The European Data Protection Board adopts new guidance on GDPR fines and DSA-GDPR interplay

The European Data Protection Board (EDPB) has adopted new guidelines to support a more consistent approach to administrative fines under the General Data Protection Regulation (GDPR).

The guidelines set out a five-step methodology for national data protection authorities (DPAs) when deciding whether to impose a fine. Authorities should first establish whether the infringement can lead to a fine and whether the organisation concerned can be held liable. They should then assess whether the infringement was intentional or negligent, consider aggravating and mitigating factors, and determine whether a fine would be effective, proportionate and dissuasive.

The guidance also explains how administrative fines relate to other corrective powers available to DPAs, including warnings, reprimands, orders, limitations and bans, and withdrawal of certification. It includes 14 practical examples showing how different circumstances can affect the choice of corrective measures.

The new guidelines replace earlier guidance from the Article 29 Working Party on the application and setting of administrative fines. They complement existing EDPB guidance on calculating the amount of an administrative fine.

The EDPB has also adopted the final version of its guidelines on the interplay between the DSA and the GDPR, following a public consultation. The guidelines aim to support consistent application of the two legal frameworks, particularly where DSA provisions involve the processing of personal data by intermediary service providers or refer to concepts and definitions established under the GDPR.

The new guidelines on administrative fines are open for public consultation until 13 November 2026.