EDPB harmonizes GDPR fines: a unified EU methodology

On 21 September 2026, the European Data Protection Board (EDPB) adopted guidelines harmonizing how GDPR fines are decided, either alone or combined with other corrective measures. For companies in Luxembourg, the methodology becomes more predictable—yet enforcement will be stricter.

Key facts

• Who: the EDPB.
• What: adoption of guidelines on the application of GDPR administrative fines and publication of the final DSA–GDPR guidelines.
• Where: Brussels (EDPB plenary).
• When: 21 September 2026.
• How much: no single amount—this is about aligning the method to decide whether to impose a fine and, if so, its level, alongside other measures (orders, limitations, etc.). The EDPB sets out a five‑step approach, now a reference for national authorities, including Luxembourg’s CNPD.

Legal basis and background

• GDPR: Articles 58(2) and 83 GDPR (corrective powers, seriousness criteria, cap of €20m or 4% of global turnover). The EDPB clarifies when to impose a fine alone or in addition to other measures to ensure effectiveness and proportionality.
• Cooperation and consistency (Chapter VII GDPR): towards a more uniform application across authorities (including the CNPD), informed by prior practice on calculation and reasoning of fines.
• Case‑law context: the common methodology strengthens reasoning and proportionality, reduces cross‑border disparities, and makes decisions more defensible on appeal.

What changes for Luxembourg companies

• Increased predictability: with a common “grid,” the CNPD will follow a clear sequence (qualification, seriousness, aggravating/mitigating factors, deterrence, interplay with orders). For multi‑country groups, exposure to fines should vary less at comparable gravity. See our overview of GDPR compliance with CNPD in Luxembourg.
• Fewer cases without fines: the EDPB frames when a fine should be added to other measures (serious or persistent infringements, lack of cooperation, failure to uphold data subject rights), increasing the likelihood of monetary sanctions even when remediation is ordered.
• One‑stop‑shop and CNPD: for Luxembourg‑established companies acting as lead under Article 56 GDPR, the CNPD will apply this framework in cross‑border cases. Robust documentation of risks, measures (Arts. 24, 25, 32), DPIAs (Art. 35), and rights handling (Arts. 12–22) becomes decisive to mitigate seriousness and amount. A certified DPO mandate helps maintain continuous evidence of compliance.

Immediate actions to take this week

• Map your "fine exposures": for each risky processing (sensitive data, profiling, marketing, cookies, transfers), verify evidence of compliance and Article 83 criteria (seriousness, duration, scope, cooperation, history)—and close evidence gaps.
• Revise your corrective‑measures strategy: prepare execution plans (timelines, owners, metrics) for potential CNPD orders, and document why an order alone may suffice or, failing that, why a reduced amount would be proportionate.
• Update GDPR playbooks: data subject rights (SLAs, deadline tracking, proof of response), breach management (detection, logs, Arts. 33–34 notifications), transfers governance and legal bases. Add a structured “EDPB arguments” section for observations and appeals.

Go further

• Strengthen governance with a DPO Luxembourg engagement to coordinate with the CNPD and maintain ongoing compliance.

Article generated by Luxgap regulatory watch. For tailored guidance on this topic, contact us.