European Data Protection Board publishes guidelines on GDPR fines for public consultation

What happened

• The European Data Protection Board adopted Guidelines 04/2026 on 17 September 2026.
• The guidelines clarify how supervisory authorities may combine fines with measures such as orders to erase data or suspend processing.
• Stakeholders can submit comments during the consultation period.

Why it matters

Supervisory authorities will have clearer criteria for scaling fines with additional corrective actions, prompting organisations to reassess risk‑mitigation and remediation strategies.

Business impact

Companies may need to adjust their GDPR compliance programs to address not only monetary penalties but also the likelihood of concurrent corrective orders, affecting incident response planning and budgeting.

What to check

1. 1

   reviewHigh priority

   Assess current GDPR remediation procedures to ensure they address both fines and corrective measures outlined in the new guidelines.

2. 2

   monitorMedium priority

   Track the public consultation outcome for any refinements that could affect enforcement practices.