On 17 September 2026, the European Data Protection Board (EDPB) adopted Guidelines 04/2026. They describe how supervisory authorities decide whether to impose a fine for an infringement of the GDPR or to choose another measure, such as a reprimand or an order. The guidelines are open for public consultation until 13 November 2026. They affect all controllers and processors, from large groups to small associations.
What it is about
Article 58(2) of the GDPR grants supervisory authorities a whole range of corrective powers: warnings, reprimands, orders, limitations up to a ban on processing, the withdrawal of a certification and, indeed, the administrative fine under Article 83. Since 2022, Guidelines 04/2022 on calculation have governed how high a fine is. What remained unclear until now was the criteria by which authorities decide to impose a fine at all. On this, there were only older guidelines from the Article 29 Working Party dating from before the GDPR entered into force.
The new guidelines replace these old provisions and supplement the calculation guidelines. The EDPB draws on the authorities’ experience since 2018 and on several judgments of the Court of Justice of the European Union. The aim is for similar cases to be treated alike in all Member States.
The five-step method
The EDPB describes a process that the authority works through step by step:
- Can the identified infringement be sanctioned with a fine at all, under the GDPR or under national law?
- Can the company under investigation be held liable for this infringement, for example as controller or processor?
- Was the infringement intentional or negligent?
- Do the circumstances under Article 83(2) GDPR indicate a minor infringement?
- Would a fine be effective, proportionate and dissuasive in the specific case?
The first three steps examine the legal prerequisites. Steps four and five determine whether a fine is actually imposed or whether another measure is more appropriate.
Negligence is quickly established
The third step is particularly important in practice. A fine requires culpability. In the EDPB’s view, however, the threshold for negligence is very low. What matters is not whether a company actually recognised its infringement, but whether it could have recognised it. Companies are expected to inform themselves about the obligations that apply to them.
Nor does a legal opinion automatically offer protection. In one of the examples in the guidelines, a company relies on an external opinion that departs from the prevailing view. The EDPB does not regard this as exculpatory, because the company was aware of the opposing view. The same applies to an internal assessment that contradicts the known position of the supervisory authority.
Minor or not: the decisive turning point
In the fourth step, a clear basic rule applies. If an infringement is minor, as a rule no fine is imposed; at most a reprimand is issued. If it is not minor, there is a strong presumption in favour of a fine. In both cases, the authority retains discretion. According to the guidelines, for minor infringements it may even refrain from any measures if the company has ended the error itself and taken precautions against recurrence.
When classifying, authorities consider, among other things, the nature, gravity and duration of the infringement, the number of data subjects, the type of data and the damage caused. Several points are revealing for companies:
- Measures to mitigate damage count above all when they are taken early and on the company’s own initiative, before an investigation is known.
- Mere compliance with GDPR obligations is not considered mitigating. This applies to technical and organisational measures as well as to the legally required cooperation with the authority. Only what clearly goes beyond this has a mitigating effect.
- The absence of previous infringements is not in itself exculpatory, because compliance with the GDPR is the norm.
- Repeated similar errors can turn a minor infringement into one warranting a fine.
The guidelines contain 14 fictitious case examples. Several concern small and medium-sized enterprises, such as an unanswered access request that had ended up in the spam folder, or a tracking pixel that transmitted data unnoticed. In both cases, the outcome was a reprimand. In another example, a delayed response to an access request led to fine proceedings because similar cases accumulated.
What remains open
This is the first version for consultation. Comments can be submitted via the EDPB website until 13 November 2026. The Board will then revise the text. The guidelines are addressed to the supervisory authorities and do not directly bind courts. However, they show how the authorities will examine and justify cases in future.
You can find the full text on the EDPB page on Guidelines 04/2026.
What this means for you
The guidelines reward companies that detect errors quickly, remedy them themselves and can prove it. Those who only react when the authority makes enquiries lose this advantage. Sensible next steps:
- Check whether access and erasure requests reliably reach you and are processed on time, even if they arrive via unusual channels.
- Record when you noticed an error and which measures you took. The date and content of the remedy are decisive in an emergency.
- Analyse recurring errors. A single slip is assessed differently from a pattern.
- Review privacy notices and embedded third-party services regularly, not only when they are introduced.
- For contentious processing, do not rely solely on a favourable legal opinion if the supervisory authority clearly takes a different view.
Sightadel supports you with guided assessments, action plans and an evidence archive in which measures are documented with dates. Find out more on the GDPR page. You can try the platform free of charge for 14 days.
As of: 12 October 2026 · Not legal advice. The standard or law in its current version is authoritative.
