TL;DR
At the plenary announced on 21 September 2026 the EDPB adopted Guidelines 04/2026 on how authorities decide whether to impose an administrative fine, alone or together with the other corrective powers of Article 58(2). Five steps: legal basis for the fine, liable party, intent or negligence, aggravating and mitigating factors, effectiveness and proportionality. Minor infringement: as a rule no fine, possibly a reprimand. Non-minor infringement: strong presumption of a fine. Fourteen practical examples. They replace the 2017 Article 29 Working Party guidelines and complement Guidelines 04/2022 on calculating the amount. Consultation open until 13 November 2026. The same plenary adopted the final version of Guidelines 3/2025 on the interplay between the DSA and the GDPR.
What changes
Guidelines 04/2022 explain how the amount of a fine is calculated. The step before was missing: when an authority must fine and when it may settle for another measure. The new guidelines fill that gap and replace the old Article 29 Working Party document. They also describe each corrective power — warnings, reprimands, orders, limitations and bans, withdrawal of certification — with its purpose and how it combines with a fine.
The five steps
- LEGAL BASIS. The authority checks that the infringement can lead to a fine, under the GDPR or national law.
- WHO IS LIABLE. Controller or processor, depending on who is bound by the provision breached: security under Article 32, for example, binds both.
- INTENT OR NEGLIGENCE. No fault, no fine. This is the line already drawn by the Court of Justice in Deutsche Wohnen (C-807/21, 5 December 2023).
- AGGRAVATING AND MITIGATING FACTORS. If the infringement is minor, as a rule no fine and at most a reprimand; if it is not minor, there is a strong presumption that a fine should be imposed.
- EFFECTIVE, PROPORTIONATE, DISSUASIVE. The final check, with room to depart from the standard approach where the case justifies it.
The presumption that matters
The sharpest point is step four. Outside minor infringements, a fine is no longer an option that needs justifying but the rule, departed from only for good reasons. For anyone counting on a first «courtesy» reprimand, the room is shrinking.
Why it matters for small organisations too
The guidelines are meant to align European authorities: the same infringement should get the same response in Rome, Lisbon or Stockholm. For an organisation, this means that what weighs in step four — cooperation, measures already taken, existing documentation, prompt remedies — becomes even more predictable. And that is exactly what is built beforehand, not during an investigation.
What it means for the DPO
Four moves
One: fault is a condition, judged on what the organisation knew and had done. The record of processing, DPIAs, risk analyses and dated procedures are the evidence that negligence is absent or slight. Two: keep a trail of corrective actions with dates and owners, because they count as mitigating factors. Three: a reprimand is not «nothing»: it is a decision that stays on file and weighs as a precedent. Four: anyone wishing to comment has until 13 November 2026. In DPO Workspace, the record diagnosis and the activity history already keep dates, decisions and reasons together.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
