Free tool for security, legal, and risk teams
Breach penalty & cost exposure calculator
Estimate what a breach could cost before one prices it for you: HIPAA civil money penalties by culpability tier, the GDPR fine ceiling for your turnover, and response costs scaled from published per-record research. Runs in your browser, no signup, nothing stored.
The entity knew or should have known, but not willful neglect.
Everything runs in your browser; nothing is submitted or stored.
Where these numbers come from
HIPAA figures are the HHS civil money penalty tiers as last published, which HHS adjusts annually for inflation; penalties apply per violation and enforcement settles case by case. GDPR ceilings come from Article 83: the greater of a fixed amount or a percentage of annual global turnover, with the applicable tier depending on which provisions were breached. Response costs scale from published per-record breach-cost research; the 2026 cost-of-breach analysis shows the full picture. The state layer is mapped in the state notification guide.
Frequently asked questions
What does the breach penalty calculator estimate?
Three exposure layers: HIPAA civil money penalties under the four culpability tiers (worst-case per-violation reading, capped at the annual maximum), the GDPR administrative fine ceiling for your turnover tier, and response costs scaled from published per-record breach-cost research. It is an exposure estimate for planning, not a fine prediction.
How are HIPAA penalties calculated?
HHS civil money penalties are per violation across four culpability tiers, from unknowing to willful neglect left uncorrected, with an annual maximum per violation type. The calculator applies your selected tier to the record count as a worst-case reading, capped at the annual maximum. Enforcement settles case by case, usually below the ceiling, and HHS adjusts the figures annually for inflation.
What is the GDPR fine for a data breach?
GDPR sets ceilings, not fixed fines: up to the greater of €10M or 2% of global annual turnover for the lower tier, and up to the greater of €20M or 4% for core-principle violations. Which tier applies depends on what rules were broken, not just that a breach happened; many cases close below the ceiling.
Are US state penalties included?
The state layer varies too widely for a single calculator line: state attorneys general can seek civil penalties under each state's statute, and several states add fixed notification deadlines as short as 30 days. The calculator links the state-by-state guide so the state layer is mapped alongside the HIPAA and GDPR estimates.
Is anything I enter stored or shared?
No. The calculation runs entirely in your browser, the numbers never leave your device, there is no account, no log, and nothing retained.