The European Data Protection Board (EDPB) has adopted a harmonised methodology for calculating administrative fines under the GDPR, alongside final guidelines addressing the interplay between the Digital Services Act (DSA) and the GDPR.
The fining methodology aims to bring greater consistency across national data protection authorities when they assess penalties for GDPR infringements, reducing divergence in how similar breaches are treated across member states.
The DSA-GDPR guidelines address areas of overlap between the two regimes, including how obligations on platforms and intermediaries under the DSA relate to data protection duties under the GDPR, an area that has caused uncertainty for organisations subject to both frameworks.
Although this development concerns data protection enforcement rather than the EU AI Act directly, it is relevant to organisations preparing for AI Act compliance because many AI systems process personal data and will therefore sit at the intersection of the GDPR, the DSA, and the AI Act.
Greater consistency in GDPR fining practice may also signal how regulators approach penalty calculation more broadly, including under the AI Act's own enforcement provisions, which set out fines for infringements by providers and deployers of AI systems.
As a compliance matter, organisations developing or deploying AI systems that process personal data should treat this as a reminder to map overlapping obligations across the GDPR, the DSA, and the AI Act, rather than addressing each regime in isolation.
Documenting how these frameworks interact within an organisation's own systems and processes may help demonstrate a coherent compliance approach if regulators scrutinise practices spanning multiple regimes.