The European Data Protection Board (EDPB) has taken a further step towards a more consistent approach to GDPR enforcement across the European Union. On 17 September 2026, the EDPB adopted new Guidelines 04/2026 addressing how national data protection authorities should exercise their power to impose administrative fines and how fines interact with other corrective measures available under the GDPR. The Guidelines are currently subject to public consultation until 13 November 2026.

The new Guidelines complement the EDPB’s existing Guidelines 04/2022 on the calculation of administrative fines, which provide a harmonised methodology for determining the amount of a fine. The latest initiative addresses a different question: whether an administrative fine should be imposed in the first place and, where appropriate, whether it should be used on its own or in combination with other corrective measures, such as warnings, reprimands, orders or restrictions on processing.

According to the EDPB, supervisory authorities should follow a five-step methodology. This includes determining whether the infringement can attract a fine and whether the relevant controller or processor can be held liable, assessing whether the infringement was committed intentionally or negligently, considering aggravating and mitigating circumstances, and finally determining whether a fine would be effective, proportionate and dissuasive. The EDPB further states that minor infringements will generally not result in a fine, whereas for non-minor infringements there is a strong presumption in favour of imposing one. The Guidelines contain 14 practical examples illustrating the application of this methodology.

The initiative responds to a longstanding issue in European data protection enforcement: although the GDPR establishes a common framework for administrative fines, enforcement practices have continued to differ between national supervisory authorities. Thus, the new guidance is intended to contribute to greater consistency in determining when fines are appropriate across EU Member States.

The Guidelines do not eliminate the discretion of national supervisory authorities. Rather, they establish a common analytical framework within which that discretion is to be exercised. The EDPB expressly recognises that authorities may depart from the standard approach where the circumstances of an individual case justify doing so. The practical impact of the Guidelines will therefore depend on their application by national authorities once the consultation process has been completed.