A GDPR fine requires fault. The draft out for consultation says that where the Board has published, the fault is no longer arguable.

The European Data Protection Board adopted a thirty-nine-page draft on 17 September and opened it for comment four days later. It sets out, as a numbered sequence for the first time, how a supervisory authority should decide whether to impose a GDPR fine at all, as distinct from how to size one once that is settled, and it replaces the Article 29 Working Party guidance the Board had endorsed and worked from until now.

Five steps. The first three ask whether a fine is legally available. The last two ask whether it should be imposed.

The discretion is not what changes. The authority still chooses. What changes is that the Board has written down which way the choice falls before anyone opens the file. Paragraph 57: if the infringement is minor then as a general rule there is no fine, and a reprimand may be issued instead; if it is not minor, "there is a strong presumption to impose an administrative fine."

That sentence is the document. Everything else is the machinery for reaching one side of it or the other.

Step three is where more cases are settled than step four

A fine requires fault, and the requirement is not written in the regulation. The Board deduces it — paragraphs 47 and 48 — from Article 83(2)(b) and Article 83(3), which both presuppose negligence or intent, and from the absence of any provision contemplating a fine without wrongful conduct. It cites the Court of Justice in Deutsche Wohnen, C-807/21, at paragraph 75.Neither EUR-Lex nor the Court's own database would serve us a case-law page this week. Every statement here about a judgment is the Board's reading of it, at the paragraph the Board gives. A culpable infringement is a condition of the fine. On its face that is a threshold.

Then read paragraph 49. Negligence requires an awareness component, not a will component. It is satisfied where the addressee "could not be unaware" of the infringing nature of its conduct, whether or not it knew it was breaching the GDPR: the question is whether it was in a position to know, not whether it recognised the position. The Board quotes Advocate General Emiliou to the effect that the threshold is so low it is difficult to envisage a situation where it is not met.

Paragraph 50 closes the remaining gap. Fault is absent only where an error of law was unavoidable, meaning that every possible and reasonable step was taken to avoid it. Then the sentence: where the law leaves room for interpretation, the absence of legal literature or EDPB guidelines does not in itself make an error unavoidable — but where EDPB guidelines exist, an error is "always to be considered avoidable and therefore at least negligent."

Read the two halves against each other. Guidance on your problem forecloses the defence. No guidance on your problem does not open it.

Nor does advice. Example 4 disposes of the obvious answers in turn: an external opinion that acknowledges the contrary majority view proves you knew the risk; an internal assessment that departs from the supervisory authority's known position proves you could have known it; and a consultation you cannot document cannot be assessed, so it does nothing. External advice, the Board adds, must not be trusted blindly.

This is not new law. It is the first time it has been set out as a step with a number, in a document the authorities are told to work through in order.

The word the test turns on appears once in the regulation

Step four asks whether the infringement is minor. There is no definition, because there is nothing to define from. Search the GDPR for the string and you get one hit, in recital 148, and none at all in the articles. Article 83(2) lists eleven factors and does not use the word. Recitals are not binding.

So the switch between a letter and a fine is an interpretation of a recital, and the nearest thing to a test is paragraph 56, where the authority "may" conclude that an infringement is minor because it does not pose a significant risk to the rights of the data subjects concerned and does not affect the essence of the obligation in question. Two limbs, both evaluative, in a sentence that is not an operative provision of anything.

The four worked examples at Examples 6 to 9 are more useful than the test: an access request that went to an SME's spam folder, a tracking pixel that shipped hashed contact details for some fifty thousand users to a social network over two years, a refused access request to parking-facility footage, and a small sports club's fan page. Scale is not what they share. In each one the controller corrected the thing before or immediately after the authority arrived, which is the fact the Board keeps returning to.

Example 10 is the pivot. A telecoms company answered an access request a month late without warning the requester; the authority took that as minor and reached for a reprimand, then found further identical cases while handling the complaint. The accumulation, on the Board's reasoning, shows a pattern rather than an exception, and a pattern is not minor. Nothing about the individual failure changed.

Two things that look like credit and are not

Paragraph 95: where a controller is under a specific notification duty, an Article 33 breach notification is "neutral" in the weighing. Self-reporting mitigates only where you were not obliged to report. Filing the notification you had to file buys nothing, which is defensible and will still surprise the room.

Paragraph 99: compliance with measures the authority previously ordered against you on the same subject matter carries no weight either, because compliance is mandatory. Only doing more than you were told is mitigating. Non-compliance is aggravating, and may be a separate infringement.

There are nine other factors, at paragraphs 62 to 107. The one to read next is Article 83(2)(k): profit obtained or loss avoided indicates strongly that the infringement is not minor, on the ground that a measure without a pecuniary component cannot take the gain back.

From April 2027 the reasoning arrives in a letter you can answer

Paragraph 3 of the draft says the methodology should be considered, to the extent appropriate, in drafting two documents under Regulation (EU) 2025/2518, the procedural rules regulation of 26 November 2025. That regulation applies from 2 April 2027, and Article 36 confines its investigation chapters to own-initiative investigations opened, and complaints lodged, after that date.

The third subparagraph of Article 19(2) is the one to read. Preliminary findings notified to the party under investigation must indicate the corrective measures the lead authority is considering and, where it is weighing a fine, list the legal and factual elements it intends to rely on in deciding whether to impose one, with the aggravating and mitigating factors. Article 10(2)(e) puts a preliminary identification of potential corrective measures into the summary of key issues, which goes to the other supervisory authorities rather than to you.

So from spring 2027 a firm under investigation receives, before any draft decision, a document whose skeleton is the five steps. Commenting on a methodology is unrewarding work; commenting on the template of a letter addressed to you is not the same activity.

The presumption is not the end of it, either. It survives into step five and can be displaced there: at Example 14 an infringement the authority calls not minor draws a reprimand, because the processing had been covered by a national publication certificate and the provision limiting that protection was recent and unsettled. At Example 11 a savings bank that disciplined the employee who had read a customer's file and agreed to extend its access-log retention gets no corrective measure at all. Paragraph 121, though, is the Board telling the authorities that where a fine is not proportionate it expects a reprimand, not silence.

The consultation closes on 13 November. A response arguing the outcome will not land; the discretion belongs to the authority and the draft does not take it away. A response arguing the text might: paragraph 50 is a general rule of culpability assembled from two Advocate General opinions and two of the Board's own binding decisions, to be applied by every supervisory authority in the EEA, each inside a national administrative law with its own view of what an error of law is.

Until 13 November this document is a draft, and on the Board's own account an error about its subject matter is not yet automatically avoidable. After that it is guidelines.