Remedy
Start free

Section 157: Maximum amount of penalty

Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk

Part 6: Enforcement

In relation to an infringement of a provision of the UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is—

the amount specified in Article 83 of the UK GDPR, or
if an amount is not specified there, the standard maximum amount.

In relation to an infringement of a provision of Part 3 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—

in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, 50B, 50C, 52, 53, 73, ... 75, 76, 77 or 78, the higher maximum amount, and
otherwise, the standard maximum amount.

In relation to an infringement of a provision of Part 4 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—

in relation to a failure to comply with section 86, 87, 88, 89, 90, 91, 93, 94, 100 or 109, the higher maximum amount, and
otherwise, the standard maximum amount.

In relation to a failure to comply with an information notice, an assessment notice , an interview notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.

The "higher maximum amount" is—

in the case of an undertaking, £17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
in any other case, £17,500,000.

The "standard maximum amount" is—

in the case of an undertaking, £8,700,000 or 2% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
in any other case, £8,700,000.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

About this text

This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.

Reuse reviewed 21 August 2026 under Open Government Licence v3.0.