The European Data Protection Board (EDPB) published Guidelines 04/2026 on administrative fines in September 2026, marking a significant change in how supervisory authorities should use their enforcement tools. These guidelines clarify when fines should accompany other corrective measures under GDPR Article 58, addressing years of inconsistent application across member states.
For Data Protection Officers (DPOs), this changes your risk assessment. The question shifts from "will we be fined?" to "what combination of enforcement actions will we face, and in what order?"
What Changed
Guidelines 04/2026 clarify the relationship between fines and other corrective powers. Previously, some authorities treated fines as standalone remedies, while others used them sparingly with compliance orders. The guidelines now provide a framework for when authorities should combine penalties with injunctions, data processing bans, or certification withdrawals.
This change aligns with Binding Decision 1/2026, issued in May 2026, which resolved a dispute between the Belgian SA and other authorities concerning VRT (Vlaamse Radio-en Televisieomroeporganisatie). That decision, under Article 65 GDPR's dispute resolution mechanism, shows how cross-border cooperation influences enforcement outcomes. When authorities disagree on remedies, the EDPB's binding decisions set precedents that shape future fine calculations and corrective measure combinations.
Key Findings
Fines are no longer the primary deterrent. The guidelines position administrative fines as part of a broader enforcement response. Authorities must now justify why a fine alone is insufficient or why additional corrective measures are necessary. This shifts the focus from "how much will this cost?" to "what operational changes will we need to implement?"
Cooperation failures trigger compounded enforcement. The VRT binding decision shows how procedural disputes between authorities can escalate remedies. If a lead authority and concerned authorities can't agree on measures, the EDPB steps in with binding decisions that often result in more severe combined actions. Your cooperation with your lead supervisory authority during cross-border investigations now directly affects the enforcement package you'll face.
Temporal sequencing matters. The guidelines distinguish between concurrent corrective measures (issued with a fine) and sequential measures (where authorities can impose additional remedies if initial compliance isn't achieved). This creates a compliance timeline where your response to the first corrective measure determines whether you'll face escalating enforcement actions.
Sector-specific patterns are emerging. While the source documents don't provide insurance-sector specifics, the October 2020 study on Big Data applications in European insurance shows the EDPB's focus on automated decision-making and profiling in regulated industries. Expect enforcement patterns to reflect sector-specific risk profiles, especially where processing involves financial matters or algorithmic decision-making.
Documentation of proportionality is now mandatory. Authorities must demonstrate why the chosen combination of corrective measures is proportionate to the infringement. Your response to enforcement should directly challenge the proportionality assessment, not just the underlying violation finding.
What This Means for Your Team
You're now managing multi-dimensional enforcement risk. A single GDPR violation can trigger a fine, an order to cease processing, mandatory audits, and required implementation of technical measures. Your incident response plan needs to account for layered remedies, not just financial penalties.
Cross-border processing creates compounded exposure. If your organization operates across multiple member states, procedural disputes between your lead authority and concerned authorities can result in EDPB binding decisions that impose stricter remedies than any single authority would have chosen. Map your data flows to identify which supervisory authorities have jurisdiction, and monitor their historical cooperation in similar cases.
Your compliance timeline just compressed. Sequential enforcement means you can't treat the first corrective measure as the final word. If you don't demonstrate swift, complete remediation after an initial order, expect follow-on measures that restrict your processing activities more severely. Build response protocols that assume escalation, not resolution.
Action Items by Priority
Immediate (next 30 days): Audit your current GDPR violations and near-misses. For each one, map the full range of corrective powers under Article 58(2) that could apply, not just potential fine amounts. Identify which violations could trigger processing bans or certification withdrawals, as these operational impacts often exceed financial penalties.
Review your cross-border processing arrangements. Document which supervisory authority serves as your lead authority for each processing activity. If you've had previous enforcement contact, analyze whether cooperation between authorities was smooth or contentious, as this predicts future enforcement complexity.
Short-term (next 90 days): Update your incident response procedures to address layered enforcement. Your protocol should specify who approves operational changes required by compliance orders, how quickly you can implement technical measures mandated by authorities, and how you'll demonstrate remediation to avoid sequential penalties.
Build proportionality arguments into your compliance documentation. When you implement data protection measures, document why they're proportionate to the processing risks. This creates a defensible record if authorities later question whether additional corrective measures are warranted.
Ongoing: Monitor EDPB binding decisions for patterns in how disputes between authorities get resolved. These decisions reveal which enforcement combinations the Board considers appropriate for specific violation types. Use this intelligence to forecast your enforcement exposure for current processing activities.
Track how your lead supervisory authority applies these guidelines in published enforcement actions. Some authorities will interpret the guidance conservatively, while others will use it to justify more aggressive remedy combinations. Understanding your authority's enforcement philosophy helps you calibrate your compliance investments.
Establish direct communication channels with your lead supervisory authority before you need them. When cooperation between authorities determines enforcement outcomes, your relationship with your lead authority becomes a strategic asset, not just a regulatory obligation.
