Guidelines 04/2026 on Administrative Fines

Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR

The Guidelines set out a five-step methodology for supervisory authorities deciding whether and how to impose administrative fines under Article 83 GDPR, alongside the corrective powers available under Article 58(2) GDPR. Step one confirms the conduct is capable of being fined under the GDPR or national law. Step two determines whether the addressee acted as controller or processor, since liability attaches differently to each. Step three assesses whether the infringement was intentional or negligent. Step four weighs the aggravating and mitigating factors in Article 83(2) GDPR, such as the nature, gravity and duration of the infringement, mitigation actions taken, and the degree of responsibility given the technical and organisational measures in place. Step five verifies the fine meets the Article 83(1) requirement to be effective, proportionate and dissuasive. Alongside fines, the Guidelines catalogue non-monetary corrective powers under Article 58(2) GDPR, including warnings, reprimands, orders to comply, processing limitations or bans, and certification withdrawal, and include fourteen worked examples. They are intended to replace the earlier Article 29 Working Party fines guidance and sit alongside EDPB Guidelines 04/2022 on calculating fines. Adopted 21 September 2026, they remain open for public consultation until 13 November 2026.