Guidance announcement, not a new fine or a change to the statutory maximum.
What happened
On 21 September 2026, the European Data Protection Board announced guidelines on using administrative fines alongside other corrective powers. Its five-stage approach considers the legal basis for a fine, the responsible party, the infringement, the circumstances and whether a fine would be effective, proportionate and dissuasive. These guidelines complement the separate guidance on calculating amounts.
Source: EDPB — original source ↗
What it means for your website
A headline maximum is not a price list for mistakes. A missing setting, a deliberate tracking practice and a major security failure are not interchangeable events. For your business, the priority is to understand the issue, stop inappropriate processing and keep evidence of the correction. Record who investigated, what changed and what the retest showed. That record is useful operationally; it is not a promise that a regulator will reduce a penalty. Avoid tools that convert every scanner warning into a predicted fine. An automated observation rarely captures all the facts needed for an enforcement decision.
Three useful next steps
- Separate confirmed problems from uncertain findings.
- Prioritise fixes by the affected data and actual behaviour.
- Keep dated evidence of corrective work.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
EDPB — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.