OpenLegislation

Section 157 Maximum amount of penaltyI1

(1)

In relation to an infringement of a provision of the F1UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is—

(a)

the amount specified in Article 83 of the UK GDPR, or

(b)

if an amount is not specified there, the standard maximum amount.

(2)

In relation to an infringement of a provision of Part 3 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—

(a)

in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, F250B, 50C, 52, 53, 73, F3... 75, 76, 77 or 78, the higher maximum amount, and

(b)

otherwise, the standard maximum amount.

(3)

In relation to an infringement of a provision of Part 4 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—

(a)

in relation to a failure to comply with section 86, 87, 88, 89, 90, 91, 93, 94, 100 or 109, the higher maximum amount, and

(b)

otherwise, the standard maximum amount.

(4)

In relation to a failure to comply with an information notice, an assessment notice F4, an interview notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.

(4A)

F5In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.

(5)

The “higher maximum amount” is—

(a)

in the case of an undertaking, F6£17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or

(b)

in any other case, £17,500,000.

(6)

The “standard maximum amount” is—

(a)

in the case of an undertaking, F7£8,700,000 or 2% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or

(b)

in any other case, £8,700,000.

(7)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Annotations

Textual amendments

F1

Words in s. 157(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F2

Words in s. 157(2)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 16; S.I. 2026/82, reg. 2(z8) (with reg. 5)

F3

Word in s. 157(2)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F4

Words in s. 157(4) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(5), 142(1); S.I. 2026/82, reg. 2(s)

F5

S. 157(4A) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 18; S.I. 2026/82, reg. 3(b) (with reg. 7)

F6

Sum in s. 157(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F7

Sum in s. 157(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F8

S. 157(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

I1

S. 157 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)