The European Data Protection Board (EDPB) has adopted guidelines on imposing administrative fines as well as the final version of its guidance on the interaction between the Digital Services Act (DSA) and the GDPR.

The new EDPB guidelines aim to harmonize how data protection authorities (DPAs) decide to impose a fine, alone or combined with other measures. They establish a five-step methodology for DPAs: verify if the infringement is subject to a fine, determine the responsible party, assess intentional or negligent character, analyze aggravating or mitigating factors, and ensure the sanction is effective, proportionate, and dissuasive. These guidelines, which replace the Article 29 Working Party's and complement those on calculating fine amounts, also cover other corrective measures such as warnings or injunctions and are subject to a public consultation until 13 November 2026.

The EDPB also adopted the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR, following a public consultation. These guidelines aim to ensure consistent application of both texts, especially when DSA provisions concern the processing of personal data by intermediary service providers. The document will be published after a final linguistic check.