Home › Law library › Maximum fines for privacy, AI and cybersecurity laws by country
Maximum fines for privacy, AI and cybersecurity laws by country
The highest fine or penalty each law allows, side by side. Fines are maximums: regulators set the actual amount case by case. Each row comes from the law's own page, where every fact links to its official source.
35 laws in 20 jurisdictions. Library last updated 11 October 2026. = confirmed by two independent sources, at least one official. Rows marked “Being verified” are still being confirmed and are not given as answers.
| Law | Jurisdiction | Maximum fine or penalty | Last verified |
|---|---|---|---|
| Cyber Resilience Act (CRA) | European Union | Up to EUR 15m or 2.5% of worldwide turnover (essential requirements, Arts 13-14); EUR 10m or 2% (other duties); EUR 5m or 1% (misleading info). | 10 October 2026 |
| DORA | European Union | Set by Member States for financial entities. Critical ICT providers: periodic penalty payments up to 1% of average daily worldwide turnover. | 10 October 2026 |
| Digital Services Act (DSA) | European Union | Up to 6% of annual worldwide turnover.✓ | 10 October 2026 |
| EU AI Act | European Union | Up to EUR 35m or 7% of worldwide turnover for prohibited practices; EUR 15m or 3% for other obligations incl. high-risk and transparency; EUR 7.5m or 1% for misleading info (whichever higher; SMEs pay the lower).✓ | 10 October 2026 |
| EU Data Act | European Union | Set nationally; must be effective, proportionate and dissuasive (e.g. Ireland's draft: up to 4% of EU turnover). GDPR fines apply to personal-data breaches.✓ | 10 October 2026 |
| European Accessibility Act (EAA) | European Union | Set nationally (fines, product withdrawal, in some countries criminal sanctions); must be effective, proportionate and dissuasive.✓ | 10 October 2026 |
| NIS2 | European Union | Essential entities: maximum of at least EUR 10m or 2% of worldwide turnover; important entities: at least EUR 7m or 1.4% (whichever higher). National caps may be higher.✓ | 10 October 2026 |
| EU GDPR | European Union (EEA) | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ | 10 October 2026 |
| ePrivacy cookie rule | European Union (EEA) | Set nationally; must be effective, proportionate and dissuasive (varies by country).✓ | 10 October 2026 |
| Swiss nFADP (revDSG) | Switzerland | Criminal fines up to CHF 250,000 for wilful breaches of key duties (information, transfers, security, etc.), imposed mainly on the responsible individual; the company can be fined up to CHF 50,000 instead where finding the individual is disproportionate.✓ | 10 October 2026 |
| Turkey KVKK | Türkiye | 2026 administrative fines (Art 18, revalued each 1 January by the tax revaluation rate, 25.49% for 2026): data security failures TRY 256,357-17,092,242; non-compliance with Board decisions TRY 427,263-17,092,242; VERBIS breaches TRY 341,809-17,092,242; privacy notice failures TRY 85,437-1,709,200; failing to notify a standard contract TRY 90,308-1,806,177. Criminal penalties under Turkish Criminal Code Arts 135-140 also apply (Art 17).✓ | 10 October 2026 |
| UK GDPR / DPA 2018 | United Kingdom | Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher (lower tier £8.7m or 2%). PECR fines raised to the same level from 5 Feb 2026.✓ | 10 October 2026 |
| UK Online Safety Act | United Kingdom | Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater (Sch 13 para 4). Ofcom can also impose daily penalties and, with a court order, business disruption measures requiring payment, advertising or internet access providers to stop working with a service or block it in the UK. Senior managers can face criminal liability for certain information and enforcement failures.✓ | 11 October 2026 |
| UK PECR | United Kingdom | Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for breaches on or after 5 Feb 2026. Earlier breaches stay under the old £500,000 cap. Directors can be fined for some marketing breaches. Reg 5A breach-notice failures are dealt with by fixed penalty, not a full penalty notice.✓ | 11 October 2026 |
| UK PSTI (connected products) | United Kingdom | Up to £10 million or 4% of qualifying worldwide revenue, whichever is greater, plus up to £20,000 per day for a continuing breach. OPSS can also issue compliance, stop and recall notices and seek forfeiture.✓ | 11 October 2026 |
| LGPD | Brazil | Up to 2% of the company's (or group's) revenue in Brazil in the prior fiscal year, net of taxes, capped at R$50 million per infraction.✓ | 10 October 2026 |
| CCPA/CPRA | California, United States | Administrative fines/civil penalties up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (from 1 Jan 2025). Data-breach private actions: $107-$799 per consumer per incident or actual damages.✓ | 10 October 2026 |
| PIPEDA | Canada (federal) | Fines up to C$100,000 per indictable offence (C$10,000 on summary conviction) for knowingly breaching breach-reporting, notification or record-keeping duties, not keeping information under an access request, retaliating against whistleblowers, or obstructing the Commissioner. Bill C-36 would allow penalties up to C$10M or 3% of gross global revenue, and fines up to C$25M or 5%.✓ | 10 October 2026 |
| Quebec Law 25 | Quebec, Canada | Administrative monetary penalties up to C$10M or 2% of worldwide turnover (whichever is greater); penal fines up to C$25M or 4% of worldwide turnover for enterprises (C$5,000-C$100,000 for individuals). | 10 October 2026 |
| Privacy Act / APPs | Australia | Serious interferences: greater of A$50m, 3x the benefit gained, or 30% of domestic turnover. Lower tier up to A$3.3m; infringement notices for administrative breaches. Individuals can also sue under the statutory tort.✓ | 10 October 2026 |
| PIPL | China | Serious violations: up to RMB 50 million or 5% of the previous year's turnover, plus business suspension or licence revocation; responsible managers fined RMB 100,000-1 million and may be barred from senior roles.✓ | 10 October 2026 |
| DPDP Act / DPDP Rules | India | Up to INR 250 crore per breach for failing to keep reasonable security safeguards; up to INR 200 crore for breach-notice or children's data failures; up to INR 150 crore for breaching SDF duties; up to INR 50 crore for other violations.✓ | 10 October 2026 |
| APPI | Japan | Up to JPY 100 million fine for companies (e.g. ignoring PPC orders or improper database provision); individuals up to 1 year in prison or JPY 1 million. From the 2026 amendment: administrative surcharges equal to money gained from certain violations.✓ | 10 October 2026 |
| PDPA | Singapore | Up to 10% of annual Singapore turnover if that turnover exceeds S$10 million, otherwise up to S$1 million. Criminal offences for reckless disclosure, re-identification and misuse of data.✓ | 10 October 2026 |
| PIPA | South Korea | Fines up to 3% of total revenue (excluding unrelated revenue). From 11 Sep 2026, up to 10% for repeated, intentional or grossly negligent breaches, very large breaches, or ignoring PIPC orders. Punitive damages up to 5x actual losses.✓ | 11 October 2026 |
| ADGM DPR | Abu Dhabi Global Market (UAE free zone) | Administrative fines of up to USD 28 million; failing to pay the data protection fee can attract fines of up to 150% of the fee. Individuals can also claim compensation.✓ | 10 October 2026 |
| DIFC DPL | Dubai International Financial Centre (UAE free zone) | Administrative fines of up to USD 100,000 per listed contravention under Schedule 2 (e.g., up to USD 50,000 for not appointing a required DPO), plus uncapped general fines for serious breaches and court compensation.✓ | 10 October 2026 |
| Israel PPL / Amendment 13 | Israel | PPA administrative fines scale with violation type, number of data subjects (e.g., NIS 100 per person) and company size, and can reach millions of NIS. Statutory damages NIS 10,000 without proof of harm; up to 3–5 years' prison for offences.✓ | 11 October 2026 |
| NDPA / GAID | Nigeria | Major importance: greater of 2% of prior-year gross revenue or NGN 10 million. Others: greater of 2% or NGN 2 million.✓ | 10 October 2026 |
| Saudi PDPL | Saudi Arabia | Administrative fines of up to SAR 5 million, or a warning, imposed by a Violations Committee, with appeal to the competent court; the fine can be doubled for repeat violations, up to twice the cap (PDPL Art. 36). Disclosing or publishing sensitive data with intent to harm the data subject or for personal benefit carries up to 2 years' imprisonment and/or a fine of up to SAR 3 million, which can also be doubled for repeat offences (Art. 35). Courts may order confiscation of proceeds, the court or committee may order the decision published at the violator's expense (Art. 38), and individuals can claim compensation (Art. 40).✓ | 11 October 2026 |
| POPIA | South Africa | Administrative fine up to ZAR 10 million; up to 10 years' imprisonment for certain offences; civil damages claims also possible.✓ | 10 October 2026 |
| UAE PDPL | United Arab Emirates (onshore; excludes DIFC and ADGM free zones) | PDPL itself sets no fines; a Cabinet decision on violations and penalties is pending. The Cybercrime Law (Decree-Law 34/2021) may apply: detention and/or AED 50,000–500,000.✓ | 10 October 2026 |
| PECA | Pakistan | Cyber terrorism: up to 14 years and/or PKR 50 million. Unauthorised use of identity information: up to 3 years and/or PKR 5 million. Spreading fake information (s.26A): up to 3 years and/or PKR 2 million.✓ | 10 October 2026 |
| Pakistan PDP Bill | Pakistan | Proposed (not law): May 2023 draft allows fines up to USD 2 million (or PKR equivalent) for unremedied contraventions, with lower caps for unlawful processing (USD 125,000; USD 500,000 for sensitive and USD 1 million for critical data).✓ | 10 October 2026 |
| Pakistan SBP/PTA data rules | Pakistan | Being verified | 10 October 2026 |
See which of these laws apply to you with the Global Law Finder
Information only, not legal advice. Laws change; open the law page and its official source before relying on a row. Spotted an error? Email contact@