Data Protection Authority
EDPB harmonises fining methodology and adopts guidelines on the DSA and GDPR
21st September 2026
The European Data Protection Board (EDPB) has adopted new guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR.
The aim is to further align how Data Protection Authorities (DPAs) decide whether an administrative fine should be imposed, either on its own or alongside other corrective measures.
The guidelines set out a five-step methodology for deciding whether to impose an administrative fine. Among other things, DPAs should assess whether the infringement can lead to a fine, whether the party under investigation may be fined for the infringement, whether the infringement was committed intentionally or negligently, and whether there are any aggravating or mitigating factors. Finally, the DPA must assess whether imposing an administrative fine would be effective, proportionate and dissuasive.
The guidelines will be subject to public consultation until 13 November 2026.
The EDPB has also adopted the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR. The guidelines are intended to support the consistent application of both legal acts, particularly where DSA provisions concern the processing of personal data by intermediary service providers and refer to concepts and definitions laid down in the GDPR.
The final guidelines on the interplay between the DSA and the GDPR will undergo linguistic checks before publication.