Guideline
Guidelines 04/2026 on when a supervisory authority imposes a GDPR fine
- Date
- Status
- under consultation
- Body
- European Data Protection Board (EDPB)
- Reference
- Guidelines 04/2026, versie 1.0 voor publieke consultatie (reacties tot 13 november 2026)
What it is about
Adopted on 17 September 2026 as a version for public consultation. The guidelines complement the calculation of fines (Guidelines 04/2022) and give five steps for whether a fine follows: can the infringement be fined, can this party be fined, is there intent or negligence, is the infringement minor under the factors of Art. 83(2), and is a fine effective, proportionate and dissuasive. For a minor infringement there is as a rule no fine; otherwise there is a strong presumption that one follows.
What this means in practice
An error without intent or negligence cannot lead to a fine, but outside minor infringements this version means you should expect a fine. So record which choices you made and why. This is not yet the final text. Comments can be submitted until 13 November 2026.
The GDPR articles concerned
Source: EDPB, Guidelines 04/2026 (consultatieversie)checked on 5 November 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Themes where this returns
The counterpart in the other law
Case law
- Deutsche Wohnen: a fine on a legal person needs no identified natural person, but does require fault
2023-12-05 · final, Hof van Justitie van de EU (Grote kamer), Deutsche Wohnen SE tegen Staatsanwaltschaft Berlin
- Land Hessen: the supervisory authority need not always fine where the organisation already remedied the breach
2024-09-26 · final, Hof van Justitie van de EU (Eerste kamer), TR tegen Land Hessen
- Reddit's summary proceedings against the DPA over a penalty order and legal privilege dismissed
2026-03-04 · status not established, Rechtbank Den Haag, voorzieningenrechter
- Council of State: DPA could fine DPG Media for routinely demanding ID copies, fine halved to 262,500 euros
2025-09-24 · final, Raad van State, Afdeling bestuursrechtspraak
- Council of State upholds 6,000 euro DPA fine for recruitment firm
2024-05-29 · final, Raad van State, Afdeling bestuursrechtspraak
- Interim judge suspends DPA penalty order against Northwave: exhaust powers against the hosting provider first
2024-03-26 · final, Rechtbank Midden-Nederland, voorzieningenrechter (zittingsplaats Utrecht)
- Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems
Guidelines
- Dutch DPA publishes its final enforcement policy
2026-10-30 · final, Autoriteit Persoonsgegevens
- Consultation on the Dutch DPA's enforcement policy (April 2026)
2026-04-13 · under consultation, Autoriteit Persoonsgegevens
Enforcement and fines
- DPA cuts Kruidvat fine to 50,000 euros on objection
2025-05-27 · status not established, Autoriteit Persoonsgegevens
- Ten municipalities fined a total of 250,000 euros for unlawful files on Muslim residents
2026-02-03 · final, Autoriteit Persoonsgegevens
- Coolblue fined 40,000 euros on objection for cookies without consent
2024-12-23 · status not established, Autoriteit Persoonsgegevens
- Formal warning to the Dutch Minister of Education, Culture and Science not to put the CABR war archive online and searchable
2024-11-26 · final, Autoriteit Persoonsgegevens
Legislation in motion
- Amendment to the Dutch GDPR Implementation Act: DPA must publish GDPR sanctions from 1 September 2026
2026-09-01 · in force, Wetgever (Tweede Kamer) en Autoriteit Persoonsgegevens