EDPB Guidelines 04/2026 adopted September 17, 2026; public consultation closes November 13, 2026
Fine by Default: EDPB Draft Would Flip the GDPR Question, and Comments Close November 13
The European Data Protection Board adopted draft Guidelines 04/2026 on September 17, setting out when a GDPR administrative fine should be imposed alongside, or instead of, the other corrective powers in Article 58(2). Public consultation closes on November 13, 2026, which makes this the last week to comment. The guidelines complement the 2022 calculation guidelines, which address how much a fine should be; this document addresses the prior question of whether there is a fine at all, and it replaces the older Article 29 Working Party guidance on the point. The method has five steps: whether the infringement can be fined under the GDPR or national law; whether the party can be liable; whether the act was intentional or negligent; whether Article 83(2) factors make the infringement minor; and whether a fine would be effective, proportionate, and dissuasive in the case. The default is the story. For a minor infringement, the general rule is no fine and a reprimand instead. For anything not minor, there is a strong presumption that a fine should be imposed, which two law firm analyses describe as flipping the regulator's question from whether to fine to whether not fining can be justified. The negligence bar is set low: the question is whether the organization was in a position to know its conduct was unlawful, not whether it actually appreciated it, and the recognized escape is an unavoidable error in law after taking all reasonable steps to understand the position. Mitigation is also narrowed: measures taken spontaneously before an investigation is known carry weight, while doing what the GDPR already requires, including ordinary cooperation and statutory breach notification, is treated as neutral rather than mitigating. Fines can be combined with processing bans and limitations for established infringements, while a warning, being preventive, cannot pair with a fine for the same conduct. The fine ceilings the method operates under are unchanged: up to 20 million euros or 4 percent of worldwide annual turnover for the most serious infringements, and 10 million euros or 2 percent for the lower tier. Both analyses add the honest caveat that enforcement remains national, and the 2022 calculation guidelines are not followed consistently, so adoption in practice will vary by authority.
Executives
If these guidelines are adopted as drafted, the enforcement conversation in Europe changes posture: for any non-minor infringement, the regulator starts from fine and asks to be persuaded otherwise. The persuasion material is not a good response after the fact; the guidelines give little credit for doing what the law already required. What carries weight is evidence that existed before the incident: documented legal and risk assessments, and mitigation taken early and voluntarily. That is a budget and governance point, not a legal technicality, and the consultation window to influence the final text closes November 13.
CIO / CISO
Translate the five steps into an internal readiness check. For your highest-risk processing, could you produce, today, the documented assessment that shows the organization understood its obligations before acting; the record of technical and organizational measures in place beforehand; and a response timeline showing containment and harm reduction that began before any regulator contact. Under the draft, those three artifacts are effectively the defense, and their absence leaves the negligence argument with nothing to stand on.
Engineers
The guidelines reward speed that is already engineered: detection that fires without a human noticing a headline, containment that can be executed in hours, and records that prove the sequence afterward. Incident evidence, decision logs, and remediation timestamps should be generated by the tooling rather than reconstructed in a document after the event, because the draft weighs the timeliness and effectiveness of measures and discounts anything that looks assembled for the investigation.
Everyone (non-IT)
Nothing here changes what you can ask of companies holding your data; your GDPR rights are the same as last month. What may change is how reliably a fine follows when a company breaks the rules in a way that is more than minor. If you follow privacy enforcement, the date to watch is November 13, when the consultation closes and the final drafting begins.