Lower tier — €10M / 2%
Upper tier — €20M / 4%
Greater of the flat cap or the revenue percentage, per Article 83.
Unintentional — $2,663
Intentional — $7,988
Per-violation amount (2026, inflation-adjusted), applied per record.
Statutory damages of $100–$750 per consumer per incident, regardless of proven harm (Civ. Code § 1798.150).
Annual cap per identical provision — the binding ceiling once records exceed a few hundred.
Estimated maximum exposure
Low
$0
High
$0
Exposure by regime
GDPR$0
CCPA / CPRA admin.$0
CCPA private action$0
HIPAA$0
Toggle each regime on the left to include or exclude it from the total.
Not legal advice. This calculates simplified statutory maximums under GDPR Art. 83, CCPA/CPRA Civ. Code §§ 1798.150/1798.155/1798.199.90, and HIPAA/HITECH civil penalty tiers (45 CFR § 160.404) — figures current as of 2026. Regulators and courts almost always assess amounts far below these ceilings, and jurisdictions, overlapping laws, and mitigating factors vary widely. Consult a qualified attorney for guidance specific to your situation.