# EDPB Guidelines on GDPR Fine Practice > The EDPB clarifies the assessment of GDPR fines and other corrective measures as well as the interplay between DSA and GDPR. Source: https://www.mtrlegal.com/en/edpb-guidelines-gdpr-fine-practice/ · Language: en · Updated: 2026-10-21 --- ## EDPB adopts guidelines on fine practice The European Data Protection Board (EDPB) adopted guidelines at its most recent plenary meeting on the exercise of the power to impose fines in relation to further corrective powers [under the GDPR](https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32016R0679). In addition, the final version of the guidelines on the interplay between the Digital Services Act and the GDPR was adopted. With the new guidelines, the EDPB aims to further align the decision-making practice of data protection supervisory authorities. The focus is on the question of the conditions under which a fine may be considered on its own or together with other measures. [The GDPR](https://www.mtrlegal.com/wiki/dsgvo/) has granted data protection supervisory authorities extensive corrective powers. [Fines constitute](https://www.mtrlegal.com/wiki/unternehmensgeldbusse/) a key enforcement instrument in this context. According to EDPB Deputy Chair Jelena Virant Burnik, the guidelines are intended to contribute to greater clarity and promote uniform application of the GDPR in Europe. ## Five-step approach to assessing fines Under the guidelines, data protection supervisory authorities should apply a five-step method when deciding whether to impose a fine. This is intended to structure the assessment and make the application of the GDPR in comparable cases more transparent. ### Assessment of whether the infringement is subject to a fine First, the data protection supervisory authority examines whether the established infringement can be sanctioned with a fine at all. The basis for this may arise directly from the GDPR or from the relevant national law. ### Attribution to the party concerned In the next step, it is determined whether a fine may be imposed on the party concerned by the investigation for the infringement in question. Whether a controller or a processor is eligible depends on who is bound by the provision that has been breached. ### Intent or negligence as a requirement It must then be examined whether the infringement was committed intentionally or negligently. According to the guidelines, a culpable infringement is a prerequisite for the imposition of a fine. ### Aggravating and mitigating circumstances The data protection supervisory authority then assesses possible aggravating and mitigating factors. In the case of minor infringements, no fine is generally imposed; instead, a reprimand may be issued. If the measure is not minor, the guidelines state that there is a strong presumption that a fine should be imposed. ### Effectiveness, proportionality and deterrence Finally, the data protection supervisory authority examines whether imposing a fine would be effective, proportionate and dissuasive. In this context, it may take into account whether, in the specific individual case, there is a reason to depart from the standard approach. ## Overview of further corrective powers The guidelines are not limited to fines. They also include an overview of the corrective powers that fall within the remit of national data protection supervisory authorities. The purpose, scope and relationship of the measures to one another are explained. The corrective measures mentioned include in particular: - warnings, - reprimands, - orders, - restrictions, including bans, - withdrawal of a certification. The EDPB also provides 14 practical examples. These are intended to illustrate how data protection supervisory authorities can assess the specific circumstances of an individual case and decide which corrective measures may be considered, if any. ## Public consultation until November 2026 The guidelines on the application of the power to impose fines in conjunction with other corrective powers will be subject to a public consultation. According to the [EDPB announcement](https://www.edpb.europa.eu/news/edpb-harmonises-fining-methodology-and-adopts-final-dsa-gdpr-guidelines_de), this consultation will run until 13 November 2026. Stakeholders are thereby given the opportunity to submit comments and feedback on the guidelines. The present version of the announcement is based on an automated translation that may contain errors. This translation is not authoritative; the official English version is decisive. ## Final guidelines on DSA and GDPR In addition to the guidelines on fine methodology, the EDPB has also adopted, following a public consultation, the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR. These guidelines are intended to support the uniform application of both legal acts. This concerns in particular cases in which provisions of the Digital Services Act affect the processing of personal data by providers of intermediary services. In doing so, the guidelines refer to the concepts and definitions contained in the GDPR. ## Relationship to earlier guidelines The new guidelines replace the guidelines of the Article 29 Data Protection Working Party on the application and setting of fines within the meaning of Regulation 2016/679. At the same time, they supplement the previously adopted guidelines on the calculation of fines under the GDPR. While the earlier guidelines on the calculation of fines are more strongly focused on the method for determining the amount of a fine, the new guidelines concern the upstream and accompanying question of whether a fine should be imposed alone or together with other corrective measures. ## Significance for companies and data-processing bodies The guidelines make clear that data protection supervisory authorities must carry out a structured assessment in the event of infringements of the GDPR. For companies, investors and other data-processing bodies, this may be relevant in particular with regard to administrative proceedings, internal data protection organisation and the assessment of regulatory risks. MTR Legal Rechtsanwälte advises companies and private individuals on data protection law issues, in particular in connection with the GDPR, administrative proceedings and interfaces with digital business models. Further information can be found under [legal advice in data protection law](https://www.mtrlegal.com/rechtsberatung/it-recht/datenschutz/).