# How much can the ICO fine you under UK GDPR? The legal maximum is a ceiling, not a prediction of what a business will pay. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. **The short answer.** UK GDPR has two maximum fine levels. The standard level is £8.7 million, or 2% of an undertaking’s worldwide annual turnover if higher. The higher level is £17.5 million, or 4% if higher. The turnover is from the preceding financial year ([ICO, The maximum amount of a fine under UK GDPR and DPA 2018](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/), checked 7 October 2026). ## What are the maximum UK GDPR fines? The level depends on which rule has been broken. Within each level, the turnover calculation can produce a larger maximum than the fixed amount. These are UK limits in pounds ([ICO, The maximum amount of a fine under UK GDPR and DPA 2018](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/), checked 7 October 2026). **Read the fixed amount together with the turnover rule** | Level | Fixed amount | Turnover rule | | --- | --- | --- | | Standard | £8.7 million | For an undertaking, 2% of worldwide annual turnover in the preceding financial year, if higher | | Higher | £17.5 million | For an undertaking, 4% of worldwide annual turnover in the preceding financial year, if higher | Source: ICO, The maximum amount of a fine under UK GDPR and DPA 2018, https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/ (checked 7 October 2026) **The fixed amounts in the two UK fine levels** Unit: £ million - Standard level: 8.7 - Higher level: 17.5 £ million. These are only the fixed parts of the limits, not expected fines. The turnover rule can make either maximum higher. Source: ICO, The maximum amount of a fine under UK GDPR and DPA 2018, https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/ (checked 7 October 2026) ## Does every breach lead to the maximum fine? No. The ICO must decide what is effective, proportionate and enough to discourage further breaches in the case before it. The legal ceiling and the actual fine are different questions ([ICO, The factors the Commissioner will take into account when deciding whether to issue a penalty notice and in determining the amount](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-factors-the-commissioner-will-take-into-account-when-deciding-whether-to-issue-a-penalty-notice-and-in-determining-the-amount/), checked 7 October 2026). It considers how serious the breach was, how long it lasted, how many people it affected and the harm caused. It also looks at whether the conduct was deliberate or careless, and the steps taken to reduce the harm ([ICO, The factors the Commissioner will take into account when deciding whether to issue a penalty notice and in determining the amount](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-factors-the-commissioner-will-take-into-account-when-deciding-whether-to-issue-a-penalty-notice-and-in-determining-the-amount/), checked 7 October 2026). > "That’s why our focus is on supporting and enabling you to comply, and not on fines." > ICO, Small organisation guidance > ICO, Data protection fines, why they happen and how to avoid them, https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-fines-why-they-happen-and-how-to-avoid-them/ (checked 7 October 2026) ## Whose turnover counts in a group of companies? The law uses the word “undertaking”. This means an entity involved in economic activity, whatever its legal form or funding. Where companies form one undertaking, the turnover can be that of the whole group, rather than just one company in it ([ICO, The concept of an ‘undertaking’ for the purpose of imposing fines](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-concept-of-an-undertaking-for-the-purpose-of-imposing-fines/), checked 7 October 2026). That is why a turnover figure from a single company’s accounts may not settle the maximum. If the group structure matters to your case, it is a point to raise with your legal adviser ([ICO, The maximum amount of a fine under UK GDPR and DPA 2018](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/) and [ICO, The concept of an ‘undertaking’ for the purpose of imposing fines](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-concept-of-an-undertaking-for-the-purpose-of-imposing-fines/), checked 7 October 2026). ## What does the ICO say about smaller organisations? In its guidance for small organisations, the ICO says its focus is on helping them comply. It also says it takes sensible steps to reduce risk into account. That does not remove the power to fine ([ICO, Data protection fines, why they happen and how to avoid them](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-fines-why-they-happen-and-how-to-avoid-them/) and [ICO, The maximum amount of a fine under UK GDPR and DPA 2018](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/), checked 7 October 2026). The useful task is to keep improving how you handle data. The ICO describes data protection as ongoing risk management because people and systems change. Treat the maximum fine as a legal limit, not a reason to buy a service in a panic ([ICO, Data protection fines, why they happen and how to avoid them](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-fines-why-they-happen-and-how-to-avoid-them/), checked 7 October 2026). ## What to do 1. Check which rule and fine level are relevant to the issue ([ICO, The maximum amount of a fine under UK GDPR and DPA 2018](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/), checked 7 October 2026). 2. If turnover affects the limit, check which companies form the undertaking ([ICO, The concept of an ‘undertaking’ for the purpose of imposing fines](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-concept-of-an-undertaking-for-the-purpose-of-imposing-fines/), checked 7 October 2026). 3. Record the steps taken to reduce harm and improve controls ([ICO, Data protection fines, why they happen and how to avoid them](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-fines-why-they-happen-and-how-to-avoid-them/) and [ICO, The factors the Commissioner will take into account when deciding whether to issue a penalty notice and in determining the amount](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-factors-the-commissioner-will-take-into-account-when-deciding-whether-to-issue-a-penalty-notice-and-in-determining-the-amount/), checked 7 October 2026). 4. Keep reviewing risks as people and systems change ([ICO, Data protection fines, why they happen and how to avoid them](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-fines-why-they-happen-and-how-to-avoid-them/), checked 7 October 2026). ## Common questions ### Is the higher limit always £17.5 million? No. For an undertaking, 4% of worldwide annual turnover in the preceding financial year applies if it is higher ([ICO, The maximum amount of a fine under UK GDPR and DPA 2018](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/), checked 7 October 2026). ### Is every data breach fined? The ICO considers the case and its response. Its small organisation guidance says the focus is on helping organisations comply, rather than fines ([ICO, Data protection fines, why they happen and how to avoid them](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-fines-why-they-happen-and-how-to-avoid-them/) and [ICO, The factors the Commissioner will take into account when deciding whether to issue a penalty notice and in determining the amount](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-factors-the-commissioner-will-take-into-account-when-deciding-whether-to-issue-a-penalty-notice-and-in-determining-the-amount/), checked 7 October 2026). ### Does only the subsidiary’s turnover count? Not necessarily. Where companies form one undertaking, the relevant turnover can be the whole group’s ([ICO, The concept of an ‘undertaking’ for the purpose of imposing fines](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-concept-of-an-undertaking-for-the-purpose-of-imposing-fines/), checked 7 October 2026). ## Where next - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md) ## Sources - ICO, The maximum amount of a fine under UK GDPR and DPA 2018: https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/ (checked 7 October 2026) - ICO, The factors the Commissioner will take into account when deciding whether to issue a penalty notice and in determining the amount: https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-factors-the-commissioner-will-take-into-account-when-deciding-whether-to-issue-a-penalty-notice-and-in-determining-the-amount/ (checked 7 October 2026) - ICO, Data protection fines, why they happen and how to avoid them: https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-fines-why-they-happen-and-how-to-avoid-them/ (checked 7 October 2026) - ICO, The concept of an ‘undertaking’ for the purpose of imposing fines: https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-concept-of-an-undertaking-for-the-purpose-of-imposing-fines/ (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.