EDPB Guidelines 04/2026: when a GDPR infringement leads to a fine

Published 7 November 2026 · By Floris Lindenaar

The EDPB sets out five steps authorities follow to decide whether a GDPR infringement is fined or reprimanded. Comments are open until 13 November 2026.

On 17 September 2026 the European Data Protection Board (EDPB) adopted Guidelines 04/2026, which tell national data protection authorities how to decide whether a GDPR infringement should be fined, or handled with another corrective measure such as a reprimand or an order. The EDPB published them on 21 September 2026. Comments can be sent until 13 November 2026, 23:59 CET.

The guidelines replace the old WP29 guidelines on administrative fines and sit next to the EDPB's guidelines on calculating the amount of a fine.

The five steps

1. Can the infringement be fined? The authority needs a basis in the GDPR or in national law.
2. Can this party be fined? Whether the controller or the processor is liable depends on who is bound by the provision that was breached.
3. Was it intentional or negligent? A culpable infringement is a condition for a fine.
4. Is it minor? The authority weighs the aggravating and mitigating factors of Article 83(2). A minor infringement generally leads to no fine, and a reprimand may be issued instead. If it is not minor, there is a strong presumption that a fine will be imposed.
5. Would a fine be effective, proportionate and dissuasive? Here the authority may see a reason to depart from the general approach in a specific case.

The guidelines also explain the other corrective powers (warnings, reprimands, orders, limitations including bans, and withdrawal of certification) and give 14 practical examples.

Also final: DSA and GDPR

At the same plenary the EDPB adopted the final version of Guidelines 3/2025 on how the Digital Services Act and the GDPR interact, for intermediary services that process personal data.

What to do now

Under step 4, the Article 83(2) factors decide whether you are looking at a reprimand or a fine: among them the measures you took to limit the damage, your cooperation with the authority, previous infringements and the categories of data involved. Being able to show this quickly matters.

Dazr Compliance keeps that evidence in one place: your Article 30 record of processing, DPIAs with a log of every change, recurring GDPR controls and a breach register with a 72-hour clock. If you want to comment on the guidelines, use the EDPB's consultation form before 13 November.

Sources

• EDPB: EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines (21 September 2026)
• EDPB: Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR, version 1.0 (adopted 17 September 2026)
• EDPB: public consultation on Guidelines 04/2026, 21 September to 13 November 2026
• EDPB: Guidelines 3/2025 on the interplay between the DSA and the GDPR, final version

For information only, not legal advice. Last updated 7 November 2026.

Topics: GDPR, EDPB, Enforcement, EU

Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål