EDPB adopts harmonised fining methodology and final DSA-GDPR guidelines

Original title: EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines

The European Data Protection Board has adopted guidelines establishing a harmonised five-step methodology for Data Protection Authorities to use when deciding whether to impose administrative fines under the GDPR. The methodology ensures consistent application of fining decisions across Europe by requiring DPAs to assess legal basis, liability, culpability, aggravating and mitigating factors, and proportionality of any fine. Additionally, the EDPB has finalised its guidelines on how the Digital Services Act and GDPR interact. These guidelines strengthen enforcement consistency and provide greater clarity for data protection authorities across Member States when exercising their corrective powers.

What changed

• EDPB introduces a mandatory five-step methodology for fining decisions: (1) checking if infringement can lead to a fine under GDPR or national law, (2) determining who may be fined (controller or processor), (3) assessing whether infringement was intentional or negligent, (4) evaluating aggravating and mitigating factors, and (5) assessing effectiveness, proportionality and dissuasiveness of the fine.
• DPAs must apply stronger presumption that fines should be imposed when infringements are not minor; reprimands may be issued only for minor infringements.
• EDPB finalises guidelines on the interplay between the Digital Services Act (DSA) and GDPR, clarifying how both regulations apply in parallel.
• Guidelines provide overview of corrective powers available to national DPAs and explain their purpose and coordination with fining decisions.

What the document requires

The EDPB guidelines establish a mandatory five-step methodology for Data Protection Authorities to follow when deciding whether to impose administrative fines under the GDPR.

Who is affected

Data Protection Authorities in all EU Member States and organisations subject to GDPR, including controllers and processors across all sectors and sizes operating in the EU.

Summary generated by a language model; the official text prevails. Not legal advice.