Guidelines on GDPR Fine Methodology: How EDPB Guidelines 04/2026 Allow a Decision With No Fine

The Guidelines on GDPR fine methodology adopted by the EDPB as Guidelines 04/2026 finally articulate, in a structured manner that was missing until now, how a supervisory authority should decide whether a fine is actually necessary or whether another corrective measure will do.

Adopted on 17 September 2026 and open for public consultation until 13 November 2026, Guidelines 04/2026 on administrative fines do something that many practitioners had been expecting for years, namely they explain that not every established infringement has to result in an administrative fine, and they provide a methodology for when a reprimand, a warning, an order or even no measure at all is the more appropriate outcome.

That shift in perspective is what matters commercially, because until now the only harmonised instrument available at European level was the Guidelines 04/2022 on the calculation of fines, which presupposed that a fine would be imposed, whereas the new Guidelines on GDPR fine methodology address the logically prior question of whether a fine should be imposed at all, which is precisely the question every board asks when an investigation letter arrives.

What the Guidelines say about GDPR fine methodology and the five steps

The EDPB describes the GDPR fine methodology as a sequential assessment that supervisory authorities should work through before deciding to impose a fine, either alone or in combination with other corrective powers under Article 58(2) GDPR.

• Step 1 asks whether the infringement can lead to a fine at all, which is essentially a question of whether the provision breached is listed among those that are punishable under GDPR or national law;
• Step 2 asks who is liable for that infringement, which requires identifying whether the entity under investigation is actually the addressee of the rule that was breached;
• Step 3 asks whether the infringement was committed intentionally or at least negligently, following the interpretation that negligence exists whenever the controller could not have been unaware of the unlawful character of its conduct;

Steps 4 and 5 then move from legal preconditions to discretionary assessment, with

• Step 4 asking whether the infringement is minor when assessed through the lens of the Article 83(2) factors and
• Step 5 asking whether a fine would be effective, proportionate and dissuasive in the circumstances of the case.

The uncontroversial part is that Steps 1 to 3 will, in the vast majority of files, be satisfied without much discussion, since the conduct of employees acting on behalf of the company is attributed to the company, processors are generally attributed to the controller unless they acted outside instructions for their own purposes, and reliance on external legal advice or on an internal assessment that was never properly documented does not exclude negligence, particularly where EDPB guidance already existed on the point at issue.

Why these Guidelines on GDPR fine methodology allow a decision with no fine

The most significant contribution of the Guidelines on GDPR fine methodology is not in Steps 1 to 3, which essentially restate principles that were already known, but in Steps 4 and 5, where the EDPB acknowledges that an administrative fine is only one instrument among others and that it may not be the right one.

The Guidelines on GDPR fine methodology state explicitly that

1. a warning operates ex ante and therefore cannot be combined with a fine for the same conduct that has already materialised,
2. a reprimand and a fine share a deterrent purpose so that imposing both for the same infringement is generally unnecessary,
3. where a limitation or ban concerns future processing for which no infringement has yet been established no fine may follow under this GDPR fine methodology, and
4. a supervisory authority may refrain from exercising any corrective power where the controller, as soon as it became aware of the infringement, adopted appropriate and necessary measures to bring it to an end and prevent its recurrence.

This is not a fining guideline in the traditional sense, it is a not-fining guideline, and if you can demonstrate that the infringement is minor and that remediation occurred spontaneously before the authority made contact, the Guidelines on GDPR fine methodology expressly allow the authority to close the file with a reprimand or with no measure at all.

Four critical gaps in the Guidelines’ GDPR fine methodology that Italian practice exposes

If you operate in Italy you know that a file never contains only five steps, it contains a reduced payment mechanism offered by procedural rules, an ancillary publication measure with its own commercial weight, and often an urgent measure adopted before any infringement has been formally established, and none of these constraints are addressed in the current formulation of the GDPR fine methodology.

1. Publication as an independent sanction that the GDPR fine methodology leaves aside

Article 16(1) of Italian Data Protection Authority Regulation No. 1/2019 provides for publication of the decision on the Garante’s website as an ancillary sanction to an injunction order, which is a corrective measure capable of independent challenge and which produces on its own a relevant and lasting commercial harm, particularly where the substantive fine is modest and the reputational impact sits entirely in the publication, yet the Guidelines on GDPR fine methodology rank warnings, reprimands, limitations and bans without ever positioning publication within that ranking, without clarifying what threshold justifies it and without explaining whether it survives when the substantive fine falls on appeal.

2. Urgent provisional measures adopted before any infringement is established

The sharpest illustration of where the GDPR fine methodology runs out of room arrived on 27 October 2026, when the President of the Garante adopted urgent provisional limitation No. 809 against six Italian broadcasters and online publishers, prohibiting any further dissemination of data and images capable of identifying two minors reported in connection with disorder in Milan and extending the prohibition to content already online, on the basis of Article 58(2)(f) and (a) GDPR, qualifying the violations as apparent only on a first summary examination, taking effect on receipt and requiring each recipient to report documented compliance steps within three days, with ratification required at a collegial meeting convened within thirty days.

This is precisely the space where the Guidelines on GDPR fine methodology state that no fine may follow where the limitation concerns future processing for which no infringement has yet been established, yet the three-day report that the recipient is required to produce becomes, in substance, the first self-descriptive statement written by that recipient in a proceeding that has not formally opened, under a deadline, before knowing the charge.

Step 4 of the GDPR fine methodology should therefore address how the mitigation analysis treats a statement produced under compulsion before any proceeding exists and whether an authority may rely on the quality, timing or completeness of that statement when it later assesses cooperation under Article 83(2), but at present it does not. I covered the expansion of inspection powers without notice in New Italian AI Act Enforcement Law Is Now Live.

3. The reduced payment mechanism that the GDPR fine methodology ignores

Italian procedural rules allow a recipient to pay half the amount within thirty days and close the case, which appears attractive from a cash perspective but forfeits any argument on the amount and, in practice, on any ancillary publication, and the Guidelines on GDPR fine methodology are built on the assumption of a single decision point at which one authority, holding discretion, selects a measure and fixes an amount, whereas real files contain a reduction offered by procedural rules, an ancillary publication with its own commercial weight and an urgent measure adopted before the facts are established.

What is needed is therefore what I would call a Step Zero in the GDPR fine methodology, namely an express assessment of the measures already in force against the same entity, because without that assessment the methodology produces decisions that may not survive judicial review, as it hands the recipient four arguments that no step addresses.

What organisations should do before the consultation on the GDPR fine methodology closes

The draft is useful precisely because it opens the door to a decision with no fine, but a GDPR fine methodology that allows a no-fine outcome must also explain when that outcome is required, not merely when it is possible, otherwise the discretion remains entirely with the authority and the harmonisation objective is missed.

Organisations operating in Italy face a further overlay that the Guidelines on GDPR fine methodology do not address, since the agency that holds a company’s cybersecurity registration under NIS2 categorization also receives its incident notifications and, since 23 October 2026, may inspect its artificial intelligence systems without notice, with the result that a statement made to one of those functions reaches the others, and the five steps say nothing about that either.