EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)
The new EDPB guidance clarifies how authorities should levy fines and align DSA obligations with GDPR rules, impacting controllers, processors and digital platforms across the EU.
ADTP Regulatory Watch· September 23, 2026· European Data Protection Board (EDPB)
ImpactModerate 52
Type🧭 Regulatory Guidance
Statuspublishedenacted, check the effective date
JurisdictionEU
What happened
On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The guidelines outline a five‑step method for assessing fines and describe corrective measures such as warnings, injunctions and service limitations. A public consultation on the guidelines runs until 13 November 2026.
Why it matters for trust and compliance
Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
The new EDPB guidance clarifies how authorities should levy fines and align DSA obligations with GDPR rules, impacting controllers, processors and digital platforms across the EU.
It relates to DSA. The regulations library explains what that law requires.
Recommended actions
Check that privacy notices describe the practices this addresses.