EDPB Issues New Guidance on GDPR Administrative Fines and the DSA
The European Data Protection Board (EDPB) has adopted new guidelines on how Data Protection Authorities (DPAs) should use administrative fines alongside other corrective powers under the General Data Protection Regulation (GDPR). The Board also finalized its guidance on how the Digital Services Act (DSA) interacts with the GDPR.
The administrative fines guidelines aim to make enforcement more consistent across Europe. They explain when a fine may be imposed, which organization may be held responsible, and how DPAs should assess the seriousness of an infringement. The guidance also clarifies when a fine should be imposed alone and when it may be combined with other corrective measures.
The guidelines set out a five-step process for DPAs. First, the authority must establish that the infringement is subject to a fine under the GDPR or applicable national law. Second, it must determine whether the controller or processor is responsible for the breached obligation. Third, the DPA must assess whether the infringement was committed intentionally or negligently, as culpability is required before a fine can be imposed.
The fourth step involves reviewing aggravating and mitigating factors. Where an infringement is minor, a reprimand may be more appropriate than a fine. For more serious infringements, the guidelines establish a strong presumption that a fine should be imposed. Finally, the DPA must determine whether the fine would be effective, proportionate, and dissuasive in the circumstances of the case.
The guidance also explains how administrative fines relate to other corrective powers available to national DPAs. These powers include warnings, reprimands, compliance orders, restrictions on processing, bans on processing, and the withdrawal of certification. The EDPB has included 14 practical examples to help authorities assess different situations and select the appropriate response.
The new guidelines are open for public consultation until November 13, 2026. Stakeholders can submit comments and provide feedback during this period. The guidance will replace the former Article 29 Working Party guidelines on administrative fines and complement the EDPB’s existing guidance on calculating the amount of a fine.
The EDPB also adopted the final version of its guidelines on the relationship between the DSA and the GDPR. These guidelines are intended to support the consistent application of both laws, particularly where the DSA regulates the processing of personal data by intermediary service providers or uses concepts and definitions established under the GDPR.
