Side by Side: How High Can a Privacy Fine Go?

Coupang has filed two suits in the Seoul Administrative Court to cancel W624.7b in penalties that Korea’s Personal Information Protection Commission set in June, over a leak whose victims include 33.22 million members. The question for the customs desk: how high may each country’s data protection law fine a company, as a share of what it earns, under the law in force today?

European Union

Article 83 of the GDPR allows fines of up to 20 000 000 EUR or “up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.” Security and breach-notification duties sit in a lower tier, at 2 %. Losing the data is the cheaper offence; arguing with the regulator’s order about it costs double.

United Kingdom

Under the UK GDPR the ceiling is “the higher of either £17.5 million or 4% of the undertaking’s total worldwide annual turnover.” Britain left the Union and kept the percentage. Only the currency needed converting.

China

Where “the circumstances are serious,” Article 66 of the PIPL allows “a fine of not more than RMB 50 million or not more than 5% of its turnover of the previous year,” and the managers directly responsible can be fined up to RMB 1 million each. Beijing outbids Brussels by one point, and is the only capital here that also keeps a chair for the manager.

South Korea

Since 11 September 2026 the amended law allows a surcharge of up to 10% of total revenue, excluding revenue unrelated to the violation, for repeated intentional or grossly negligent breaches, failure to obey a corrective order, or a leak affecting more than 10 million people. A third repeat raises the surcharge by 80%; proven investment in protection can cut the base by up to 40%. Seoul has written the loyalty scheme and the discount into the same statute.

Australia

For serious or repeated interference with privacy, a company faces the greater of A$50 million, three times the benefit obtained or, where that cannot be worked out, “30% of the corporation’s ‘adjusted turnover’” over the breach period, in force since 13 December 2022. Canberra’s ceiling is three times Seoul’s new one. It is also the only formula here that stops to ask what the company made from the mistake.

India

The DPDP Act sets penalties of up to Rs 250 crore for failing to keep security safeguards that prevent breaches, with no percentage of turnover at all. A flat ceiling is the same for a start-up and the largest platform in the country. It is the one cap on the list that shrinks every time a company grows.

Verdict

New Delhi sets a number, Brussels and London 4 per cent, Beijing 5, Seoul 10 for its worst cases and Canberra 30. Each government calls its ceiling a deterrent, and each sits at a different height for the same leak. The likeliest maximum in practice is whatever survives the appeal. Coupang is in court over a penalty set in June, three months before Seoul’s 10 per cent ceiling for the largest leaks took effect. It is appealing the old price.