The European Data Protection Board (EDPB) has adopted guidelines on the application of administrative fines and other corrective powers under the GDPR. The guidelines are intended to provide greater clarity and more consistent enforcement by European supervisory authorities.
The proposed method consists of five steps. A supervisory authority first assesses whether the infringement can result in a fine under the GDPR or national legislation and who is liable for the infringement. The supervisory authority then assesses whether the infringement was intentional or the result of negligence, which aggravating or mitigating circumstances apply, and whether a fine would be effective, proportionate and dissuasive. In the case of a minor infringement, a fine is generally not imposed and a reprimand may follow. In the case of a non-minor infringement, the guidelines state that there is a strong presumption that a fine should be imposed.
The guidelines also provide an overview of the corrective powers of national supervisory authorities. These include warnings, reprimands, orders, restrictions, including bans, and the withdrawal of certification. Fourteen practical examples show how supervisory authorities can assess the circumstances of a case and determine which measure is appropriate.
The guidelines on fines are open for public consultation until 13 November 2026. The EDPB has also adopted the final version of the guidelines on the interplay between the Digital Services Act (DSA) and the GDPR. These are intended to support consistent application when DSA provisions concern the processing of personal data by providers of intermediary services and refer to concepts from the GDPR.
