The factors visible in cases resulting in significant fines, and how they differ from cases that close without penalty. Drawn from the published enforcement record.
GDPR Article 83 lists the factors authorities consider when determining whether to impose a fine and at what level: the nature, gravity, and duration of the infringement; whether it was intentional or negligent; the degree of cooperation; and how the authority became aware of it. In practice, these criteria interact with institutional capacity and caseload dynamics.
Cases resulting in significant penalties tend to involve systematic rather than isolated failures, a large number of affected people, high public salience, or limited engagement from the company during the proceeding.
Timing appears consistently in the enforcement record. Cases where a problem was identified and addressed before a complaint was filed have a different trajectory than those where the response came under regulatory pressure.
Cooperation is one of the Article 83 criteria, and it is reflected in published outcomes. This is not specific to data protection — it is a feature of how discretionary administrative processes work. Case handlers weigh what they are given and when they receive it.