News · European Data Protection Board EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines

Brussels, 21 September – During its latest plenary, the EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR and the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR.The new EDPB guidelines are a major step in further aligning how Data Protection Authorities decide whether an administrative fine should be imposed, either on its own or alongside other cor

Supervision Fines Supervisory Authorities Risk Management System Authority Powers for Fundamental Rights Protection
Sep 21, 2026 Source edpb.europa.eu

How it connects

Related across sources

C-768/21 TR v Land Hessen In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of… CJEU ·First Chamber Sep 26, 2024 Supervision Data Breaches Supervisory Authorities
2016 IEHC 323 High Court examines DPA inquiry into Meta's refusal of raw data access and portability On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (MPIL) (then Facebook Ireland Limited), the… Aug 21, 2026 Data Portability Supervisory Authorities Personal Data
C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin C-807/21 (Deutsche Wohnen) CJEU Dec 5, 2023 Fines Certification Administrative Fines on Union Institutions, Bodies, Offices and Agencies
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-383/23 Criminal proceedings against ILVA A/S The Court of Justice of the European Union ruled on a preliminary reference from the Danish High Court in criminal proceedings against ILVA A/S, addressing whether the GDPR… CJEU ·Fifth Chamber Feb 13, 2025 Fines Personal Data Processing
C-458/25 CJEU · C-458/25 The Advocate General opined that Article 83(7) GDPR precludes exempting a private-law entity providing publicly subsidised education from administrative fines merely because it… Sep 21, 2026 Data Minimization Child Consent GDPR Article 5 Principles of Processing

Full text

Brussels, 21 September – During its latest plenary, the EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR and the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR.The new EDPB guidelines are a major step in further aligning how Data Protection Authorities decide whether an administrative fine should be imposed, either on its own or alongside other corrective measures.The GDPR significantly increased the corrective powers of DPAs, with fines serving as an important instrument for effective enforcement. The guidelines reaffirm our commitment to providing greater clarity and ensuring the consistent application of the GDPR across Europe.EDPB Deputy Chair, Jelena Virant BurnikData Protection Authorities (DPAs) should follow a five-step methodology when deciding whether to impose an administrative fine:the DPA checks if the infringement can lead t

Related documents