Regulatory update
EDPB Adopts Guidelines 04/2026 on When to Impose GDPR Fines
The EDPB adopted draft guidelines on when authorities should fine rather than use other corrective powers under the GDPR. Public consultation runs until 13 November 2026.
What changed?
On 21 September 2026 the European Data Protection Board announced Guidelines 04/2026. They cover how national supervisory authorities should decide whether to impose an administrative fine, and how that choice relates to their other corrective powers under the GDPR. The same announcement covered final guidelines on the interplay between the DSA and the GDPR, which this note does not cover.
What do the guidelines say?
According to the Board’s announcement, authorities should work through five steps:
- Confirm that a fine is possible under the GDPR or national law.
- Identify whether the controller or the processor can be fined.
- Establish whether the infringement was intentional or negligent.
- Weigh aggravating and mitigating factors. Minor infringements will usually lead to a reprimand. More serious ones point towards a fine.
- Check that a fine would be effective, proportionate and dissuasive.
The guidelines also explain the other corrective powers, such as warnings, reprimands, orders, bans and withdrawal of certification. They include 14 practical examples.
Can you comment?
Yes. The Board has opened a public consultation that runs until 13 November 2026. The Board’s announcement does not set out how to respond, so check the consultation page on the EDPB website.
What should you do?
Read the draft as a guide to how authorities may think about culpability and mitigation. Documented controls, prompt remediation and cooperation are the kinds of factor that can matter at step four. This is a draft, so do not treat it as final. See our GDPR guide.
What to watch
- The final text after consultation, and how authorities use it when choosing between a reprimand and a fine.
- Whether your sector's trade body is responding before 13 November 2026.
Sources and official references
- EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines — European Data Protection Board (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
