The European Data Protection Board (EDPB) has published draft guidelines that could change how GDPR enforcement works in practice. According to a summary of the draft, the proposal sets out an EDPB presumption of GDPR fines for non-minor infringements, paired with a deliberately low bar for establishing negligence. In plain terms, regulators would start from the assumption that a serious violation deserves a fine, and companies would carry more of the burden of showing why it should not.
The source material available for this story is limited to a summary, so this post sticks to what that summary states and explains the likely implications in general terms.
What the EDPB's draft guidelines propose
The core of the draft is a shift in the default. Until now, supervisory authorities have had a range of corrective powers under the GDPR, from reprimands and orders to comply through to administrative fines. The draft guidelines propose that for infringements that are not minor, a fine should be the expected outcome rather than one option among many.
Two elements stand out in the summary:
- A presumption in favor of fines for non-minor infringements.
- A deliberately low threshold for negligence, which matters because fault is a key condition for imposing a fine.
The summary also notes that organizations will need to demonstrate robust measures to show they acted with appropriate care. The draft is a proposal, not final guidance, so details may change after consultation.
Why a low negligence bar changes enforcement
Fines under the GDPR generally depend on whether an infringement was intentional or negligent. If proving negligence is difficult, regulators may hesitate to fine, or cases may stall in argument over what a company knew or should have known.
A low bar shifts that dynamic. If a company failed to take the steps a reasonably careful organization would take, negligence can be established without much further inquiry. Combined with a presumption of fines, that would make it harder for an organization to argue that a breach was simply bad luck or an honest oversight.
This fits with the broader push toward consistency. The EDPB has already introduced a five-step approach to calculating fines, which we covered in our explainer on the EDPB five-step GDPR fine method. That method deals with how much a fine should be. The new draft addresses the earlier question of whether a fine should be imposed at all. For background on the fine tiers and the role of fault, see our guide to GDPR fines and penalties in 2026.
What This Means For You
For ordinary people, the practical effect would be indirect but meaningful. Privacy rights on paper only matter if there are consequences when they are ignored. If fines become the expected response to serious violations, companies have a stronger financial reason to:
- Collect less personal data in the first place.
- Secure the data they keep, and document how.
- Respond to access, erasure, and objection requests on time.
- Train staff and vet vendors who handle customer data.
This does not mean every complaint will end in a penalty, and it does not guarantee faster outcomes for individuals. Minor infringements are expected to be treated differently, and the guidelines are still in draft form. But the direction of travel is toward enforcement that carries real weight.
Organizations, meanwhile, will likely focus on evidence. Under this approach, being able to show records, risk assessments, and prompt corrective action could be the difference between a fine and a lesser response.
How to exercise your GDPR rights today
You do not need to wait for the guidelines to be finalized. If you are in the EU or EEA, or a company is processing your data under the GDPR, you can already act:
- Ask for access. Send a data subject access request to find out what a company holds about you and how it uses it.
- Request erasure. If the data is no longer needed or you withdraw consent, ask the company to delete it.
- Object to processing. You can object to certain uses, including direct marketing.
- Keep a record. Save copies of your requests and the replies, with dates.
- Escalate if ignored. If a company does not respond properly, you can complain to your national data protection authority.
A documented, well-founded complaint is the kind of evidence regulators can act on, and a stronger enforcement stance would make those complaints more consequential.
Key takeaways
The EDPB presumption of GDPR fines, if adopted as drafted, would make penalties the normal response to non-minor violations and make negligence easier to establish. That puts pressure on companies to handle personal data with care and gives individuals' rights more practical force.
Use the rights you already have: request access, ask for erasure, and object where appropriate. To understand how penalties are worked out once a fine is on the table, read our explainers on the EDPB five-step fine method and the GDPR penalty tiers.
