GDPR vs HIPAA penalties

GDPR vs HIPAA penalties: which exposure is larger for your organization?

If your organization holds both EU personal data and US electronic protected health information, you need to know which law can produce the larger fine. The answer depends on your turnover, the number of violations and the tier each violation falls into, so neither law can be ranked in the abstract. GDPR maximums are the higher of a fixed euro amount or a percentage of total worldwide annual turnover, set in two tiers under Article 83(4) (EUR 10 million or 2%) and Article 83(5) (EUR 20 million or 4%). HIPAA civil money penalties work differently: they are set per violation within inflation-adjusted tiers, with a calendar-year cap of $2,190,294 for penalties assessed on or after January 28, 2026.

Because the GDPR cap scales with turnover, a large group can face a ceiling far above the HIPAA annual cap, while a smaller organization may find the fixed euro amount is the figure that applies. HIPAA exposure, by contrast, grows with the count of violations and with the culpability tier, since each violation can be assessed separately up to that annual cap. Security gaps under Article 32 of the GDPR sit in the lower GDPR tier, while principle, lawful basis and transfer failures sit in the higher one. For HIPAA, the tier turns on what the entity knew and whether it corrected the problem. Confirm your worldwide turnover for the preceding financial year, count your likely violations by law and tier, and model both sides before you set insurance limits or remediation priorities.

These figures are maximums set by law, not predicted fines. Regulators weigh factors such as the gravity of the violation, the steps taken to mitigate harm and cooperation, and actual penalties are usually well below the ceilings. Use the caps to size worst-case exposure, not to forecast outcomes. The GDPR is enforced by national supervisory authorities, while HHS Office for Civil Rights enforces the HIPAA Security Rule, so you will face two separate enforcement relationships. Check the current HIPAA penalty table in the eCFR text of 45 CFR 102.3 and the Article 83 text in the GDPR on EUR-Lex with your counsel before relying on any figure.

How the GDPR and HIPAA penalty structures differ, part by part

This table sets the GDPR and HIPAA civil penalty regimes side by side, row by row, so leaders can see which exposure drivers apply to each law. Read each row as a separate question: what sets the ceiling, who decides, and whether any certificate changes the outcome.

Feature	GDPR (Regulation (EU) 2016/679)	HIPAA Security Rule (45 CFR Part 164)
Legal basis	Article 83 sets administrative fine ceilings applied by national supervisory authorities	Civil money penalties under HIPAA enforcement rules, with inflation-adjusted amounts in 45 CFR 102.3
Penalty unit	Percentage of total worldwide annual turnover of the preceding financial year, or a fixed euro amount, whichever is higher	Per violation, with a separate calendar-year cap
Maximum amounts	EUR 10 million or 2% (Article 83(4)); EUR 20 million or 4% (Article 83(5))	$145 per violation (no knowledge) up to $2,190,294 per violation (uncorrected willful neglect)
Tiers	Two tiers: security, breach notice, DPIA and processor duties in the lower tier; principles, lawful basis, rights and transfers in the upper tier	Four culpability levels: no knowledge, reasonable cause, willful neglect corrected, and willful neglect uncorrected
Annual cap	No separate annual cap; the turnover-based maximum applies per infringement decision	Calendar-year cap of $2,190,294 for identical violations
Enforcer	Independent national supervisory authorities; the EDPB resolves disputes through binding decisions (Articles 65 and 70)	HHS Office for Civil Rights, through complaint investigations, compliance reviews and audits
Appeal or decision route	Decisions go through national courts; confirm the route with counsel for each Member State concerned	Confirm the administrative hearing and judicial review steps with counsel for the specific penalty
Effect of a third-party certificate	No certificate lowers the fine ceiling; Article 42 certification is voluntary and does not reduce controller or processor responsibility	HHS does not recognize private certifications, and a certification does not prevent HHS from later finding a violation (HHS FAQ 2003)

What moves an organization into the higher GDPR and HIPAA penalty tiers

Both regimes scale exposure with the kind of violation, its severity and how the organization responded. The cards below separate the factors that decide which maximum applies under each law, so you can document the facts that keep a violation in a lower tier.

Infringement category under Article 83

Article 83(5) covers principles, lawful basis, consent, data subject rights and transfers, with a maximum of EUR 20 million or 4% of worldwide turnover. Article 83(4) covers security, breach notification, DPIAs, DPOs and processor duties, with a maximum of EUR 10 million or 2%. Map each process to its category now, because a gap in lawful basis can land in the higher tier even when security is sound.

Preceding-year worldwide turnover

For GDPR undertakings, the percentage maximum is applied to total worldwide annual turnover of the preceding financial year, and the higher of the fixed amount or the percentage applies. Ask finance to confirm which entity and consolidated figure would be used for your group, since a group structure can change the base. Revisit this figure after acquisitions or large revenue shifts.

HIPAA knowledge level at violation

HIPAA civil money penalties rise with what the entity knew. Ranges run from no knowledge to reasonable cause, willful neglect corrected, and uncorrected willful neglect. Document how and when staff became aware of each finding, because the knowledge level is judged on facts in your records. Confirm the current tier amounts with the cited federal rule before using them in a board paper.

Correction within the required period

Under HIPAA, a violation that is corrected within the required period can fall into a lower tier than one left open, which makes the correction date a decision point. Record the discovery date, the corrective action, the date it was completed and the evidence that the fix works. Ask counsel to confirm the correction window that applies to your facts before relying on it.

Number of violations in a calendar year

HIPAA penalties are assessed per violation, and the calendar-year cap limits total exposure for identical violations. Repeated identical findings across systems or sites can multiply the per-violation count until the annual cap applies. Track recurring findings in one register so you can show whether issues were isolated or systemic, and confirm how your counsel would count them.

Ignored supervisory authority orders

Under the GDPR, failing to comply with an order of a supervisory authority falls in the higher Article 83(5) tier, even when the underlying issue is otherwise lower risk. Assign an owner to every regulator or HHS request, set a deadline, and keep a log of responses and corrective evidence. Confirm with counsel how each national authority handles follow-up requests.

Who enforces each penalty and how a case moves forward

The GDPR is enforced by independent national supervisory authorities under Article 51, one or more per Member State, and each authority acts on its own complaints, investigations and corrective powers. When a case crosses borders, the European Data Protection Board established by Article 68 issues guidelines and can resolve disputes between authorities through binding decisions under Articles 65 and 70. Organizations exposed to the GDPR therefore deal with a lead authority and possibly several concerned authorities, not a single EU regulator.

Lead authority: For cross-border processing, the authority of the main establishment usually takes the lead, so the place of your EU main establishment shapes who you deal with first.
Binding EDPB decisions: Where authorities disagree, the Board's binding decision under Article 65 can settle the matter, which can extend the timeline of a case.
Procedural rules from 2 April 2027: Regulation (EU) 2025/2518 of 26 November 2025 sets additional procedural rules for complaints and investigations in cross-border cases and applies from 2 April 2027.
Text not yet amended: As of October 2026 the GDPR text has not been amended, and the Omnibus and Digital Omnibus proposals remain in the legislative process.
Maximum fines: The Article 83 tiers apply to the case, and the authority decides the amount within those limits.

Confirm with your lead supervisory authority or national data protection authority which procedural rules will govern your open matters, and check the current legislative status on the European Parliament Legislative Observatory before relying on any timeline.

Why GDPR fines scale with turnover while HIPAA fines scale with violations

GDPR fines are capped by the size of the business. Article 83 sets two maximum tiers. The first allows up to EUR 10 million or 2% of total worldwide annual turnover of the preceding financial year, for infringements such as security of processing under Article 32. The second allows up to EUR 20 million or 4% for infringements of the core principles, lawful basis, data subject rights and transfer rules. In each tier the ceiling is whichever figure is higher. For a group with large turnover, the percentage is the figure that sets the ceiling, so the exposure rises with revenue. These are maximums, and the supervisory authority decides the amount within them. Confirm which turnover figure a regulator would use and which tier each likely infringement falls into.

HIPAA civil money penalties use a different unit. Each violation carries a penalty, and the total is limited by an annual cap. For penalties assessed on or after January 28, 2026, the inflation-adjusted amount ranges from $145 per violation where the entity did not know of the violation, up to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294 under the 45 CFR 102.3 penalty adjustment table. The HHS Office for Civil Rights enforces the Security Rule, so exposure grows with the number of separate violations it finds and how long each one continues. Because the cap is a fixed dollar figure, it does not move with revenue. Confirm the adjusted amounts in effect on the date a penalty would be assessed.

The two counting models mean one incident can produce different exposure on each side. Consider an illustrative case in which a single breach touches EU customer records and US patient records held by the same group. On the GDPR side, the ceiling depends on group turnover and the tier of each infringement. On the HIPAA side, the figure depends on the number of Security Rule violations, their culpability and how long they persisted, up to the calendar-year cap. A large group may face the higher GDPR ceiling, while a smaller provider may find its HIPAA exposure driven mainly by how many provisions it failed. Map each finding to its article or standard, record when each gap began and when it was corrected, and ask counsel to confirm how each regulator counts violations before building an exposure model.

How to measure your exposure on each side before you set budget

This sequence turns the GDPR and HIPAA penalty ceilings into an exposure estimate your leadership can test, using your own processing map, turnover figure and control set rather than headline maximums.

Map processing to GDPR infringement categories
Start with a list of the EU personal data flows your organization runs, including processing for EU residents by systems hosted in the US. For each flow, ask your counsel or DPO which obligations could be breached: security and breach notification duties fall under the Article 83(4) tier (up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher), while lawful basis, data subject rights and transfer rules fall under the Article 83(5) tier (up to EUR 20 million or 4%, whichever is higher). Done means each flow has a tier assigned and a named owner who signed off the mapping.
Confirm the turnover base for the percentage test
Ask finance which figure would be used as total worldwide annual turnover of the preceding financial year, and whether it is consolidated across group entities. Confirm with counsel how a regulator would treat a group structure, since the percentage applies to the undertaking concerned. Done means finance has written down the turnover figure, its period and its consolidation basis, so the percentage test can be recalculated when the figures change.
Identify HIPAA roles and ePHI systems in scope
Ask your privacy officer to confirm whether each entity is a covered entity (health plan, health care clearinghouse or covered health care provider), a business associate, or both. Then inventory every system that creates, receives, maintains or transmits electronic protected health information under 45 CFR 164.302. Done means a dated register lists each in-scope system, its role and the business associate agreements that cover it.
Count possible violations under addressable reasoning
For each in-scope system, have the security lead map the Security Rule implementation specifications that apply. Under 45 CFR 164.306(d), an addressable specification requires a documented decision on whether it is reasonable and appropriate, and an equivalent measure where it is not. Ask counsel how a regulator would count distinct violations from a single incident, because each failed specification may be treated separately. This is an illustrative exercise, not a prediction. Done means the team has a list of specifications where a gap would be a separate violation, with the documented reasoning attached.
Check the HIPAA cap and tier table against the assessment date
Pull the current inflation-adjusted civil money penalty table in 45 CFR 102.3 and record the effective date you are assessing against. The table gives a per-violation range by culpability tier and a calendar-year cap, so the date matters. Confirm with counsel which culpability tier the organization's records would support. Done means the assessment cites the table version, the date, and the tier the team considers most likely, with the reasoning written down.
Document which corrections you could make in time
Ask the privacy officer and security lead which gaps could be corrected within the period the HIPAA rule allows and which would take longer. The distinction matters because the tier an organization falls into depends heavily on whether a violation was corrected. Also ask counsel which GDPR remediation steps would be credible to a supervisory authority. Done means a corrections register lists each gap, the owner, and whether correction is feasible, and it is reviewed before the budget is set.

What the fines leave out: audits, remediation and proof of compliance

The fine maximums are only one part of what an incident or enforcement case costs. The costs that sit outside the penalty are often larger and arrive sooner: internal legal and privacy office time, forensic investigation to establish what data was affected, notification work for regulators and individuals, and the remediation of controls that an investigator finds lacking. For the GDPR, the controls in question are the security of processing under Article 32 and the breach duties in Articles 33 and 34. For HIPAA, they are the Security Rule standards in 45 CFR Part 164 Subpart C, including the addressable implementation specifications that must be documented as assessed and either implemented or justified. Each of these items has a cost that depends on the size of the estate, the data flows and how well records are kept before an event occurs, so leaders should ask their own teams to estimate them rather than rely on any headline figure.

Third-party assessments need particular care in budgeting because neither regime requires one. The GDPR requires no audit, attestation or certificate, and Article 42 certification is voluntary and does not reduce the controller's or processor's responsibility. HHS states that no Security Rule standard requires an entity to certify compliance, and that a private certification does not prevent HHS from later finding a violation. Any assessment spend is therefore a choice made for customer assurance, contract terms, or internal confidence, not a shield against fines. Before approving that spend, decide which question it answers and whether the evidence it produces will be read by an EU supervisory authority or by OCR.

When requesting a quote for assessment, forensic or remediation work, ask the provider for a written scope that names the systems, data stores, regulations and controls in and out of bounds, and for a list of deliverables in the form the reader will use, such as a findings register, evidence set or remediation plan. Ask the provider to separate one-time work, such as the initial gap analysis or the first remediation sprint, from recurring work, such as periodic testing, evidence refresh, log review or annual reassessment, and to state what triggers additional fees. Confirm with counsel which records must be kept for each regime, and confirm with the provider how their deliverables map to GDPR Article 32 and the relevant HIPAA standards without implying that the mapping is a certification.

Questions buyers ask about GDPR and HIPAA penalty exposure

Which penalty is higher for a US company with EU customers?

It depends on the size of the company and the violation. GDPR fines are tied to worldwide annual turnover: under Article 83(4) the maximum is EUR 10 million or 2% of turnover for security and breach notification failures, and under Article 83(5) it is EUR 20 million or 4% for core principles, rights and transfers, whichever is higher in each case. HIPAA civil money penalties are set per violation, with an inflation-adjusted range for penalties assessed on or after January 28, 2026 of $145 to $2,190,294 per violation, and a calendar-year cap of $2,190,294 (45 CFR 102.3). For a large company, the GDPR ceiling usually grows with revenue, while HIPAA exposure is capped per year for each violation category. Model both with your own turnover figures and violation scenarios, and confirm the calculation with counsel.

Does holding a certificate lower a GDPR or HIPAA fine?

No certificate lowers either fine on its own. HHS states in FAQ 2003 that no Security Rule standard requires certification, that HHS does not endorse or recognize private certifications, and that a third-party certification does not stop HHS from later finding a violation. The GDPR requires no certificate, and Article 42 certification is voluntary, issued for at most three years, and does not reduce the controller's or processor's responsibility for compliance. What helps in practice is evidence that controls were designed, operated and documented, because regulators assess the facts of each case. Ask any certification body or consultant to show you the scope of what their document actually covers before you rely on it.

How does the HIPAA penalty cap reset each calendar year?

The HIPAA annual cap applies per calendar year, so the cap for a given category of violation restarts on January 1. The current calendar-year cap for identical violations is $2,190,294 for penalties assessed on or after January 28, 2026 (45 CFR 102.3). Per-violation amounts scale with the culpability tier, from no knowledge to uncorrected willful neglect, so the tier an incident falls into matters as much as the count. Violations that continue across years can accrue in more than one calendar year, which is why prompt correction is a key factor. Confirm the current table in the eCFR before you use the figures in a board paper.

Can DeployOpen tell us what fine we would face?

No. DeployOpen does not calculate fines or predict regulator decisions. GDPR fines are set by independent national supervisory authorities under Article 51 and depend on the facts of each case, while HIPAA penalties are set by HHS OCR based on the tier of culpability and the circumstances. DeployOpen can help you prepare systems, controls and evidence for assessment, and can document what was in place and when. Your legal advisers and, where relevant, your regulator's guidance should estimate exposure. Ask us for a written scope that covers the evidence we would prepare, not for a penalty forecast.

What drives the cost of preparing evidence, and can we do it ourselves?

Your internal team can do much of this work, and many organizations do. Cost is driven by the number of systems in scope, how many business associates and processors you have, how documented your controls already are, and whether evidence exists for past periods. For HIPAA, the Security Rule covers 18 standards and 36 implementation specifications, and addressable items need documented reasoning. For the GDPR, you need records of processing, security measures, breach procedures and processor contracts. Costs include internal staff time, outside counsel, tooling and any external assessor or implementation partner. Ask any provider for a quote that separates one-time preparation from recurring reviews and monitoring.

How long does a readiness effort take for GDPR and HIPAA?

No supplied source gives a standard duration, so we cannot state one. The time depends on the number of systems and data flows, the state of existing documentation, the number of processors and business associates, and how many decisions require legal review. Most engagements with DeployOpen are fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts. Ask for a written scope and timeline that lists each system, each deliverable and each assumption about your environment. Compare any timeline you receive against the scope it depends on.

What information do we need to provide before a penalty exposure review?

Prepare the following inputs before any scoping conversation:

An asset and data inventory showing where personal data and ePHI are stored, processed and transferred.
A list of processors and business associates, with their contracts and security commitments.
Incident records and breach response logs for the past several years, including decisions about notification.
Financial figures for total worldwide annual turnover of the preceding financial year, which the GDPR fine ceiling uses.
Current policies, risk assessments and evidence of control operation.

The more complete these inputs are, the more accurately scope and cost can be quoted.

Could the HIPAA Security Rule revision or GDPR amendments change our exposure?

Possibly, but neither has changed the current rules as of October 2026. HHS proposed a major Security Rule revision on January 6, 2025 (90 FR 898), with comments due March 7, 2025. No final rule has been published, and the latest Unified Agenda lists final action projected for July 2027. The GDPR text has not been amended as of October 2026. The Omnibus IV proposal (procedure 2025/0130(COD)) has a text agreed in negotiations on 26 June 2026 awaiting Parliament's first-reading vote, and the Digital Omnibus proposal (procedure 2025/0360(COD)) awaits committee decision. Regulation (EU) 2025/2518 applies from 2 April 2027 to cross-border enforcement procedures. Track each item in the official sources and plan controls against the rules in force today.

How DeployOpen helps you evaluate and implement penalty-driven controls

DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, so the controls behind GDPR and HIPAA exposure can be tested and evidenced in your environment. We prepare systems, controls and evidence for compliance assessments, but we do not issue audit reports, attestations or certifications. Independent auditors, regulators and certification bodies make those determinations.

How we scope

Written scope names which processing activities, systems and ePHI or personal data flows fall under each regime.
Scope records which controller, processor or business associate roles your organization holds under each law.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We implement and harden the security controls that support Article 32 and the HIPAA Security Rule safeguards in scope.
Addressable HIPAA specifications get documented reasoning and any equivalent alternative measures recorded.
Security testing covers applications, APIs and infrastructure so exposure is tested before regulators ask about it.

How we hand over

Deliverables include system documentation, control records and evidence packs mapped to each regime's requirements.
Runbooks show your team how to operate, back up and upgrade the platforms after handover.
Your legal and compliance leads receive a written record of decisions for tier and fine exposure review.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can keep evidence current as the Security Rule proposal or EU procedural rules change.
Ask us to confirm scope, deliverables and retainer terms in writing before committing budget.

GDPR vs HIPAA penalties