GDPR fines: EDPB consults on whether to impose a penalty

A draft about the decision to fine

On 21 September 2026, the EDPB announced guidance setting out a five-step methodology for deciding whether to impose a GDPR administrative fine. European Data Protection Board The subject is the decision to use a fine as a corrective measure. A reader should keep that question separate from how much a fine would be once the decision to impose one has been made.

The guidance includes 14 practical examples of how authorities may choose corrective measures, according to the EDPB announcement. European Data Protection Board Examples can make a decision framework easier to examine. They should not be treated as a ready-made classification of an organisation’s own situation without reviewing the circumstances of that situation.

The consultation remains open until 13 November 2026. European Data Protection Board This gives the text a clear procedural status: it is open for responses rather than settled after consultation. For an internal briefing, the consultation deadline should be recorded as a point for monitoring or contribution, not as a date on which a new fine automatically applies.

The dates and the document’s status

The official EDPB document page dates Guidelines 04/2026 to 17 September 2026 and labels the public consultation ongoing. European Data Protection Board The document date and the announcement date describe different steps. Keeping them distinct avoids presenting the announcement as the adoption date or suggesting that publication ended the consultation.

The fining guidelines are a draft rather than a final post-consultation text, P.K. Sharma explains. P.K. Sharma That status matters when preparing training or management guidance. A team may study the approach, but it should identify the version it is using and leave room to update its analysis after the consultation.

The supplied facts establish that the methodology has steps, but do not set out their individual content. An article or internal note should not reconstruct them from memory. The useful distinction can be explained without inventing a checklist that might later be mistaken for the EDPB’s actual wording.

Deciding whether and calculating how much are separate

The new fining guidance addresses whether to fine, while the calculation methodology remains in Guidelines 04/2022, unchanged since 2023, according to P.K. Sharma. P.K. Sharma This is the central reading rule for the announcement. The consultation should not be described as replacing the calculation methodology or creating a new statutory fine ceiling.

Under the framework, minor infringements generally call for a reprimand rather than a fine, Tech Policy Law reports. Tech Policy Law The word “generally” should remain visible. It describes the approach without promising that a particular organisation’s conduct would be classified as minor or that a fine would necessarily be excluded in its case.

For a risk assessment, separate the question of the appropriate corrective measure from the question of its monetary amount. Otherwise, a discussion about whether a fine is justified may be misread as a reduction in exposure. The supplied development does not establish a financial outcome for an individual business.

A separate final text must not lend its status to the draft

The EDPB separately finalised guidance on the interaction between the Digital Services Act and the GDPR, Tech Policy Law reports. Tech Policy Law That finalisation concerns a different text. Its appearance alongside the fining announcement does not make the fining guidance final, and it should not be used to imply that all the announced work has the same status.

A useful management summary would therefore keep separate entries for the fining consultation, the existing calculation methodology and the finalised interaction guidance. This is an editorial recommendation about how to organise the material. It does not assert additional obligations from the separate text whose detailed provisions are not in the supplied facts.

An Algerian business should begin with its own exposure

For Algerian businesses assessing exposure to EU data-protection requirements, the relevance is conditional on their own circumstances. This announcement does not establish that a particular Algerian business is covered, nor does it create an Algerian fine schedule. The honest connection is a more precise way to frame a compliance review.

A practical review could ask the appropriate adviser to distinguish applicability, the selection of a corrective measure and the calculation of an amount. Keep these questions in separate parts of the assessment and avoid using the draft as a promise of leniency. Record what remains unknown rather than filling the gap with an assumed legal conclusion.

The value of the consultation is this distinction between decisions, not a headline suggesting that fines have simply become lower or higher. Follow the consultation, retain the draft label and update any internal explanation when the text’s status changes.

Frequently Asked Questions

Sources & Further Reading

• European Data Protection Board
• Tech Policy Law
• P.K. Sharma
• European Data Protection Board