CJEU: Rules on the term "undertaking" for GDPR fines

The Court of Justice of the European Union (CJEU) has made an important decision about how fines for breaking data protection rules should be calculated. This decision will have a big impact on companies, especially large corporate groups.

Key points: The CJEU has ruled that "undertaking" in GDPR should be interpreted as in competition law. Fines for GDPR violations must be based on total global turnover of corporate groups. This decision stemmed from a case involving ILVA A/S, a Danish furniture company

Why this matters: This ruling significantly impacts how GDPR fines are calculated, potentially leading to much larger penalties for corporate groups. It prevents companies from avoiding substantial fines by operating through smaller subsidiaries.

What might happen next: Data protection authorities may revise their fine calculation methods. Increased scrutiny of corporate group structures in GDPR enforcement. Similar approach likely to be applied in other EU regulations. 

ADDITIONAL INFORMATION:

See: CJEU judgement EC 2025: 84