§ Data Act · Article 40

Data Act Article 40: Obligations, Deadlines & Penalties

Regulation (EU) 2023/2854, Article 40 · All obligations · Data Act

At a glance

Article 40 of the Data Act imposes 6 obligations on Commission, European Data Protection Supervisor, Member States and 1 other entity type(s). At least one obligation carries an explicit compliance deadline.

§ Obligations

All obligations under Article 40

Obligation 1

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and take all measures necessary to ensure that they are implemented, ensuring penalties are effective, proportionate, and dissuasive. Regulation (EU) 2023/2854, Article 40, Article 40

Obligated entity: Member States
Action required: lay down rules
Deadline: —
Penalty: —

Obligation 2

Member States shall notify the Commission of the rules and measures on penalties by 12 September 2025 and notify it without delay of any subsequent amendment affecting them. Regulation (EU) 2023/2854, Article 40, Article 40

Obligated entity: Member States
Action required: notify
Deadline: 12 September 2025
Penalty: —

Obligation 3

The Commission shall regularly update and maintain an easily accessible public register of the measures notified by Member States regarding penalties. Regulation (EU) 2023/2854, Article 40, Article 40

Obligated entity: Commission
Action required: maintain register
Deadline: —
Penalty: —

Obligation 4

Member States shall take into account the recommendations of the EDIB and specific non-exhaustive criteria, such as the nature and gravity of the infringement, when imposing penalties. Regulation (EU) 2023/2854, Article 40, Article 40

Obligated entity: Member States
Action required: take into account
Deadline: —
Penalty: —

Obligation 5

Supervisory authorities responsible for monitoring Regulation (EU) 2016/679 may impose administrative fines for infringements of obligations in Chapter II, III, and V, up to the amount referred to in Article 83(5) of that Regulation. Regulation (EU) 2023/2854, Article 40, Article 40

Obligated entity: supervisory authorities
Action required: impose fines
Deadline: —
Penalty: —

Obligation 6

The European Data Protection Supervisor may impose administrative fines for infringements of obligations in Chapter V, up to the amount referred to in Article 66(3) of Regulation (EU) 2018/1725. Regulation (EU) 2023/2854, Article 40, Article 40

Obligated entity: European Data Protection Supervisor
Action required: impose fines
Deadline: —
Penalty: —

§ Frequently asked

Questions about Article 40

Who must comply with Article 40 of the Data Act? +

Commission, European Data Protection Supervisor, Member States, supervisory authorities.

What does Article 40 of the Data Act require? +

lay down rules notify maintain register

What is the compliance deadline for Data Act Article 40? +

12 September 2025

Need a cross-border briefing on Data Act Article 40?

Search Fontvera ↵

All EU obligation pages · All Data Act articles