What Changed
- The EDPB established a standard five-step methodology for DPAs when deciding whether to impose administrative fines under the GDPR.
- The EDPB finalised guidelines addressing the interplay between the Digital Services Act (DSA) and the GDPR for intermediary service providers.
- The new fining methodology guidelines replace WP29 guidelines and are subject to public consultation until 13 November 2026.
During its plenary meeting in Brussels, the European Data Protection Board (EDPB) adopted new guidelines designed to align how Data Protection Authorities (DPAs) across the European Union exercise their corrective powers, specifically regarding administrative fines under the General Data Protection Regulation (GDPR). Alongside this, the EDPB finalised its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR.
The newly adopted guidelines on administrative fines set out a five-step methodology for DPAs:
1. Legal Basis: The DPA verifies whether the infringement can lead to a fine directly under the GDPR or national law.
2. Liability: The DPA identifies whether the controller or processor is liable based on who is bound by the breached provision.
3. Culpability: The DPA assesses whether the breach was committed intentionally or negligently, as culpability is required to impose a fine.
4. Aggravating and Mitigating Factors: For minor breaches, a reprimand may be issued instead; for non-minor breaches, there is a strong presumption that a fine should be imposed.
5. Effectiveness, Proportionality, and Dissuasiveness: The DPA determines whether the fine meets these standards and if any deviation from standard practice is justified.
These guidelines replace the previous Working Party 29 (WP29) guidelines on setting administrative fines under Regulation 2016/679 and complement guidelines regarding fine calculations. They also provide overview and practical examples of corrective measures, including warnings, reprimands, orders, limitations, bans, and withdrawal of certification. Stakeholders can comment on these guidelines during a public consultation ending on 13 November 2026.
Additionally, the EDPB finalised guidelines on the interplay between the DSA and GDPR following public consultation. These support consistent enforcement where DSA rules affect personal data processing by intermediary service providers and reference GDPR concepts.
The update highlights ongoing DPA enforcement actions, such as the Irish Data Protection Commission fining Google 403 000 000 EUR, the Spanish DPA fining Securitas Direct 100 000 EUR, and the French CNIL fining EXTIA 300 000 EUR.
Who May Be Affected
Data controllers, data processors, intermediary service providers, legal counsel, and compliance officers operating within or offering services in the European Union.
Cross-Border Context
Applies across all EU Member States and directly impacts foreign or multinational companies, including Swiss, Chinese, and global entities, that process personal data of individuals in the EU or provide intermediary services subject to the DSA.
What to check next
- Monitor the EDPB public consultation process regarding the fining guidelines prior to the 13 November 2026 deadline.
- Review the finalized EDPB guidelines on the DSA-GDPR interplay for operational impact on intermediary service providers.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.
Prepared automatically with AI assistance from the official sources linked on this page. Translations and explanations do not replace the official text.