The Guidelines on GDPR fine methodology adopted by the EDPB as Guidelines 04/2026 finally articulate, in a structured manner that was missing until now, how a supervisory authority should decide whether a fine is actually necessary or whether another corrective measure will do.