranges are only indicative. The Commissioner will reach a decision on a case-by-case basis as to whether it is appropriate to adjust the starting point of the fine in this way, having regard to the need for the fine to be effective, proportionate and dissuasive. Therefore, the Commissioner retains the discretion to impose a fine up to the applicable statutory maximum. If relevant, the Commissioner will give reasons for not making an adjustment at Step 2 based on the ranges set out in Table B.
- The Commissioner will express any adjustment made to the starting point for the fine to reflect the size of an undertaking as a percentage based on the ranges set out in Table B.
83 See EDPB, Binding Decision 1/2021, WhatsApp Ireland, paragraphs 411 and 412: ‘[Insofar] the turnover of an undertaking is not exclusively relevant for the determination of the maximum fine amount in accordance with Article 83(4)-(6) GDPR, but it may also be considered [as one relevant element among others] for the calculation of the fine itself, where appropriate, to ensure the fine is effective, proportionate and dissuasive in accordance with Article 83(1) GDPR’.
84 In addition, as set out in Recital 150 UK GDPR, where a fine is imposed on a person that is not an undertaking, the Commissioner will, were relevant, take account of the general level of income in the UK as well as the economic situation of the person in considering the appropriate amount of the fine.
85 See Article 83(4) to (6) UK GDPR and section 155(5) and (6) DPA 2018.
86 See section 474 Companies Act 2006. The Commissioner will also have regard to relevant legislation relating to the calculation of ‘turnover’ that may arise for certain undertakings, for example in the areas of credit, financial services and insurance.
87 In many cases, the most straightforward way to identify turnover for the undertaking will be to use the corporate group’s consolidated financial accounts.
88 For example, see Department of Business, Energy and Industrial Strategy (now Department of Business and Trade), Small and medium enterprises (SMEs) action plan: 2022 to 2025 , which uses the European Commission definition of SMEs: SME definition. The European Commission’s definition is derived from Article 2 of the European Commission’s Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises, (2003/361/EC). The Commissioner considers it is appropriate and clearer to apply these ranges in Pounds Sterling, rather than converting the amounts from Euros.
89 Where the standard maximum amount applies.
90 Where the higher maximum amount applies.
91 Above £435 million (for the standard maximum amount) and above £437.5 million (for the higher maximum amount) the undertaking’s size is already reflected by the use of a percentage figure to calculate the statutory maximum and the Commissioner will consider whether it is appropriate to impose a penalty up to the amount allowed by law.