Skip to content
LegalTech Lab LawTechnologyBusiness

Blog

When a GDPR breach earns a reprimand instead of a fine

A supervisory authority, the national regulator that enforces the General Data Protection Regulation, has more than one answer available when it finds a breach. Article 58(2) GDPR gives it warnings, reprimands, orders, limitations including bans, the withdrawal of certification, and administrative fines. On 17 September 2026 the European Data Protection Board (EDPB) adopted Guidelines 04/2026, which set out how an authority should choose between them. The Board announced the text from Brussels on 21 September 2026.

The guidelines answer a question that comes before the size of any fine. The Board’s earlier Guidelines 04/2022, the Calculation Guidelines, govern the amount. The new text, which the Board calls the Imposition Guidelines, governs whether a fine belongs in the case at all. It replaces the Article 29 Working Party guidelines on the application and setting of administrative fines, known as WP253, which the EDPB had endorsed.

Three questions before any fine

Steps one to three are legal preconditions. First, the authority checks that the infringement can lead to a fine, finding support either in the GDPR itself or in national law. Second, it checks that the party under investigation can be fined for that infringement. Liability depends on who is bound by the provision in breach, the controller or the processor. Third, it asks whether the infringement was intentional or negligent, because a culpable infringement is a condition for imposing a fine. The EDPB treats culpability as an unwritten condition, deduced from Article 83(2)(b) and Article 83(3) GDPR. It supports that reading with the Court of Justice judgments in Deutsche Wohnen (C-807/21) and Nacionalinis visuomenes sveikatos centras (C-683/21).

Minor or not minor

The fourth step uses the aggravating and mitigating factors in Article 83(2)(a) to (k) GDPR to ask whether the infringement is minor. Recital 148 GDPR allows a reprimand, a corrective measure short of a fine, to be issued instead in a minor case. Where the infringement is minor, the general rule is that no fine follows. Where it is not minor, the guidelines state a strong presumption that a fine should be imposed. The fifth step then asks whether a fine would be effective, proportionate and dissuasive, as Article 83(1) GDPR requires. An authority may depart from the general practice on the facts of a case, and it need not work through a step that does not apply.

Warnings stand apart

One distinction matters in daily practice. A warning under Article 58(2)(a) GDPR works before the event, because it addresses intended processing that is likely to infringe. No infringement has yet occurred, so a fine cannot be added to a warning for the same conduct. A reprimand under Article 58(2)(b) GDPR answers processing that has already infringed, and the guidelines note that the GDPR does not in principle exclude combining a reprimand with a fine.

What comes next

Fourteen worked examples show the method in use. In one, a small or medium-sized enterprise that never answered a request for access, in breach of Articles 12(3) and 15 GDPR, receives a reprimand. In another, a tracking pixel passed hashed contact details of roughly 50,000 users to a social media provider over two years. That security failure under Article 32(1) GDPR is also treated as minor. EDPB Deputy Chair Jelena Virant Burnik called the text “a major step in further aligning how Data Protection Authorities decide whether an administrative fine should be imposed”. The wording may still change, because the guidelines are open to public consultation until 13 November 2026. At the same plenary the Board adopted the final version of Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR. Those guidelines matter where duties under that Act involve the processing of personal data by intermediary service providers.

Sources