Written by: Haim Ravia, Dotan Hammer
On September 17, 2026, the European Data Protection Board adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR, and released them for public consultation. The guidelines address the question that precedes fine calculation — whether a fine should be imposed at all, in addition to or instead of the other corrective measures available under the GDPR, which comprise warnings, reprimands, orders, limitations including bans, and withdrawal of certification.
The methodology has five steps. Steps 1 to 3 establish the legal preconditions. In step 1, the supervisory authority checks that the established infringement can lead to a fine at all, since not every GDPR infringement is subject to one and support must be found either in the GDPR or in national law. In step 2, it establishes that the party under investigation can be fined for the infringement in question, liability depending on who is subject to the provision breached — controller or processor. In step 3, it assesses whether the infringement was committed intentionally or negligently, culpability being a condition of any fine.
Steps 4 and 5 govern the decision itself. In Step 4, the authority applies the factors in the GDPR to determine whether the infringement is “minor.” The guidelines work through each factor in turn: the nature, gravity, and duration of the infringement, where longer duration weighs against a finding that the infringement is minor and in favor of a fine; the degree of culpability, where a low degree of negligence has less impact on the decision to impose a fine than a high degree of negligence; mitigation measures taken for affected data subjects, where timeliness and effectiveness matter and measures adopted spontaneously before the controller became aware of the investigation are more likely to count as mitigating than measures adopted afterwards; the degree of responsibility, assessed by reference to whether the controller “did what it could be expected to do” regarding the residual risk persisting after its measures; previous infringements; cooperation with the authority; the categories of data affected; how the infringement came to light; compliance with previously ordered measures; and adherence to approved codes of conduct or certification mechanisms.
The guidelines also address systemic infringements, inviting authorities to consider the ratio between the number of data subjects affected and the total population in the relevant context, and to treat the level of damage—physical, material, or non-material—as a parameter separate from the number of individuals involved.
Step 5 then asks whether imposing a fine would be effective, proportionate and dissuasive. The guidelines split it in two. Under step 5(a), where the infringement is minor, as a general rule no fine will be imposed and a reprimand may issue instead — although the EDPB does not exclude that an authority may still exercise its discretion to fine, and notes that in some cases of minor infringement it may not be appropriate, necessary or proportionate to exercise any corrective power at all. The guidelines cite a decision of the Court of Justice of the European Union for the proposition that an authority must act where a corrective power is appropriate, necessary and proportionate, but retains discretion as to which measure to adopt. An example is where the controller, as soon as it became aware, took appropriate measures to bring the infringement to an end and prevent recurrence.
Under Step 5(b), where the infringement is not minor, as a general rule a fine will be imposed, but the authority retains discretion to take other measures in addition or instead: the guidelines give the example of a reprimand where a fine would impose a disproportionate burden on a natural or legal person, and note that in Member States whose national law does not permit fining public authorities, a reprimand may issue even for an infringement that is not minor.
Click here to read EDPB Guidelines 04/2026 on the application of the power to impose administrative fines.
