TL;DR
On 21 September 2026 the EDPB adopted Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers. Five steps: the first three are the legal preconditions for a fine to be possible, the last two the choice between a fine and another measure. If the infringement is minor, generally no fine and a reprimand instead; if it is not minor, a strong presumption that a fine should be imposed. They replace the 2017 Article 29 Working Party guidance and complement Guidelines 04/2022 on calculating the amount. Fourteen practical examples. Public consultation until 13 November 2026.
The question that was missing
Since 2022 there has been a European methodology for calculating the amount of a fine. What remained uncovered was the question that comes first: should a fine be imposed, or is a reprimand, a warning, an order enough? Article 58 gives authorities a range of corrective powers and Article 83 says a fine may be added to or replace the other measures, but it did not say on what condition. That is the space these guidelines occupy.
The path has five steps. The first three check that a fine is legally possible: that the infringement can lead to one, under the Regulation or national law; that the party under investigation may be its addressee; that the infringement was committed intentionally or negligently. The last two concern the choice: aggravating and mitigating circumstances, and finally whether a fine would be effective, proportionate and dissuasive in the specific case.
- STEP 2, the underrated one: whether the party may be fined depends on WHO IS BOUND by the provision breached. A processor does not answer for an obligation the Regulation places on the controller alone, and vice versa. That check comes before any discussion of the amount.
- STEP 3: culpability is a CONDITION of the fine, not a factor that raises it. Without intent or negligence, the conversation about the amount never opens.
- STEP 4: this is where the minor / non-minor distinction enters, and with it the presumption.
- STEP 5: the assessment of effectiveness, proportionality and dissuasiveness may justify departing from the standard approach, but it must be reasoned.
“Minor” does not mean “small”
The classification happens at step 4, together with aggravating and mitigating circumstances, not by counting the data subjects involved. An infringement affecting a single person may be non-minor — because of the nature of the data, the harm, the conduct afterwards. And the opposite direction is the one that changes defensive habits: outside minor cases the presumption is no longer that the matter is open to argument, it is that a fine follows. Building a client's defence on “nothing serious happened” now means proving the infringement is minor, not merely asserting it.
There is something to do by 13 November
The text is open for public consultation until 13 November 2026. This is not a formality: the guidelines contain fourteen practical examples of how an authority should choose the measure, and the examples are the part that later gets cited in proceedings. Anyone who does this work has material to comment on — especially on the cases where a compliance order achieves the result and a fine does not.
In the meantime little changes in daily practice and a lot in how submissions are written. The record of processing, the documentation of decisions and the traceability of who decided what remain what moves steps 3 and 4: culpability and mitigation are proved with the papers that existed before, not with those written afterwards.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
