EDPB issues new guidelines on GDPR fine imposition

The European Data Protection Board (EDPB) has released new guidelines, specifically Guidelines 04/2026, to supplement its existing methodology for calculating GDPR fines. These new rules focus on the decision-making process regarding whether a fine should be imposed in the first place.

The EDPB proposes a five-step assessment process for supervisory authorities: determining if the violation is subject to fines under GDPR or national law, identifying the responsible party, assessing whether the breach was intentional or negligent, evaluating the severity of the violation, and ensuring the fine is effective, proportionate, and serves as a deterrent.

The guidelines clarify that not every GDPR violation necessitates a financial penalty. For minor infractions, authorities are encouraged to consider warnings or other corrective measures instead. However, for non-minor violations, there is a strong presumption in favor of a fine. The EDPB also distinguishes between corrective measures, such as data erasure orders intended to fix a breach, and fines, which are intended to punish and deter.