EDPB Data Protection Brief

Headline

EDPB adopts fining-methodology guidelines and finalizes DSA-GDPR interplay guidance at September 2026 plenary

Executive Summary

The European Data Protection Board adopted two sets of guidelines at its September 21, 2026 plenary. The first establishes a five-step methodology for national data protection authorities deciding whether to impose administrative fines under the GDPR. The second finalizes guidance on how the Digital Services Act and the GDPR interact, following public consultation.

Bottom Line

The EDPB's fining-methodology guidelines establish a five-step sequential framework governing whether national data protection authorities impose administrative fines, with a strong presumption of a fine where an infringement is not minor. The finalized DSA-GDPR guidelines close the consultation phase and now represent the EDPB's settled position on how both instruments interact for intermediary service providers processing personal data. The fining-methodology guidelines remain open for stakeholder comment until November 13, 2026. Cresthaven reading: organizations subject to active or anticipated DPA investigations across the EU face a harmonized enforcement standard under which the decision to fine is now as methodologically structured as the calculation of the fine amount itself.

Key Regulatory Signals

• Five-Step Fining Methodology Recommended for DPAs: The guidelines set out a five-step methodology that national data protection authorities should follow when deciding whether to impose an administrative fine. Steps cover legal basis, party liability, culpability, aggravating and mitigating factors, and proportionality assessment. Cresthaven reading: organizations under active DPA investigation face a more structured and predictable, but also more systematically documented, enforcement pathway across all EU member states.
• Minor Infringements Carry a Reprimand Default: Where a DPA determines an infringement is minor, the guidelines state there will generally be no fine and a reprimand may be issued instead. Where the infringement is not minor, the guidelines establish a strong presumption that a fine should be imposed.
• Fourteen Practical Examples Accompany the Framework: The EDPB provides 14 illustrative case examples showing how DPAs assess specific circumstances and select corrective measures. These examples sit alongside a full inventory of corrective powers, covering warnings, reprimands, orders, limitations including bans, and withdrawal of certification.
• DSA-GDPR Interplay Guidelines Are Now Final: Following public consultation, the EDPB adopted the final version of its guidelines on the intersection of the Digital Services Act and the GDPR. The finalized text supports consistent application of both instruments where DSA provisions concern personal data processing by intermediary service providers and reference GDPR concepts and definitions.
• Fining-Methodology Guidelines Open for Comment Until November 13, 2026: The newly adopted fining-methodology guidelines are subject to public consultation closing November 13, 2026. The finalized DSA-GDPR guidelines are not subject to further consultation, having completed that process before adoption.

Regulatory Delta

• The new guidelines replace the Article 29 Working Party fining guidelines and complement the EDPB's previously adopted guidance on calculating fine amounts. The shift is significant: these guidelines address the prior threshold question of whether a fine should be imposed at all, not how to calculate one once that decision is made.
• The five-step sequential framework formalizes DPA discretion on culpability and proportionality across all EU member states, replacing a less prescriptive prior approach.
• The concurrent finalization of guidance on the relationship between the DSA and the GDPR signals EDPB coordination with the DSA enforcement architecture overseen by the European Commission and national Digital Services Coordinators. The guidelines support the consistent application of both legal acts where DSA provisions concern the processing of personal data by intermediary service providers.

Materiality Classification

MEDIUM — Sector-wide EDPB guidelines harmonizing DPA fining discretion across all EU member states, with a public consultation deadline of November 13, 2026; not yet final on the fining-methodology component, but the DSA-GDPR guidelines are finalized and represent settled EDPB policy.

Time Horizon

comment_close — 2026-11-13

Intelligence Outlook

Monitor the EDPB for the final version of the fining-methodology guidelines following the close of the public consultation on November 13, 2026.