Guidelines 04/2026, open for comment until 13 November, turn Article 83(2) GDPR into five steps in which a 'minor' infringement generally ends without a fine and anything else carries a strong presumption of one. Most of what tips the balance is settled before the complaint arrives.
Guidelines 04/2026, open for comment until 13 November, turn Article 83(2) GDPR into five steps in which a 'minor' infringement generally ends without a fine and anything else carries a strong presumption of one. Most of what tips the balance is settled before the complaint arrives.
Among the fourteen worked examples in the European Data Protection Board's new guidelines on fines is a one-person company that ignores access requests. It doesn't know that Article 15 GDPR obliges it to answer, and when the supervisory authority announces a fine, the owner argues that the business works in a completely different field and never meant to break any law. The Board's verdict is two sentences long:
"The intention to violate the law is not necessary for the existence of negligence. The only decisive factor is whether the controller had the opportunity to become aware of the obligation, which is the case here."
That example sets the tone for a document that describes, step by step, how a supervisory authority decides whether an infringement ends in a fine, a reprimand, or nothing at all. Read from the controller's side, it is also a fairly precise list of which facts count, which don't, and when those facts have to exist.
The document is Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR. Its version history has one line: "version 1.0 17 September 2026 adoption of the guidelines for public consultation". The EDPB announced it after its 21 September plenary, and the text is "subject to public consultation until 13 November 2026". It is a draft, and what follows describes the draft.
Paragraph 8 of the guidelines says they "replace the WP29 Guidelines, complement the Calculation Guidelines and can be referred to as the 'Imposition Guidelines'". The WP29 text is WP253, which the EDPB had endorsed; the Calculation Guidelines (04/2022) cover how large a fine should be. The new document sits upstream of the calculation: it answers whether there should be a fine at all.
The audience is stated in paragraph 1: the guidelines "are intended for use by supervisory authorities". Paragraph 11 adds that the examples are "imaginary cases" that "cannot be considered precedents". For a controller, that makes the document a description of how the other side reasons, which is often the more useful thing to have.
Paragraph 9 lays out the method as five questions:
The first three are legal preconditions. The last two are the decision, and the fourth carries almost all of the weight. The word "minor" comes from Recital 148 GDPR: "In a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine." The guidelines turn that permission into a rule of thumb with a strong default on each side. Paragraph 57:
"As mentioned, if the infringement is considered minor, as a general rule, the supervisory authority will not impose an administrative fine. Conversely, if the infringement is not considered minor, there is a strong presumption to impose an administrative fine."
Step 5 lets an authority depart from either default, and the examples show it doing so in both directions. Still, once an infringement is established, the practical question for the controller is which side of the minor line it lands on, and that is decided by the eleven factors in Article 83(2), points (a) to (k).
At step 1, paragraph 38 notes that the list of fineable provisions in Article 83(4) to (6) "notably does not include Article 10 or Article 24 GDPR", and then closes the gap: because Article 24 expresses the accountability principle, "an infringement of Article 24 GDPR may amount to an infringement of Article 5(2) GDPR", which is in the higher fine tier.
Step 3 looks like a place where a case might stop. It rarely will. Paragraph 49 sets the test:
"The decisive factor is whether the addressee of a provision was in a position to know that their conduct was unlawful, not whether they actually recognised this."
The same paragraph quotes Advocate General Emiliou: "the threshold for the element of negligence is so low that it is difficult to envisage situations where the element is not satisfied." Paragraph 50 then removes most of what is left. Good faith "can only be invoked in very exceptional circumstances", and the paragraph ends on the sentence with the widest reach:
"However, where EDPB Guidelines exist, an error is always to be considered avoidable and therefore at least negligent."
Published guidance on a question is, on this reading, proof that the answer was knowable. Paragraph 41 closes another door: "The fact that employees did not comply with instructions or a code of conduct is not necessarily sufficient to disrupt this liability."
Legal advice gets the same treatment. In Example 4c, a company that did not give all the information Article 13(1) requires says external counsel told it the information was compliant. "When requested by the supervisory authority the company is unable to provide the documentation regarding the alleged consultation and its content", and so the argument "cannot have any exculpatory effect". The Board adds that "Even if documentation had been available, external advice must not be blindly trusted." Advice that nobody can produce counts for nothing, and even documented advice is only one part of the picture.
Step 4 is where the controller's own conduct enters. Sort what the guidelines say about the Article 83(2) factors a controller can influence, and three piles appear.
Counts in the controller's favor, with conditions:
Neutral are the notifications the law already required. Where the controller is subject to a specific notification obligation, "such as in the case of personal data breaches pursuant to Article 33 GDPR", paragraph 95 says the notification "should be considered as neutral". So, as a rule, is an infringement that surfaced through a complaint or an investigation (paragraph 96).
Counting for nothing are a clean record and ordinary cooperation. Paragraph 88: "The mere absence of previous infringements by the controller or processor cannot, in itself, be considered a mitigating factor, as compliance with the GDPR is the norm." Article 31 already obliges controllers and processors to "cooperate, on request, with the supervisory authority", and paragraph 90 draws the consequence: "The GDPR does not provide discretion to consider mere cooperation as a mitigating factor, as this is already required."
Running through the first pile is a condition about proof. Paragraph 78 says the authority "should take into account any relevant documentation provided by the controller or processor", and names what that documentation could show: "evidence of when the measures were taken and how they were implemented, whether there were interactions between the controller and the processor (if applicable), or whether there has been contact with the Data Protection Officer or data subjects (if applicable)." The mitigating factors depend on when, and the only thing that can establish when, months later and in front of an authority, is a dated record made at the time.
Three of the fourteen examples are explicitly about SMEs, and several more involve small organizations or a single human error. Read side by side, the ones that end without a fine and the ones that end with one separate cleanly.
In Example 12, an SME ran a one-time raffle and did not update its transparency statement. A data subject complained. "Before the supervisory authority initiated an investigation, the SME amended its transparency statement". The infringement was minor, and the authority found that exercising any corrective power at all would not be proportionate.
In Example 13, an employee attached a copy of a data subject's driver's license to an email sent to a limited number of other data subjects. The controller notified the authority and the data subject "without delay", reimbursed the cost of replacing the document, and, "Without waiting for the supervisory authority's decision", hired a third party to re-evaluate its measures, then adopted more of them. The authority again found a minor infringement and took no corrective measure.
In Example 7, an SME's tracking pixel sent hashed contact details of "approximately 50,000 users" to a social media provider "over a two-year period", because a function activated in the provider's developer tool "took precedence over the data protection settings the organisation had configured". The authority noted that the SME "lacked the systematic procedures required to identify such unintentional changes"; a third party had reported it. The data was hashed and not sensitive, so the infringement was still minor, but this time there was a reprimand.
Examples 5 and 10 show the other direction. A recruitment agency with an internal erasure policy got a reprimand after two complaints; three more complaints followed, the procedure for removal requests "led to human errors in too many cases", and the agency was fined. A small telecoms company got a reprimand for answering a request a month late; the authority then found more identical cases, concluded that the delay was "a fundamental problem or pattern", and opened fine proceedings.
What separates the outcomes is whether the controller noticed and fixed the problem on its own, whether it could show that it had, and whether the same thing happened again. Paragraph 70 adds duration to the list: "The longer the duration of the infringement, the more likely it is that the infringement is not considered as minor". A two-year leak that nobody inside the company detected was always going to sit closer to the line than a raffle notice corrected before the authority opened an investigation.
None of this changes what the GDPR requires; the guidelines describe how authorities intend to weigh what has already gone wrong, and the final text may differ from version 1.0 after the consultation. What they do offer is an unusually concrete account of the questions they direct an authority to weigh once a complaint lands: when you found out, what you did and when, whether you can show it, and whether it had happened before. Each of those questions can only be answered from records that existed before anyone asked. If you want to comment on the draft, the EDPB's consultation runs until 13 November 2026. For your own situation, qualified counsel is the right reader of the full text.
devguard keeps the incident register and the dated, versioned records that questions like these are answered from: devguard.ch/platform.
Angelo runs strategy and the relationships behind devguard. He spends his time with the teams who live with compliance day to day, and keeps what we build tied to what they actually need.
Start free, bring your frameworks, and keep the evidence attached as the work ships. No setup friction, no audit-week fire drill.
Start free, bring your frameworks, and keep the evidence attached as the work ships. No setup friction, no audit-week fire drill.