Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR

On 17 September 2026 the EDPB adopted version 1.0 of Guidelines 04/2026, for public consultation, on how supervisory authorities decide whether to impose an administrative fine under the GDPR, in addition to or instead of the other corrective measures under Article 58(2) GDPR. The guidelines set out a five-step methodology, give an overview of corrective measures such as warnings, reprimands, orders, limitations including bans, and withdrawal of certification, and include 14 practical examples; they replace the WP29 guidelines on administrative fines. The guidelines are open for public consultation until 13 November 2026.