Privacy & Cybersecurity Law Blog

On September 17, 2026, the European Data Protection Board (“EDPB”) adopted Guidelines 04/2026 on the application of administrative fines in relation to other corrective powers under the EU General Data Protection Regulation (“GDPR”) for public consultation (the “Guidelines”). The Guidelines are intended to harmonize how EU supervisory authorities determine whether an administrative fine should be imposed in addition to, or instead of, other corrective measures listed at Article 58(2) of the GDPR.

The Five-Step Approach

The Guidelines introduce a five-step methodology for supervisory authorities to use when determining whether to impose a fine, which includes assessing or considering the following:  

• Step 1: whether the infringement is one for which a fine may be imposed, either pursuant to the GDPR or applicable national law.
• Step 2: whether the party under investigation can be fined, particularly whether they can be liable.
• Step 3: whether the infringement was committed intentionally or negligently.
• Step 4: whether the factors in Article 83(2) of the GDPR suggest that the infringement is minor.
• Step 5: whether imposing a fine would be effective, proportionate and dissuasive in the specific case.

According to the EDPB, the first three steps address the legal preconditions for imposing a fine, while the final two steps focus on whether a fine should in fact be imposed in light of the other corrective powers available under the GDPR.

Guidance on Step 4 is particularly relevant in practice because it addresses when an infringement may be treated as minor. The general rule is that an administrative fine should not be imposed and a reprimand may be issued instead, although supervisory authorities retain discretion to impose a fine where appropriate in light of the circumstances of the individual case. Conversely, if the infringement is not considered minor, there is a strong presumption that an administrative fine should be imposed.

In assessing whether an infringement is minor, supervisory authorities must consider its nature, gravity and duration. The Guidelines indicate that this assessment should be highly context-specific, and take into consideration the interest protected by the infringed rule, the scope and purpose of the processing, the number of affected data subjects and the level of damage. In particular, steps taken to mitigate the impact on affected individuals may be relevant in determining whether the infringement is considered minor and whether a fine is warranted. In that regard, the EDPB places particular weight on the timeliness and effectiveness of the measures taken; measures implemented spontaneously before the organization becomes aware of an investigation are more likely to be considered mitigating than measures taken later.

The Guidelines also indicate that measures reflecting ordinary GDPR compliance obligations will not easily be treated as mitigating, and may be given weight only in exceptional circumstances where the organization has gone beyond what the GDPR normally requires. In this regard, the EDPB notes that, because cooperation with a supervisory authority is already required under the GDPR, only cooperation that goes beyond that obligation and materially limits harm may be treated as mitigating. 

Relationship with Other Corrective Powers

The Guidelines clarify how fines relate to the other corrective powers available under the GDPR. According to the EDPB, a warning is preventive in nature and applies where processing operations are likely to infringe the GDPR but no infringement has yet occurred, so a fine cannot be imposed for the same conduct in that situation. By contrast, as a rule, a fine may be imposed in addition to a limitation or ban on processing where an infringement has been established. However, where the limitation or ban relates to future processing for which an infringement has not yet been established, a fine cannot be imposed for that same conduct.

The Guidelines will be subject to public consultation until November 13, 2026.

Read the Guidelines.