The EDPB’s new approach to GDPR sanctions
With Guidelines 04/2026, adopted on 17 September 2026 for public consultation, the EDPB addresses a particularly significant issue for organisations: when and to what extent a GDPR infringement should result in an administrative fine.
The Guidelines replace the previous WP29 guidance and complement the EDPB Guidelines 04/2022 on the calculation of administrative fines.
The document clarifies an important principle: a GDPR violation does not automatically lead to the imposition of a monetary fine. The supervisory authority must carry out a concrete assessment of the infringement and the circumstances of the case, also considering the other corrective powers provided for in Article 58(2) GDPR.
For organisations, this reinforces the importance of a structured approach to privacy governance and risk management
Sanctions, Responsibility, Accountability: the GRC perspective on the five‑step methodology
The EDPB Guidelines 04/2026 introduce a decision‑making process structured into five steps:
- Is the infringement subject to an administrative fine?
- Can the controller or processor be subject to a fine?
- Is the infringement intentional or negligent?
- Can the infringement be considered minor?
- Would the fine be effective, proportionate and dissuasive?
This structure is particularly significant because it shifts the focus from the mere identification of the violation to a comprehensive assessment of the organisation’s risk exposure and responsibility.
Severity, Duration and Context
To determine whether an infringement can be considered minor, the supervisory authority must take into account the factors set out in Article 83(2) GDPR.
Among the most relevant elements are the following
- nature and seriousness of the infringement
- duration
- nature and purpose of the processing
- number of data subjects affected
- level of harm or risk
- categories of personal data processed
- intentional or negligent character of the infringement
- previous infringements
- level of responsibility of the organisation
- measures adopted to mitigate the consequences
- degree of cooperation with the supervisory authority
An important point is that the mere fact that the infringement falls within the categories listed in Article 83(4)–(6) GDPR is not sufficient to qualify it as non‑minor or automatically subject to a fine
The role of remediation
From a GRC perspective, one of the most significant aspects concerns the organisation’s ability to respond promptly to the infringement.
Mitigation measures may carry weight in the authority’s assessment, especially when they are implemented quickly and effectively.
Timeliness therefore becomes a concrete element of governance: identifying an issue, containing it, correcting it and preventing its recurrence can influence the overall evaluation of the organisation’s conduct.
In compliance terms, the distinction is not only between “error committed” and “error not committed”, but also between an organisation that reacts in a structured manner and one that fails to demonstrate adequate risk control.
Responsibility and Accountability
The Guidelines also place particular emphasis on the degree of responsibility of the controller or processor. In practice, merely demonstrating the formal existence of technical and organisational measures is not sufficient: it must be shown that such measures were appropriate in light of the nature, purposes and risks of the processing, and that they were effectively implemented.
This is where the principle of accountability under Article 5(2) GDPR emerges strongly. As a result, documentation, records, control evidence, training activities, risk assessments, management decisions and interactions with the DPO may become essential elements in demonstrating the organisation’s level of risk governance — in other words, its overall degree of compliance.
Previous infringements and organisational maturity
Another significant element concerns previous infringements and how their recurrence — especially when they relate to the same area or reveal persistent organisational weaknesses — may be considered an aggravating factor.
This introduces a typically GRC‑oriented perspective: a single non‑compliance may represent an isolated event; the repetition of the same issue, however, may indicate a structural weakness in the internal control system. The organisation’s ability to take on board the DPO’s recommendations and translate them into concrete actions therefore becomes particularly relevant.
A fine is not the only possible outcome
The fifth step requires assessing whether the fine would be effective, proportionate and dissuasive.
The Guidelines clarify that, in the case of minor infringements, an administrative fine should generally not be imposed. However, the supervisory authority retains a margin of discretion depending on the specific circumstances.
Even for non‑minor infringements, a monetary sanction is not necessarily the only possible response: the authority may rely on the other corrective powers provided for in Article 58(2) GDPR when these are more appropriate and proportionate.
The system outlined by the EDPB is therefore oriented towards ensuring that the response is proportionate to the infringement and to the circumstances of the case.
Governing privacy risk beyond compliance
The EDPB Guidelines 04/2026 outline an approach to the sanctionability of GDPR infringements based on a concrete, proportionate and risk‑based assessment, in which the mere existence of a violation does not exhaust the supervisory authority’s analysis. The nature and seriousness of the infringement, its duration, intentional or negligent character, mitigation measures, degree of responsibility, previous infringements and cooperation capacity all contribute to determining the corrective response
From a Governance, Risk & Compliance perspective, this approach further strengthens the accountability principle set out in Article 5(2) GDPR: it is not sufficient for an organisation to have formally defined policies, procedures and controls; it must be able to demonstrate their adequacy, effective implementation and actual effectiveness in relation to the risks at stake.
Privacy compliance therefore takes on a dynamic dimension. Risk identification, control design, monitoring of control effectiveness, incident management, remediation and prevention of recurrence must be integrated within a coherent and well‑documented internal control system.
In this perspective, even the management of a non‑compliance becomes an indicator of GRC maturity. Timeliness of response, adequacy of corrective measures, traceability of decisions and the ability to prevent the violation from recurring may all represent relevant elements in the overall assessment of the organisation’s conduct.
The real shift in perspective lies in moving from a logic of “compliance by documentation” to one of “compliance by evidence”: not merely declaring that privacy risk is governed, but being able to demonstrate — through verifiable evidence — that the governance and control system is genuinely operational.
For an organisation, the strategic question should therefore not be limited to “what is the risk of being fined?”, but extend to a more structural consideration: “how robust, proportionate and demonstrable is our privacy risk‑governance system?”
It is precisely on this ground that the GDPR meets the GRC model: data protection is no longer just a specialised compliance function, but a component of the broader system of governance, risk management and internal control, in which responsibilities, processes, controls and evidence must be coherently integrated.
Sources and Regulatory References
Regulation (EU) 2016/679 (GDPR) – Articles 5, 24, 25, 32, 58 and 83 –artt. 5, 24, 25, 32, 58 e 83.
EDPB Guidelines 04/2026 – on the application of the power to impose administrative fines in relation to the other corrective powers provided for under the GDPR.
EDPB Guidelines 04/2022 – on the calculation of administrative fines under the GDPR.
Regulation (EU) 2025/2518 – laying down additional procedural rules for the application of the GDPR.
Court of Justice of the European Union, judgments C‑807/21 (Deutsche Wohnen), C‑683/21, C‑768/21 (Land Hessen), C‑383/23 and C‑667/21.