VDAI fine or reprimand: what the new EDPB Guidelines 04/2026 say

Not every infringement of the General Data Protection Regulation (GDPR) ends in a fine. A supervisory authority may issue a reprimand, give an order, or limit or ban processing (Article 58(2) GDPR). It imposes a fine in addition to, or instead of, those measures, depending on the circumstances of the individual case (Article 58(2)(i) GDPR; Article 83(2) GDPR). In a case of a minor infringement, a reprimand may be issued instead of a fine (Recital 148 GDPR).

On 17 September 2026 the European Data Protection Board (EDPB) adopted Guidelines 04/2026, which describe how a supervisory authority should decide whether to impose a fine. This is version 1.0, adopted for public consultation: feedback may be submitted until 13 November 2026 (EDPB public consultation page), so the final text may change. The State Data Protection Inspectorate (VDAI) announced them on 24 September 2026. Guidelines are not law. The consultation text states that they will replace the earlier Article 29 Working Party guidelines WP253 (paragraph 8 of EDPB Guidelines 04/2026).

Which measures the VDAI can take

The VDAI has all the powers of a supervisory authority laid down in the GDPR (Article 12(1) of the Lithuanian Law on the Legal Protection of Personal Data (ADTAĮ)). After an investigation, or after upholding a complaint, it may give orders and recommendations or apply other measures under Article 58(2) GDPR (Article 22(1)(2) ADTAĮ; Article 31(2)(1) ADTAĮ). A reprimand is issued where an infringement has already occurred (Article 58(2)(b) GDPR). An order may require the organisation to comply with a person’s request, to bring processing into compliance or to erase data (Article 58(2)(c), (d) and (g) GDPR). A warning concerns only intended operations (Article 58(2)(a) GDPR), so, according to the guidelines, a fine cannot be imposed together with it for the same conduct (paragraph 23 of EDPB Guidelines 04/2026). Even where a fine comes without an order, the obligation to bring processing into compliance with the GDPR remains (paragraph 30 of EDPB Guidelines 04/2026).

Five steps: how the guidelines propose to decide on a fine

1. Can this infringement lead to a fine at all. Fines apply to the infringements listed in Article 83(4) to (6) GDPR.

2. Who is liable. The addressee of the infringed obligation is liable (paragraph 40 of EDPB Guidelines 04/2026). To fine a legal person, it is not necessary for its management body to have acted or even known (judgment of the Court of Justice of the European Union (CJEU) of 5 December 2023, C‑683/21, paragraph 82). A controller may also be fined for unlawful processing by a processor acting on its behalf (CJEU judgment of 5 December 2023, C‑683/21, paragraph 84), unless the processor processed the data for its own purposes or outside the framework set by the controller (CJEU judgment of 5 December 2023, C‑683/21, paragraph 85). According to the guidelines, an employee’s failure to follow instructions does not necessarily remove liability (paragraph 41 of EDPB Guidelines 04/2026).

3. Intent or negligence. A fine cannot be imposed unless it is established that the infringement was committed intentionally or negligently (CJEU judgment of 5 December 2023, C‑683/21, paragraph 80). It is enough that the controller could not have been unaware of the infringing nature of its conduct, even if it did not realise that it was infringing the GDPR (CJEU judgment of 5 December 2023, C‑683/21, paragraph 81). The guidelines note that the threshold for negligence is very low (paragraph 49 of EDPB Guidelines 04/2026), and that where EDPB guidelines on the point already exist, an error is always considered avoidable (paragraph 50 of EDPB Guidelines 04/2026).

4. Is the infringement minor. The authority weighs the factors in Article 83(2)(a) to (k) GDPR (Article 83(2) GDPR). According to the guidelines, the authority may find an infringement minor if it does not pose a significant risk to people’s rights and does not affect the essence of the obligation. Then, as a general rule, no fine is imposed and a reprimand may be issued instead (paragraph 56 of EDPB Guidelines 04/2026). If the infringement is not minor, the guidelines speak of a strong presumption to impose a fine (paragraph 57 of EDPB Guidelines 04/2026).

5. Would a fine be effective, proportionate and dissuasive. Article 83(1) GDPR requires this. The GDPR also allows a reprimand instead of a fine where the fine would be a disproportionate burden to a natural person (Recital 148 GDPR). According to the guidelines, the authority may do the same where the burden on a legal person would be disproportionate (paragraph 26 of EDPB Guidelines 04/2026). Where the infringement is minor and in light of the circumstances, it may take no measure at all where the controller, as soon as it became aware of the infringement, took appropriate and necessary steps to end it and prevent it from recurring (paragraph 117 of EDPB Guidelines 04/2026). Where the infringement is not minor, the guidelines do not exclude this, but only in exceptional circumstances, and they assume that the authority would in general issue a reprimand rather than take no measure (paragraph 121 of EDPB Guidelines 04/2026).

What Article 83 GDPR weighs in your conduct

• Action taken to mitigate the damage (Article 83(2)(c) GDPR). According to the guidelines, measures implemented spontaneously, before the organisation learns of the investigation, are more likely to count as mitigating (paragraph 74 of EDPB Guidelines 04/2026).
• Degree of responsibility in light of measures under Articles 25 and 32 (Article 83(2)(d) GDPR). According to the guidelines, mandatory measures are not in themselves mitigating; the authority can treat them as mitigating only in exceptional circumstances, where more was done than required (paragraph 77 of EDPB Guidelines 04/2026). The authority should take account of documents showing when and how the measures were implemented (paragraph 78 of EDPB Guidelines 04/2026).
• Previous infringements (Article 83(2)(e) GDPR). According to the guidelines, infringements of a different kind may also be relevant, and their absence is not in itself mitigating, because compliance with the GDPR is the norm (paragraphs 80 and 88 of EDPB Guidelines 04/2026).
• Cooperation (Article 83(2)(f) GDPR). Cooperating with the supervisory authority on request is mandatory (Article 31 GDPR; Article 14 ADTAĮ). So, according to the guidelines, ordinary cooperation does not mitigate; only exceptional cooperation that goes beyond the duty and limited the harm to people may be mitigating (paragraphs 90 and 91 of EDPB Guidelines 04/2026). How to answer a VDAI inquiry is covered in our article Letter or inquiry from the VDAI: what it means and what to do.
• How the authority learned of it (Article 83(2)(h) GDPR). According to the guidelines, a mandatory breach notification under Article 33 GDPR is neutral, and a complaint is, as a rule, neutral too. A notification on the organisation’s own initiative may be mitigating where no specific notification duty required it and before the VDAI otherwise knew of the infringement (paragraphs 95 and 96 of EDPB Guidelines 04/2026). What happens after a person’s complaint is described in our article Complaint to the VDAI.
• Financial benefit (Article 83(2)(k) GDPR). According to the guidelines, a profit from the infringement may be a strong indication that the infringement is not minor and that a fine should be imposed (paragraph 106 of EDPB Guidelines 04/2026).

In our assessment, the factors a small organisation can influence directly are those in points (c) and (d), and documents decide how they are assessed (paragraph 78 of EDPB Guidelines 04/2026): the controller must be able to demonstrate compliance with the principles (Article 5(2) GDPR) and must document every personal data breach and the remedial action taken (Article 33(5) GDPR).

What can happen

A fine. For infringing the controller’s and processor’s obligations under Articles 8, 11, 25 to 39, 42 and 43 – up to ten million euros or, for an undertaking, up to two percent of the total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a) GDPR). For infringing the principles and people’s rights – up to twenty million euros or, for an undertaking, up to four percent of turnover, whichever is higher (Article 83(5)(a) and (b) GDPR). For public authorities and bodies the ADTAĮ sets lower caps (Article 33(1) and (2) ADTAĮ), except for those carrying out economic commercial activity (Article 33(3) ADTAĮ). More in our article GDPR fines for state and municipal institutions.

An order not complied with. Non-compliance with a VDAI order may be fined up to twenty million euros or, for an undertaking, up to four percent of turnover, whichever is higher (Article 83(6) GDPR). So an order is not the end: it creates a new obligation. A reprimand orders nothing (Article 58(2)(b) GDPR), but the infringement for which it was issued may later count as a previous infringement (Article 83(2)(e) GDPR).

A public decision. The VDAI publishes decisions taken after an investigation or a complaint on its website within five working days, protecting personal data and secrets protected by law. Where no infringement is found, the controller’s identity is not disclosed (Article 14¹(1) ADTAĮ). Decisions stay published for ten years (Article 14¹(2) ADTAĮ).

Limitation period. A decision to impose a fine may be taken if no more than 3 years have passed since the infringement, or, for a continuing infringement, since it came to light (Article 32(4) ADTAĮ).

When to call a lawyer

• when you receive a proposal to impose a fine and have a period of no less than 10 working days for explanations (Article 34(1) ADTAĮ);
• when you need to show that the infringement is minor and gather documents on the measures and when they were introduced (Article 83(2)(c) and (d) GDPR);
• when you receive a decision and are considering an appeal to court (Article 22(3) ADTAĮ; Article 31(5) ADTAĮ; Article 34(11) ADTAĮ).