GDPR fines against a subsidiary must be calculated based on its parent company's worldwide annual revenue. Be that as it may, national Data Protection Authorities must also consider the subsidiary’s "material economic capacity" to assess if the fine is proportionate. Assessments of Data Protection Authorities must include the infringement’s nature, gravity and duration; how many data subjects were affected; and how much damage they suffered.