To fine or not to fine? What the EDPB's new guidelines on imposing fines mean for organizations

When a data protection infringement comes to light, the first question most organizations ask is: What is our exposure to a fine? New guidance from the European Data Protection Board (EDPB) shifts attention to an earlier, logically prior question: Should a fine be imposed at all? The answer may be less reassuring than many controllers and processors expect. Until now, the EDPB’s Guidelines 04/2022 on the calculation of administrative fines under the GDPR (the “Calculation Guidelines”) have addressed only how the amount of a fine is determined, not whether one should be imposed in the first place.

On 17 September 2026, the EDPB adopted Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR (the "Imposition Guidelines"), which are currently open for public consultation. The Imposition Guidelines replace the Article 29 Working Party guidance (WP253) and complement the Calculation Guidelines, which govern the quantum of administrative fines. The Imposition Guidelines address the preceding stage: Should an administrative fine be imposed, either on its own or in addition to, or instead of, the other corrective measures available under Article 58(2) GDPR, such as warnings, reprimands and orders?

The core message is clear. Not every infringement will result in an administrative fine. However, once an infringement is not considered “minor”, supervisory authorities will proceed from a strong presumption that a fine should be imposed.

A five-step test

For the first time, the EDPB sets out a structured, five-step methodology for determining whether to impose an administrative fine. Supervisory authorities will ask the following questions:

1. Can a fine be imposed? Is the rule that was breached one that the GDPR or national law allows fines for?
2. Who is responsible? Is the company the party the rule actually applies to?
3. Was the company at fault? Was the breach intentional, or at least negligent?
4. Was it minor? Taken together, do the relevant factors suggest a minor infringement?
5. Would a fine make sense? Would a fine be effective, proportionate and dissuasive?

Steps 1 to 3 constitute legal preconditions for imposing an administrative fine, while Steps 4 and 5 afford the supervisory authority a structured margin of discretion.

The bar for fault is low

Organizations should not underestimate the risk of liability being established at Steps 1 to 3. The threshold is deliberately low. Under the Imposition Guidelines:

• Your people are your responsibility. The conduct of anyone acting on the company's behalf is attributed to the company. An employee ignoring instructions does not, by itself, get the company off the hook. 
• So are your service providers, in most cases. A company answers for the data processors it uses unless a processor acted for its own purposes or outside the agreed framework. 
• "We didn't realise" rarely works. Negligence is established where the company could not have been unaware that its conduct was unlawful. Where EDPB guidance on the issue exists, an error is always treated as avoidable. 
• Legal advice is not a shield. Neither external opinions nor internal assessments excuse a breach, and advice that was never documented counts for nothing. 

In practice, defenses based on good faith or reliance on legal advice will rarely succeed. The decisive battleground will typically be Step 4: Can the infringement be characterized as minor?

What makes a breach "minor"?

Whether an infringement is minor is assessed by reference to the aggravating and mitigating factors in Article 83(2)(a) to (k) GDPR. Several points merit particular attention:

• Context matters. High-risk processing such as monitoring or profiling, situations involving an imbalance of power (for example with employees, patients or children), breaches affecting the core business or many people, and long-running or systemic problems all count against a company. 
• Speed matters. Fast, effective remediation helps, especially if it happens before the company knows an investigation is under way. 
• Basic cooperation is expected, not rewarded. Only cooperation that goes beyond the legal duty and actually limits harm counts in the company's favor. 
• A clean record is the baseline. Having no previous breaches does not count as a mitigating factor. Previous breaches, especially on the same issue, count against a company, and there is no fixed cut-off for how far back authorities may look. 
• Self-reporting can help. Under Article 83(2)(h) GDPR, notifying an infringement on the organization’s own motion, before the supervisory authority becomes aware of it, may be treated as a mitigating factor. Complaints, investigations and mandatory notifications, such as personal data breach notifications under Article 33 GDPR, are treated as neutral. 
• Profit is a red flag. If a company made a profit or avoided losses through the breach, that strongly suggests a fine. 

From a practitioner’s perspective, however, some of the above-mentioned points appear unrealistic. Organizations deliberating on whether to notify of an infringement are typically reluctant to take any step that unnecessarily alerts a supervisory authority to a compliance issue. Generally, voluntary self-reporting for purely strategic, fine-reduction purposes is unlikely to feature in real-world compliance decisions.

The Imposition Guidelines also clarify that a reprimand may replace an administrative fine for legal persons, not only natural persons, where a fine would constitute a disproportionate burden. Supervisory authorities may even refrain from exercising any corrective power where the controller, as soon as it became aware of the infringement, took appropriate and necessary measures to bring it to an end and prevent its recurrence.

Fines within the wider corrective GDPR toolbox

A central theme of the Imposition Guidelines is that an administrative fine is only one instrument in the corrective toolbox under Article 58(2) GDPR, which also includes warnings, reprimands, compliance orders, temporary or definitive limitations including bans on processing, and the withdrawal of certification. Supervisory authorities must choose the measure or combination of measures that is appropriate, necessary and proportionate, having regard to their distinct purposes: Orders primarily restore compliance, whereas fines serve a punitive and deterrent function. Several rules follow. A warning operates ex ante, before any infringement has occurred, and therefore cannot be combined with a fine for the same conduct. A reprimand and a fine share a deterrent purpose, so it is generally unnecessary to impose both for the same infringement, although the GDPR does not exclude this in principle. Compliance orders may be imposed alongside a fine, and, as a rule, so may a limitation or ban on processing, unless it relates to processing in respect of which no infringement has yet been established. Even where an infringement is not minor, supervisory authorities retain discretion to issue a reprimand instead of a fine where a fine would be disproportionate.

Lessons from the examples

The most useful part of the guidelines is probably their worked examples. There are a few which show where the line falls:

Case A: Reprimand

A small business missed a single access request, which had probably ended up in its spam folder. It apologized and acted immediately once contacted. The breach was treated as minor and led to a reprimand. 

Case B: Fine proceedings

A small telecoms company replied to a request a month late. Investigators then found more identical cases. The first late reply was minor, but the pattern was not, and fine proceedings followed.

Case C: No measure taken

An employee accidentally emailed a copy of someone's driving license to other people. The company notified the authorities and the individual right away, paid for a replacement license, and, without being asked, commissioned an external review. The breach was minor, and no measures were taken.

The pattern is consistent: Isolated errors that are addressed promptly and transparently tend to be treated leniently, whereas recurring or systemic failings are not.

What should businesses do when facing potential administrative fines?

In light of the Imposition Guidelines, organizations should act proactively when facing potential administrative fines. As a first priority, they should review their processing activities against existing EDPB guidance and keep a documented record of their legal assessments, including any contrary views, as well as follow the advice of their data protection officer and document the reasons for any decision not to do so. In parallel, they should strengthen their security and privacy controls, monitor third-party tools such as tracking pixels and supervise their service providers, prioritizing high-risk processing involving employees, children or profiling. In the event of an official investigation by a supervisory authority, organizations should focus on Step 4 of the five-step methodology by presenting compelling arguments at an early stage that the infringement was minor, addressing its scope, duration, harm, the types of data concerned and the degree of fault. They should also comply with any orders issued and consider going beyond their legal obligations, since additional remedial steps can count in their favor, whereas non-compliance will aggravate their position.

The bottom line

The Imposition Guidelines track the wording of the GDPR closely and do not introduce new criteria. They complement the Calculation Guidelines by adding an important additional perspective: Read together, the two sets of guidelines now present the complete picture, and equip supervisory authorities with comprehensive guidance across the full life cycle of administrative fine decision-making, from whether to impose a fine to how to calculate it. Within that framework, the question whether an infringement is minor acts as the decisive filter. Because fault is almost always established, organizations are best protected by robust controls, prompt remediation and thorough documentation.

The Imposition Guidelines remain subject to public consultation, and both the final text and its application by national supervisory authorities remain to be seen. Organizations that prepare now will be considerably better positioned should a supervisory authority ask whether they deserve a fine.

Many thanks to Pauline Franz for her contribution to this blog post.