To Fine or Not to Fine: EDPB Confirms Default Position in GDPR Enforcement Should Be to Fine

1. What Happened 

On 17 September 2026, the European Data Protection Board (“EDPB”) published its draft Guidelines 04/2026 on the imposition of administrative fines (the "Guidelines"), currently out for public consultation until 13 November 2026. In 2022, the EDPB had adopted guidelines on calculating the amount of an administrative fine (the “Calculation Guidelines”). The present Guidelines fill a gap the Calculation Guidelines left open: they provide a structured, five-step methodology for deciding when to impose a fine and explain how fines interact with the full range of corrective powers. By issuing both sets of guidelines, the EDPB aims to increase harmonization in fining posture. 

The stakes are significant. Fines for the most serious infringements - including breaches of core processing principles, conditions for lawful processing, and data subjects' rights - can reach up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Other obligations, such as data protection by design, processor contracts, and DPO appointments, attract up to €10 million or 2% of total worldwide annual turnover, whichever is higher. 

The Guidelines propose a five-step methodology for determining whether a fine should be imposed: 

1. Can the infringement lead to a fine? Most GDPR infringements are punishable by a fine, so this is a low bar. 
2. Can the party under investigation be fined for the infringement? Liability depends on who is subject to the provision that has been breached (controller, processor, or both). 
3. Was the infringement committed with intent or negligence?  
4. Are there mitigating factors (per Art. 83(2) GDPR) that indicate the infringement is minor? If not, according to the EDPB, a fine should be imposed. 
5. Would a fine be effective, proportionate and dissuasive in this specific case? This is a final discretionary check that can override the general presumption in either direction. 

The administrative fine remains the most-used corrective mechanism for GDPR infringements - but it is not the only one. Other corrective actions may include withdrawal of certifications, bans on processing, and reprimands, some of which may have far more impact than a single fine. 

Although since Brexit the EDPB’s guidelines no longer apply directly in the UK or to the UK ICO, the ICO has historically drawn on EDPB practice when shaping its own approach and may do so again here. Organizations operating across both the EU and UK should pay close attention. 

2. Why Is This Significant  

The Guidelines are significant in particular because of the following key points: 

a. Presumption to Fine: the Guidelines state that where an infringement is not considered minor, there is a strong presumption that a fine should be imposed. This applies across the full range of fineable infringements - from breaches of core processing principles and data subject rights (higher tier) to failures relating to data processing agreements, data protection by design, and DPO obligations. The EDPB effectively flips the question: rather than asking "should we impose a fine?", authorities must ask "can we justify not imposing one?" 

b. Low Culpability Bar (“Should Have Known You Were Infringing”): A fine requires either negligence or intent. The EDPB sets the negligence bar deliberately low: the question is not whether the controller actually appreciated that its conduct was unlawful, but whether it was in a position to have done so. Organizations are expected to exercise due diligence by familiarising themselves with the applicable legal landscape before acting. 

The only recognised defence is an "unavoidable error in law", which demands that all possible and reasonable steps were taken to understand the applicable legal landscape before processing personal data. Documented internal assessments, structured risk analyses, and informed external legal advice can support a lack-of-culpability argument. While such measures cannot guarantee that no fine will be imposed, their absence leaves a controller with no realistic basis to argue it was not negligent. 

Organizations are, thus, expected to have a thorough and holistic understanding of the data protection obligations applicable to them and their processing activities. Mere doubts about legality may themselves be treated as acceptance of the risk of infringement. 

c. Responsibility for Employees and (Sub-)Processors: The Guidelines reinforce that the GDPR applies a strict attribution standard. No approval or even knowledge of the infringing conduct by a management body is required for an entity to be fined. Absent narrow exceptions, disregard of internal instructions by an employee or breach of a data processing agreement by a processor does not rule out culpability. 

3. Will the EDPB Guidelines Actually Change GDPR Enforcement in Practice? 

The EDPB has been here before. The Calculation Guidelines issued in 2022 are not followed consistently by EU data protection authorities, and it remains to be seen whether the present Guidelines will gain more traction. Because GDPR enforcement sits at the national level, it remains shaped by national procedural and administrative law, resource constraints, and cultural diversity that may affect a specific authority's willingness to fine. 

That said, if adopted, the Guidelines would not be without teeth. National courts and the CJEU have previously pointed to EDPB guidelines to require EU data protection authorities to justify their decisions. A data protection authority that departs from a clear EDPB presumption without adequate reasoning may find itself vulnerable to legal challenge in competent courts. 

These Guidelines also sit alongside the GDPR Procedural Regulation (EU) 2025/2518, which harmonises cross-border enforcement procedures and will be fully effective in August 2027.

The approach to breach notifications  

Article 33 notification obligations remain unchanged, but the Guidelines sharpen the enforcement stakes attached to the underlying incident - which often prompts a data protection authority to investigate an organization’s broader compliance program. Both the Guidelines and the Calculation Guidelines are clear: fulfilling a statutory notification duty is legally required conduct, not a gesture of good faith. It is neutral in the enforcement calculus, not mitigating. 

What will matter to regulators on both sides of the Channel is: 

1. How quickly was the incident contained and remediated? 
2. Had the organization duly considered its compliance posture, applicable laws and regulations, and the risks involved? Were adequate technical and organisational measures in place beforehand? 
3. Were the organisation's decisions documented and legally assessed at the time? 
4. Was risk to data subjects reduced, and how promptly? 
5. Is this incident isolated, or part of a pattern? 

4. What is Next 

If adopted, the enforcement default will shift. Across the EU, the question would no longer be whether a fine is warranted but whether one can justifiably be withheld. The factors that organisations instinctively rely on to soften that outcome would carry little weight. What will matter when an incident occurs is what was already in place: documented legal and risk assessments, proportionate technical and organisational measures, and a response capability that evidences genuine, pre-emptive preparation. 

The GDPR remains one of the most-enforced digital laws in Europe, and enforcement is not slowing down. With the rise of AI, regulators are turning to the GDPR as an effective tool to address associated risks. Organizations have never processed as much data, and processing operations are growing more complex, voluminous, and interconnected. Organizations should consider refreshing their GDPR assessments, especially in higher-risk environments involving large volumes of personal data, sensitive data, or automated decision-making and AI.