What a GDPR breach actually costs (fines and the larger numbers behind them).

UK GDPR and EU GDPR use the same two-tier penalty structure set out in Article 83. The EU caps are denominated in euros; the UK caps, set in the Data Protection Act 2018, are denominated in pounds.

• Tier 1:up to £8.7 million (UK) or €10 million (EU), or 2% of global annual turnover, whichever is higher. Covers procedural and documentation failures (Article 8, 11, 25-39, 42, 43).
• Tier 2:up to £17.5 million (UK) or €20 million (EU), or 4% of global annual turnover. Covers substantive breaches (Articles 5, 6, 7, 9, lawful basis, international transfers, data subject rights).

The cap is the headline. Most fines settle well below the cap; regulators apply the Article 83(2) factors (nature, gravity, intent, mitigation, prior conduct, cooperation).

A notifiable breach activates a structured response. The cost lines and typical UK-EU 2026 ranges:

• Forensic retainer activation: £15,000 - £200,000 depending on scope and IR firm. Mandiant, NCC Group, Kroll, Bridewell. Day rates inside the engagement run £1,200 - £2,500.
• Legal counsel: £500 - £1,500 / hour for senior data protection counsel; many firms run breach retainers (£3,000 - £30,000 / year) that include 72-hour engagement.
• 72-hour notification work: £8,000 - £40,000 fully loaded across legal, comms, and engineering for a mid-sized incident.
• Customer communications: £0.50 - £3.50 per affected data subject for tier-1 written notification; substantial multipliers for telephone or in-person steps.
• Regulator engagement: £20,000 - £150,000 in legal and forensic time over the 6-18 month investigation cycle.
• Post-incident remediation: commonly two to four times the original implementation budget, because the work is now non-negotiable and time-pressured.

For a typical mid-sized notifiable breach, the response cost (forensic, legal, notification, comms, regulator engagement, remediation) commonly runs five to twenty times the value of any eventual statutory fine. Some breaches receive no fine at all (the regulator may issue a reprimand or formal action plan) while still incurring the full response cost. The 5-20x range is our own modelling observation, built from the itemised response lines above against a typical sub-cap fine; it is a planning heuristic, not a published statistic. The IBM Cost of a Data Breach 2026 UK figure (£3.13m average total) anchors the upper end for larger incidents.

Notification volume cost (mailing 200,000 affected customers is a materially different number from mailing 2,000) is the most commonly under-budgeted line. Civil litigation in UK and EU group-action contexts (representative actions, claimant law firms aggregating breach victims) is the second; this is recoverable in excess of any insurance ceiling for several recent UK cases. Brand and revenue impact (cancelled contracts, churned customers, deal delays) is the third and rarely budgeted at all. Board-level distraction (the executive team running the breach response is not running the company) is the fourth.

These are illustrative composite models, not observed settlements or vendor quotes. Each total is our own arithmetic across the response line items above plus business-disruption, litigation-reserve and brand lines that are not itemised here, so the total sits above the sum of the named components. Treat every figure as a planning band, not a price.

The penalty band a regulator applies to a notified breach is a separate analysis from the cost of getting compliant in the first place. Penalty data and notable enforcement actions are tracked at gdprfine.com.