Summary
- The EDPB has adopted a five-step methodology for deciding when an administrative fine should accompany other GDPR corrective powers.
- The process examines legal basis, liability, intent or negligence, aggravating and mitigating factors, and whether a fine would be effective, proportionate, and dissuasive.
- The draft fining guidance is open to consultation until 13 November, while separate DSA-GDPR interaction guidelines have reached final form.
The European Data Protection Board has adopted a common methodology intended to make decisions about GDPR fines more consistent across national data protection authorities.
The new guidance addresses when an administrative fine should be imposed either by itself or alongside another corrective measure. It complements earlier EDPB guidance dealing with how the amount of a fine should be calculated once an authority has decided that a financial sanction is appropriate.
National data protection authorities are expected to follow a five-step process. The first stage determines whether the infringement can legally lead to a fine under the GDPR or national law.
The authority then considers whether the controller or processor under investigation can be held liable for the infringement, based on which party is bound by the provision that was breached.
The third stage assesses whether the infringement was committed intentionally or negligently. Authorities then consider aggravating and mitigating factors before deciding whether a fine would be effective, proportionate, and dissuasive in the specific case.
The EDPB says minor infringements will generally not result in a fine and may instead attract a reprimand. Where an infringement is not minor, the methodology creates a strong presumption that a financial penalty should be imposed unless the circumstances justify a different approach.
Fines remain only one part of regulators’ powers. The guidance also covers warnings, reprimands, orders, processing limitations or bans, and withdrawal of certification. Fourteen practical examples have been included to illustrate how authorities can choose among those measures.
The draft guidelines are open for public consultation until 13 November 2026. They replace earlier Article 29 Working Party guidance on the application and setting of administrative fines and are intended to narrow differences in enforcement approach across national authorities.
The methodology is relevant to cybersecurity incidents because a personal-data breach does not automatically produce a particular sanction. Regulators assess which GDPR duties were breached, whether the controller or processor is liable, how culpable the conduct was, and which corrective measure is appropriate.
A serious cyber incident can therefore create several regulatory questions at once. An authority may examine whether appropriate technical and organisational measures were in place, whether notification requirements were met, whether processing should be limited, and whether a financial penalty is justified.
A more consistent method for deciding when fines are appropriate should reduce some variation in the way those facts translate into enforcement across EU member states, although the circumstances of each case and national procedure will continue to shape the outcome.
The EDPB has separately adopted the final version of guidelines covering the interaction between the Digital Services Act and GDPR. Those guidelines address situations in which DSA duties involve processing personal data or rely on concepts already established in data-protection law.
That intersection reflects a wider regulatory environment in which the same service or incident can engage several European regimes. Cybersecurity, privacy, digital services, operational resilience, and AI governance increasingly overlap rather than operating as isolated compliance programmes.
The new methodology does not change the maximum GDPR fines available to regulators. Its purpose is procedural: giving national authorities a more consistent sequence for deciding when financial sanctions should sit alongside the other corrective powers already available to them.
