When a fine, and when not: the EDPB writes down the part that was missing

The distinction between the two documents is the one thing to grasp properly. The 2022 guidelines answer the question «how much»: you start from seriousness, you find a starting point, you apply the factors of Article 83(2), you look at turnover. Guidelines 04/2026 answer a question that came earlier and that nobody had ever written down in an orderly way: «do we reach a fine at all, and why not a reprimand, an order or a limitation». Until yesterday that part was practice, which is to say it varied from one authority to the next.

The method runs in five steps, read in sequence: each one can close the matter before the next.

• First: the authority checks that the alleged infringement can lead to a fine at all, finding support either in the GDPR or in national law.
• Second: it checks that the party under investigation can be the addressee. Whether the controller or the processor answers depends on who is bound by the provision breached.
• Third: it assesses whether the infringement was committed intentionally or negligently. Culpability is a condition of the fine, not a discount factor.
• Fourth: it weighs aggravating and mitigating circumstances. If the infringement is minor, as a rule there is no fine and a reprimand is used; if it is not minor, there is a strong presumption that a fine should be imposed.
• Fifth: it checks that the fine is effective, proportionate and dissuasive in the specific case, and whether there is reason to depart from the standard approach.

The third step deserves the same attention, for the opposite reason. Culpability is presented as a condition: without intent or negligence no fine is imposed. That looks like good news for the controller, and in part it is, but it immediately turns into a practical burden. Being without fault is not asserted, it is shown: with the date a risk was spotted, the opinion the DPO gave, the decision taken by the body entitled to take it, the action carried out. An organisation that keeps no trace of these things has no way to tell itself apart from a negligent one, because from the outside the two look very much alike.

The most useful part of the document, for people who do the work, are the fourteen practical examples: cases built to show how an authority chooses between a reprimand, an order, a limitation, a ban, withdrawal of certification and a fine, and when it combines them. That material is worth more than many pages of principle, because it makes the boundary between situations readable.

One last thing, and it has a deadline. The text is open to public consultation until 13 November 2026: anyone can send comments, not only trade associations. For a practice with clients in several Member States it is a concrete opportunity, because the very unevenness between national authorities is the problem these guidelines say they want to close.