{"id":3306,"date":"2026-10-01T18:05:54","date_gmt":"2026-10-01T16:05:54","guid":{"rendered":"https:\/\/www.pfadvisory.it\/?p=3306"},"modified":"2026-10-01T18:05:55","modified_gmt":"2026-10-01T16:05:55","slug":"gdpr-sanzioni-linee-guida-edpb-2026-compliance","status":"publish","type":"post","link":"https:\/\/www.pfadvisory.it\/en\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/","title":{"rendered":"GDPR Sanctions: the new EDPB 2026 Guidelines and their impact on compliance"},"content":{"rendered":"<h2 class=\"wp-block-heading\">The EDPB\u2019s new approach to GDPR sanctions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With Guidelines 04\/2026, adopted on 17 September 2026 for public consultation, the EDPB addresses a particularly significant issue for organisations: when and to what extent a GDPR infringement should result in an administrative fine.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Guidelines replace the previous WP29 guidance and complement the EDPB Guidelines 04\/2022 on the calculation of administrative fines.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The document clarifies an important principle: a GDPR violation does not automatically lead to the imposition of a monetary fine. The supervisory authority must carry out a concrete assessment of the infringement and the circumstances of the case, also considering the other corrective powers provided for in Article 58(2) GDPR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For organisations, this reinforces the importance of a structured approach to privacy governance and risk management<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Sanctions, Responsibility, Accountability: the GRC perspective on the five\u2011step methodology<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The EDPB Guidelines 04\/2026 introduce a decision\u2011making process structured into five steps:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Is the infringement subject to an administrative fine?<\/li>\n\n\n\n<li>Can the controller or processor be subject to a fine?<\/li>\n\n\n\n<li>Is the infringement intentional or negligent?<\/li>\n\n\n\n<li>Can the infringement be considered minor?<\/li>\n\n\n\n<li>Would the fine be effective, proportionate and dissuasive?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This structure is particularly significant because it shifts the focus from the mere identification of the violation to a comprehensive assessment of the organisation\u2019s risk exposure and responsibility.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Severity, Duration and Context<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To determine whether an infringement can be considered minor, the supervisory authority must take into account the factors set out in Article 83(2) GDPR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Among the most relevant elements are the following<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>nature and seriousness of the infringement<\/li>\n\n\n\n<li>duration<\/li>\n\n\n\n<li>nature and purpose of the processing<\/li>\n\n\n\n<li>number of data subjects affected<\/li>\n\n\n\n<li>level of harm or risk<\/li>\n\n\n\n<li>categories of personal data processed<\/li>\n\n\n\n<li>intentional or negligent character of the infringement<\/li>\n\n\n\n<li>previous infringements<\/li>\n\n\n\n<li>level of responsibility of the organisation<\/li>\n\n\n\n<li>measures adopted to mitigate the consequences<\/li>\n\n\n\n<li>degree of cooperation with the supervisory authority<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">An important point is that the mere fact that the infringement falls within the categories listed in Article 83(4)\u2013(6) GDPR is not sufficient to qualify it as non\u2011minor or automatically subject to a fine<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The role of remediation<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From a GRC perspective, one of the most significant aspects concerns the organisation\u2019s ability to respond promptly to the infringement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mitigation measures may carry weight in the authority\u2019s assessment, especially when they are implemented quickly and effectively.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Timeliness therefore becomes a concrete element of governance: identifying an issue, containing it, correcting it and preventing its recurrence can influence the overall evaluation of the organisation\u2019s conduct.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In compliance terms, the distinction is not only between \u201cerror committed\u201d and \u201cerror not committed\u201d, but also between an organisation that reacts in a structured manner and one that fails to demonstrate adequate risk control.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Responsibility and Accountability<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Guidelines also place particular emphasis on the degree of responsibility of the controller or processor. In practice, merely demonstrating the formal existence of technical and organisational measures is not sufficient: it must be shown that such measures were appropriate in light of the nature, purposes and risks of the processing, and that they were effectively implemented.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is where the principle of accountability under Article 5(2) GDPR emerges strongly. As a result, documentation, records, control evidence, training activities, risk assessments, management decisions and interactions with the DPO may become essential elements in demonstrating the organisation\u2019s level of risk governance \u2014 in other words, its overall degree of compliance.<\/p>\n\n\n\n<div style=\"height:18px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Previous infringements and organisational maturity<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Another significant element concerns previous infringements and how their recurrence \u2014 especially when they relate to the same area or reveal persistent organisational weaknesses \u2014 may be considered an aggravating factor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This introduces a typically GRC\u2011oriented perspective: a single non\u2011compliance may represent an isolated event; the repetition of the same issue, however, may indicate a structural weakness in the internal control system. The organisation\u2019s ability to take on board the DPO\u2019s recommendations and translate them into concrete actions therefore becomes particularly relevant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A fine is not the only possible outcome<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fifth step requires assessing whether the fine would be effective, proportionate and dissuasive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Guidelines clarify that, in the case of minor infringements, an administrative fine should generally not be imposed. However, the supervisory authority retains a margin of discretion depending on the specific circumstances.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Even for non\u2011minor infringements, a monetary sanction is not necessarily the only possible response: the authority may rely on the other corrective powers provided for in Article 58(2) GDPR when these are more appropriate and proportionate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The system outlined by the EDPB is therefore oriented towards ensuring that the response is proportionate to the infringement and to the circumstances of the case.<\/p>\n\n\n\n<div style=\"height:0px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Governing privacy risk beyond compliance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The EDPB Guidelines 04\/2026 outline an approach to the sanctionability of GDPR infringements based on a concrete, proportionate and risk\u2011based assessment, in which the mere existence of a violation does not exhaust the supervisory authority\u2019s analysis. The nature and seriousness of the infringement, its duration, intentional or negligent character, mitigation measures, degree of responsibility, previous infringements and cooperation capacity all contribute to determining the corrective response<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From a Governance, Risk &amp; Compliance perspective, this approach further strengthens the accountability principle set out in Article 5(2) GDPR: it is not sufficient for an organisation to have formally defined policies, procedures and controls; it must be able to demonstrate their adequacy, effective implementation and actual effectiveness in relation to the risks at stake.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Privacy compliance therefore takes on a dynamic dimension. Risk identification, control design, monitoring of control effectiveness, incident management, remediation and prevention of recurrence must be integrated within a coherent and well\u2011documented internal control system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this perspective, even the management of a non\u2011compliance becomes an indicator of GRC maturity. Timeliness of response, adequacy of corrective measures, traceability of decisions and the ability to prevent the violation from recurring may all represent relevant elements in the overall assessment of the organisation\u2019s conduct.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The real shift in perspective lies in moving from a logic of \u201ccompliance by documentation\u201d to one of \u201ccompliance by evidence\u201d: not merely declaring that privacy risk is governed, but being able to demonstrate \u2014 through verifiable evidence \u2014 that the governance and control system is genuinely operational.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For an organisation, the strategic question should therefore not be limited to \u201cwhat is the risk of being fined?\u201d, but extend to a more structural consideration: \u201chow robust, proportionate and demonstrable is our privacy risk\u2011governance system?\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is precisely on this ground that the GDPR meets the GRC model: data protection is no longer just a specialised compliance function, but a component of the broader system of governance, risk management and internal control, in which responsibilities, processes, controls and evidence must be coherently integrated.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Sources and Regulatory References<\/h3>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Regulation (EU) 2016\/679 (GDPR) \u2013 Articles 5, 24, 25, 32, 58 and 83<\/strong> \u2013artt. 5, 24, 25, 32, 58 e 83.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">EDPB Guidelines 04\/2026 \u2013 on the application of the power to impose administrative fines in relation to the other corrective powers provided for under the GDPR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">EDPB Guidelines 04\/2022 \u2013 on the calculation of administrative fines under the GDPR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Regulation (EU) 2025\/2518 \u2013 laying down additional procedural rules for the application of the GDPR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Court of Justice of the European Union, judgments C\u2011807\/21 (Deutsche Wohnen), C\u2011683\/21, C\u2011768\/21 (Land Hessen), C\u2011383\/23 and C\u2011667\/21.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>","protected":false},"excerpt":{"rendered":"<p>Le nuove Linee guida EDPB 04\/2026 chiariscono come le autorit\u00e0 di controllo debbano valutare l\u2019applicazione delle sanzioni amministrative previste dal GDPR in relazione agli altri poteri correttivi.<br \/>\nIl documento introduce una metodologia articolata in cinque passaggi, attraverso la quale l\u2019autorit\u00e0 valuta se un\u2019infrazione sia sanzionabile, il livello di responsabilit\u00e0 del titolare o del responsabile del trattamento, la natura intenzionale o negligente della condotta, la sua eventuale natura minore e, infine, se una sanzione sia efficace, proporzionata e dissuasiva.<br \/>\nDal punto di vista GRC, il messaggio pi\u00f9 rilevante \u00e8 chiaro: la compliance GDPR non pu\u00f2 essere dimostrata soltanto attraverso l\u2019esistenza di policy e procedure, ma richiede d\u2019essere validata attraverso la capacit\u00e0 dell\u2019organizzazione di dimostrare che i rischi sono stati effettivamente identificati, valutati e governati.<\/p>","protected":false},"author":1,"featured_media":3307,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"categories":[20],"tags":[],"class_list":["post-3306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>GDPR sanzioni: linee guida EDPB 2026 compliance | PF Advisory<\/title>\n<meta name=\"description\" content=\"Analisi delle nuove Linee guida EDPB 04\/2026 sulle sanzioni GDPR: cosa cambia, quali gli impatti sulla compliance e cosa fare\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pfadvisory.it\/en\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GDPR sanzioni: linee guida EDPB 2026 compliance | PF Advisory\" \/>\n<meta property=\"og:description\" content=\"Analisi delle nuove Linee guida EDPB 04\/2026 sulle sanzioni GDPR: cosa cambia, quali gli impatti sulla compliance e cosa fare\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pfadvisory.it\/en\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"PF Advisory\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-01T16:05:54+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-01T16:05:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/10\/GUIDELINES042026.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"379\" \/>\n\t<meta property=\"og:image:height\" content=\"192\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"wp_19764851\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"wp_19764851\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/\"},\"author\":{\"name\":\"wp_19764851\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#\\\/schema\\\/person\\\/fb34cce26c0ad7d653104ef34f523146\"},\"headline\":\"GDPR sanzioni: linee guida EDPB 2026 compliance\",\"datePublished\":\"2026-10-01T16:05:54+00:00\",\"dateModified\":\"2026-10-01T16:05:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/\"},\"wordCount\":1135,\"publisher\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pfadvisory.it\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GUIDELINES042026.jpg\",\"articleSection\":[\"Data Protection\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/\",\"url\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/\",\"name\":\"GDPR sanzioni: linee guida EDPB 2026 compliance | PF Advisory\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pfadvisory.it\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GUIDELINES042026.jpg\",\"datePublished\":\"2026-10-01T16:05:54+00:00\",\"dateModified\":\"2026-10-01T16:05:55+00:00\",\"description\":\"Analisi delle nuove Linee guida EDPB 04\\\/2026 sulle sanzioni GDPR: cosa cambia, quali gli impatti sulla compliance e cosa fare\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.pfadvisory.it\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GUIDELINES042026.jpg\",\"contentUrl\":\"https:\\\/\\\/www.pfadvisory.it\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GUIDELINES042026.jpg\",\"width\":379,\"height\":192},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pfadvisory.it\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GDPR sanzioni: linee guida EDPB 2026 compliance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#website\",\"url\":\"https:\\\/\\\/www.pfadvisory.it\\\/\",\"name\":\"PF Advisory\",\"description\":\"Information security | Governance and Compliance\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#organization\"},\"alternateName\":\"pf advisory\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pfadvisory.it\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#organization\",\"name\":\"PF Advisory\",\"alternateName\":\"pf advisory\",\"url\":\"https:\\\/\\\/www.pfadvisory.it\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.pfadvisory.it\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/logo_normale2-scaled.png\",\"contentUrl\":\"https:\\\/\\\/www.pfadvisory.it\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/logo_normale2-scaled.png\",\"width\":2560,\"height\":290,\"caption\":\"PF Advisory\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/pfadvisory26\\\/?viewAsMember=true\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.pfadvisory.it\\\/#\\\/schema\\\/person\\\/fb34cce26c0ad7d653104ef34f523146\",\"name\":\"wp_19764851\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e2ba93f8e0de04f34e142d26e1655ca3851dc793989e5645727d1540b17d314c?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e2ba93f8e0de04f34e142d26e1655ca3851dc793989e5645727d1540b17d314c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e2ba93f8e0de04f34e142d26e1655ca3851dc793989e5645727d1540b17d314c?s=96&d=mm&r=g\",\"caption\":\"wp_19764851\"},\"sameAs\":[\"https:\\\/\\\/www.pfadvisory.it\"],\"url\":\"https:\\\/\\\/www.pfadvisory.it\\\/en\\\/author\\\/wp_19764851\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GDPR sanzioni: linee guida EDPB 2026 compliance | PF Advisory","description":"Analisi delle nuove Linee guida EDPB 04\/2026 sulle sanzioni GDPR: cosa cambia, quali gli impatti sulla compliance e cosa fare","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pfadvisory.it\/en\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/","og_locale":"en_GB","og_type":"article","og_title":"GDPR sanzioni: linee guida EDPB 2026 compliance | PF Advisory","og_description":"Analisi delle nuove Linee guida EDPB 04\/2026 sulle sanzioni GDPR: cosa cambia, quali gli impatti sulla compliance e cosa fare","og_url":"https:\/\/www.pfadvisory.it\/en\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/","og_site_name":"PF Advisory","article_published_time":"2026-10-01T16:05:54+00:00","article_modified_time":"2026-10-01T16:05:55+00:00","og_image":[{"width":379,"height":192,"url":"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/10\/GUIDELINES042026.jpg","type":"image\/jpeg"}],"author":"wp_19764851","twitter_card":"summary_large_image","twitter_misc":{"Written by":"wp_19764851","Estimated reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/#article","isPartOf":{"@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/"},"author":{"name":"wp_19764851","@id":"https:\/\/www.pfadvisory.it\/#\/schema\/person\/fb34cce26c0ad7d653104ef34f523146"},"headline":"GDPR sanzioni: linee guida EDPB 2026 compliance","datePublished":"2026-10-01T16:05:54+00:00","dateModified":"2026-10-01T16:05:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/"},"wordCount":1135,"publisher":{"@id":"https:\/\/www.pfadvisory.it\/#organization"},"image":{"@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/10\/GUIDELINES042026.jpg","articleSection":["Data Protection"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/","url":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/","name":"GDPR sanzioni: linee guida EDPB 2026 compliance | PF Advisory","isPartOf":{"@id":"https:\/\/www.pfadvisory.it\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/#primaryimage"},"image":{"@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/10\/GUIDELINES042026.jpg","datePublished":"2026-10-01T16:05:54+00:00","dateModified":"2026-10-01T16:05:55+00:00","description":"Analisi delle nuove Linee guida EDPB 04\/2026 sulle sanzioni GDPR: cosa cambia, quali gli impatti sulla compliance e cosa fare","breadcrumb":{"@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/#primaryimage","url":"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/10\/GUIDELINES042026.jpg","contentUrl":"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/10\/GUIDELINES042026.jpg","width":379,"height":192},{"@type":"BreadcrumbList","@id":"https:\/\/www.pfadvisory.it\/gdpr-sanzioni-linee-guida-edpb-2026-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pfadvisory.it\/"},{"@type":"ListItem","position":2,"name":"GDPR sanzioni: linee guida EDPB 2026 compliance"}]},{"@type":"WebSite","@id":"https:\/\/www.pfadvisory.it\/#website","url":"https:\/\/www.pfadvisory.it\/","name":"PF Advisory","description":"Information security | Governance and Compliance","publisher":{"@id":"https:\/\/www.pfadvisory.it\/#organization"},"alternateName":"pf advisory","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pfadvisory.it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.pfadvisory.it\/#organization","name":"PF Advisory","alternateName":"pf advisory","url":"https:\/\/www.pfadvisory.it\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.pfadvisory.it\/#\/schema\/logo\/image\/","url":"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/07\/logo_normale2-scaled.png","contentUrl":"https:\/\/www.pfadvisory.it\/wp-content\/uploads\/2026\/07\/logo_normale2-scaled.png","width":2560,"height":290,"caption":"PF Advisory"},"image":{"@id":"https:\/\/www.pfadvisory.it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/pfadvisory26\/?viewAsMember=true"]},{"@type":"Person","@id":"https:\/\/www.pfadvisory.it\/#\/schema\/person\/fb34cce26c0ad7d653104ef34f523146","name":"wp_19764851","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/e2ba93f8e0de04f34e142d26e1655ca3851dc793989e5645727d1540b17d314c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e2ba93f8e0de04f34e142d26e1655ca3851dc793989e5645727d1540b17d314c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e2ba93f8e0de04f34e142d26e1655ca3851dc793989e5645727d1540b17d314c?s=96&d=mm&r=g","caption":"wp_19764851"},"sameAs":["https:\/\/www.pfadvisory.it"],"url":"https:\/\/www.pfadvisory.it\/en\/author\/wp_19764851\/"}]}},"_links":{"self":[{"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/posts\/3306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/comments?post=3306"}],"version-history":[{"count":4,"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/posts\/3306\/revisions"}],"predecessor-version":[{"id":3311,"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/posts\/3306\/revisions\/3311"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/media\/3307"}],"wp:attachment":[{"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/media?parent=3306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/categories?post=3306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pfadvisory.it\/en\/wp-json\/wp\/v2\/tags?post=3306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}