EDPB Releases New Guidelines on GDPR Fines and DSA Intersection

The European Data Protection Board (EDPB) has introduced a new five-step methodology for calculating administrative fines, aiming to standardize how supervisory authorities across the European Union penalize GDPR violations. The methodology requires regulators to confirm legal preconditions, evaluate factors under Article 83(2) of the GDPR, and assess whether a proposed fine remains effective, proportionate, and dissuasive in each specific case.

Harmonizing EU Fining Practices

The EDPB released the new guidelines on September 17, 2026, to ensure consistency in how authorities impose administrative fines, either alone or alongside other corrective measures. The guidelines include 14 practical examples to assist authorities in applying the methodology. These standards are currently subject to public consultation until November 13, 2026, and the EDPB has committed to regular reviews of the process.

Defining the Interplay Between DSA and GDPR

Alongside the fining framework, the EDPB finalized its guidance regarding the intersection of the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR). The document provides clarity for intermediary service providers on processing personal data to meet DSA requirements. For instance, the guidelines establish that compliance with legal obligations or legitimate interests may serve as a lawful basis for detecting and removing illegal content. Regarding the protection of minors, the guidance notes that Articles 28(1) and (2) of the DSA may qualify as a legal basis for processing under Article 6(1)(c) of the GDPR, provided the actions are necessary and proportionate. The EDPB explicitly advises providers against using age assurance mechanisms that allow for the unambiguous identification of users.

Enforcing Data Protection in France and Germany

On September 9, 2026, the French data protection authority, CNIL, issued a 300,000-euro sanction against an IT consulting firm for failing to handle requests regarding the right to erasure. Investigations revealed that the company failed to address more than three-quarters of the 265 requests it received. Separately, CNIL fined a hospital 500,000 euros on September 3, 2026, following a 2025 data breach that exposed the information of over 524,000 patients and 200,000 trusted third parties.

Additionally, the German Federal Court of Justice (BGH) referred questions to the CJEU on September 17, 2026, to clarify the scope of the GDPR’s “household exception,” which exempts purely personal data processing from the regulation’s requirements. These cases involve the forwarding of private chat messages and the use of home video surveillance.

Supervising Artificial Intelligence and Cloud Computing

The Berlin Group, led by the German Federal Commissioner for Data Protection and Freedom of Information (BfDI), published recommendations on September 30, 2026, supporting the use of confidential computing in cloud environments to bolster security.