EDPB Draft Guidelines on GDPR Fines: When Will You Be Fined Instead of Reprimanded?

EDPB Draft Guidelines on GDPR Fines: When Will You Be Fined Instead of Reprimanded?

Short answer: on 17 September 2026 the European Data Protection Board (EDPB) adopted draft Guidelines 04/2026, which set out a five-step test that data protection authorities should follow when deciding whether GDPR fines apply, that is, whether an infringement leads to an administrative fine or to a softer measure such as a reprimand. Under the draft, a minor infringement will generally not be fined, but an infringement that is not minor creates a strong presumption that a fine will follow. The public consultation closes on 13 November 2026.

Want to know how your organisation would fare under the EDPB’s new fining test? Consuflix provides Data Protection Officer as a Service support, including a review of your GDPR accountability records, breach procedures and data subject request handling before a regulator asks to see them. Contact info@consuflix.com.

What the EDPB adopted on GDPR fines, and when

The EDPB adopted Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR on 17 September 2026 and announced them at its plenary on 21 September 2026. They are a draft: the feedback period runs from 21 September to 13 November 2026 (23:59 CET).

The text replaces earlier guidance from the Article 29 Working Party (WP29) and complements the EDPB’s Guidelines 04/2022 on calculating the amount of a fine. In short, the 2022 guidelines answer “how much?”, while the new draft answers “whether at all?”.

The five-step test for whether a GDPR fine will be imposed

The EDPB describes a step-by-step approach for supervisory authorities. Steps one to three cover the legal preconditions, and steps four and five cover the decision itself.

  1. Can the infringement lead to a fine? The authority first establishes that an infringement of a provision listed in Article 83(4) to (6) GDPR has occurred.
  2. Can this party be fined? The authority identifies who is the addressee of the obligation, for example a controller or a processor.
  3. Was it intentional or negligent? A fine requires intent or negligence. Negligence needs awareness that the conduct could infringe, not a will to break the law.
  4. Is the infringement minor? Using the aggravating and mitigating factors in Article 83(2) GDPR, the authority assesses seriousness. If the infringement is minor, as a general rule no fine is imposed and a reprimand may be issued instead. If it is not minor, there is a strong presumption in favour of a fine.
  5. Would a fine be effective, proportionate and dissuasive? Under Article 83(1) GDPR, the authority checks whether there is a reason to depart from the general approach in step four.

The EDPB also stresses that fines remain at the discretion of each supervisory authority, and that the guidelines are addressed to authorities rather than creating new obligations for businesses.

Why the negligence examples matter to businesses

The draft includes practical examples on step three that are worth reading closely, because they close off common defences:

  • Not knowing the rule is not enough. In the EDPB’s example, a one-person company that ignored access requests could not rely on being unaware of Article 15 GDPR to avoid a finding of negligence.
  • Internal legal advice does not automatically protect you. Where an internal assessment contradicted the supervisory authority’s known position, the EDPB’s example treats the company as negligent.
  • External advice must not be trusted blindly. Without documentation showing that advisers had the full facts and knew of conflicting views, reliance on outside advice may carry no exculpatory weight.

The common thread is documentation and awareness. An organisation that can show it understood the rules and made a reasoned, recorded decision is in a better position than one that cannot.

What organisations should do now to prepare for GDPR fines

  1. Check your Article 5(2) accountability evidence. Records of processing, DPIAs, policies, training logs and decisions should exist and be current.
  2. Test your core processes. Data subject requests, breach notification, vendor management and transparency notices are where authorities repeatedly find infringements.
  3. Document the reasoning behind legal positions. If you rely on internal or external advice, keep the facts you gave and the sources considered, and check them against current supervisory authority guidance.
  4. Decide whether to respond to the consultation. Trade bodies and organisations can submit comments to the EDPB until 13 November 2026.
  5. Assign clear ownership. A designated, independent DPO or privacy lead makes it easier to evidence awareness and timely action. If you are starting from scratch, see our guide to GDPR compliance for SMEs.

Limits and uncertainty

These are draft guidelines and may change after the consultation. They are not binding law, national procedural rules still apply, and each authority keeps its discretion. Nothing in this article is legal advice about a specific situation.

Conclusion

The EDPB’s draft moves the debate from the size of GDPR fines to their likelihood. For most organisations the practical message is that infringements which cannot be called minor will probably attract a fine, and that ignorance or untested advice will not shield you. The most reliable protection is a documented, working privacy programme.

Prepare for stricter GDPR enforcement with the right support. Consuflix’s Data Protection Officer as a Service can help you assess your current GDPR exposure, close accountability gaps and put a responsible, documented process in place. Email info@consuflix.com to discuss your situation.

Sources

What are the EDPB Guidelines 04/2026 on GDPR fines?
They are draft guidelines adopted by the European Data Protection Board on 17 September 2026. They set out a five-step test that supervisory authorities should use to decide whether a GDPR infringement leads to an administrative fine or to another corrective measure such as a reprimand.
When does the consultation on the EDPB fining guidelines close?
The public consultation on Guidelines 04/2026 runs from 21 September to 13 November 2026 (23:59 CET). The guidelines may change after feedback is reviewed.
Will a minor GDPR infringement be fined?
Under the draft, a minor infringement will generally not be fined and a reprimand may be issued instead. If the infringement is not minor, there is a strong presumption that a fine will be imposed. Each authority keeps its discretion.
Can I avoid a GDPR fine by relying on legal advice?
Not automatically. The EDPB’s examples indicate that internal advice contradicting a regulator’s known position, or external advice that is trusted blindly without documentation, may not remove a finding of negligence.