Data & Privacy
- Data Act
- Data Governance Act
- ePrivacy Directive
- GDPR
AI & Trust
- Artificial Intelligence Act
Cybersecurity
- Cybersecurity Act
- DORA
- NIS2
Digital Services & Media
- Digital Markets Act
- Digital Services Act
- European Media Freedom Act
Data Act
- Recitals
CHAPTER I
GENERAL PROVISIONSArticles 1 — 2
CHAPTER II
BUSINESS TO CONSUMER AND BUSINESS TO BUSINESS DATA SHARINGArticles 3 — 7
CHAPTER III
OBLIGATIONS FOR DATA HOLDERS OBLIGED TO MAKE DATA AVAILABLE PURSUANT TO UNION LAWArticles 8 — 12
CHAPTER IV
UNFAIR CONTRACTUAL TERMS RELATED TO DATA ACCESS AND USE BETWEEN ENTERPRISESArticles 13 — 13
CHAPTER V
MAKING DATA AVAILABLE TO PUBLIC SECTOR BODIES, THE COMMISSION, THE EUROPEAN CENTRAL BANK AND UNION BODIES ON THE BASIS OF AN EXCEPTIONAL NEEDArticles 14 — 22
CHAPTER VI
SWITCHING BETWEEN DATA PROCESSING SERVICESArticles 23 — 31
CHAPTER VII
UNLAWFUL INTERNATIONAL GOVERNMENTAL ACCESS AND TRANSFER OF NON-PERSONAL DATAArticles 32 — 32
CHAPTER VIII
INTEROPERABILITYArticles 33 — 36
CHAPTER IX
IMPLEMENTATION AND ENFORCEMENTArticles 37 — 42
CHAPTER X
SUI GENERIS RIGHT UNDER DIRECTIVE 96/9/ECArticles 43 — 43
CHAPTER XI
FINAL PROVISIONSArticles 44 — 50
DA Article 40. Penalties
- 1.Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
- 2.Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
- 3.Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
- (a)the nature, gravity, scale and duration of the infringement;
- (b)any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
- (c)any previous infringements by the infringing party;
- (d)the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
- (e)any other aggravating or mitigating factor applicable to the circumstances of the case;
- (f)infringing party’s annual turnover in the preceding financial year in the Union.
- 4.For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
- 5.For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
Relevant Recitals for this Article
Competent authorities should ensure that infringements of the obligations laid down in this Regulation are subject to penalties. Such penalties could include financial penalties, warnings, reprimands or orders to bring business practices into compliance with the obligations imposed by this Regulation. Penalties established by the Member States should be effective, proportionate and dissuasive, and should take into account the recommendations of the EDIB, thus contributing to achieving the greatest possible level of consistency in the establishment and application of penalties. Where appropriate, competent authorities should make use of interim measures to limit the effects of an alleged infringement while the investigation of that infringement is ongoing. In so doing, they should take into account, inter alia the nature, gravity, scale and duration of the infringement in view of the public interest at stake, the scope and kind of activities carried out, and the economic capacity of the infringing party. They should also take into account whether the infringing party systematically or recurrently fails to comply with its obligations under this Regulation. In order to ensure that the principle of is respected, and in particular to avoid that the same infringement of the obligations laid down in this Regulation is penalised more than once, a Member State that intends to exercise its competence in relation to an infringing party that is not established and has not designated a legal representative in the Union should, without undue delay, inform all data coordinators as well as the Commission.