EDPB’s new test: when a GDPR breach gets a fine, not a reprimand

What the EDPB adopted

On 17 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR, announced on 21 September. The guidelines tell national supervisory authorities how to decide whether an infringement should be fined at all, as opposed to met with a reprimand, warning or order. Their central rule is short: if an infringement is minor, the authority will as a general rule not fine; if it is not minor, “there is a strong presumption to impose an administrative fine” (paragraph 57). The text is open for public consultation until 13 November 2026.

The guidelines replace the Article 29 Working Party’s guidelines on administrative fines (WP253) and sit alongside the EDPB’s Guidelines 04/2022, which deal with how a fine is calculated. The new text deals with the earlier question of whether one is imposed.

The five-step test for imposing a GDPR fine

The first three steps are legal preconditions. The authority checks that the infringement can lead to a fine under the GDPR or national law, that the party under investigation is the one bound by the breached provision, and that the infringement was intentional or negligent, since culpability is a condition for a fine.

The fourth step is where the judgment lies. The authority weighs the aggravating and mitigating factors in Article 83(2)(a) to (k) GDPR to decide whether the infringement is minor in the sense of Recital 148. As an example of what that can mean, the guidelines point to an infringement that, on the facts, does not pose a significant risk to the rights of the data subjects and does not affect the essence of the obligation in question. The fifth step asks whether a fine would be effective, proportionate and dissuasive in the individual case, which is where an authority may depart from the general rule in either direction.

Negligence is easy to establish

This matters for anyone who has relied on a vendor default or an optimistic reading of the law. The guidelines say that where EDPB guidelines exist on a point, an error is “always to be considered avoidable and therefore at least negligent” (paragraph 50). And the examples reject the defences that a company was unaware of the obligation, or held a legal opinion contradicting the majority view or the supervisory authority’s known position. Intent to break the law is not required; the decisive question is whether the controller had the opportunity to become aware of the obligation.

On data categories, the guidelines say the more sensitive the data, the more likely an infringement is not minor (paragraph 92). Beyond the special categories in Articles 9 and 10, they name location data, private communications, national identification numbers and financial data.

The tracking pixel example

Example 7 is the one marketing and engineering teams should read. A supervisory authority found that an SME offering a business video conferencing service had infringed Article 32(1) GDPR by running a social media provider’s tracking pixel on a webpage for the service without appropriate technical and organisational measures. Over two years, hashed email addresses and phone numbers of about 50,000 users went to the social media provider, because a function activated in the provider’s developer tool took precedence over the data protection settings configured in the SME’s own customer data platform. The SME only learned of it from a third party’s report, and the authority noted it lacked the systematic procedures needed to catch such unintended changes.

The authority treated this as minor and issued a reprimand. The reasons it gave are the point: the data was hashed, it included no special category data or information about the meetings themselves, other measures limited what was collected, and there was no uncontrolled public disclosure. Change those facts, for example a pixel on pages that reveal health conditions or financial products, and under paragraph 92 the infringement becomes less likely to be treated as minor, with a non-minor infringement carrying the presumption of a fine. Examples 5 and 10 add a second route: infringements first treated as minor led to fines once further similar complaints or identical cases showed a recurring pattern.

What this does and does not cover

The guidelines interpret Articles 58(2) and 83 GDPR. Storing or reading information on a user’s device, the cookie rule, comes from Article 5(3) of the ePrivacy Directive (2002/58/EC) as transposed in each member state, and the guidelines do not set a method for sanctions under those national laws. What they do govern is the GDPR side of the same tag: the lawfulness, transparency and security of the personal data a pixel or SDK sends onward, which is exactly where Example 7 sits.

At the same plenary the EDPB also adopted the final version of its Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR, following public consultation.

What to do now

Keep an inventory of every pixel, SDK and third-party script on your properties, and recheck it on a schedule rather than at launch only. Example 7’s controller lacked exactly that kind of systematic check, and the facts that kept it to a reprimand will not hold for every site. Review the data-sharing functions inside each ad platform’s own developer tools, not only in your tag manager or consent tool, since a function there overrode the SME’s configuration. Treat pages that touch health, finance or location as a separate risk tier with tighter tag rules. And if an authority has already reprimanded you on a point, expect a repeat to be treated far less leniently. For how regulators outside the EU have handled pixels on sensitive pages, see the OAIC’s tracking pixel determinations.

Organisations that want to comment on the methodology can respond to the EDPB consultation until 13 November 2026.

Sources

• EDPB press release, 21 September 2026: EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines edpb.europa.eu
• EDPB: Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR, version 1.0 edpb.europa.eu
• Directive 2002/58/EC (ePrivacy Directive), Article 5(3): EUR-Lex eur-lex.europa.eu
• EDPB: Guidelines 3/2025 on the interplay between the DSA and the GDPR, version 2 edpb.europa.eu