§ GDPR · Article 64
GDPR Article 64: Obligations, Deadlines & Penalties
At a glance
Article 64 of the GDPR imposes 11 obligations on Board, Chair of the Board, Commission and 4 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 64
Obligation 1
The competent supervisory authority shall communicate the draft decision to the Board when it aims to adopt specific measures such as lists of processing operations subject to DPIA, codes of conduct, accreditation criteria, standard clauses, contractual clauses, or binding corporate rules.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
competent supervisory authority
- Action required
-
communicate
- Deadline
-
—
- Penalty
-
—
Obligation 2
The Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
Board
- Action required
-
issue opinion
- Deadline
-
—
- Penalty
-
—
Obligation 3
The Board shall adopt the opinion within eight weeks by simple majority of the members of the Board, extendable by a further six weeks if necessary.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
Board
- Action required
-
adopt
- Deadline
-
within eight weeks
- Penalty
-
—
Obligation 4
Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board any relevant information using a standardised format.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
supervisory authorities
- Action required
-
communicate
- Deadline
-
without undue delay
- Penalty
-
—
Obligation 5
The Commission shall, without undue delay, communicate by electronic means to the Board any relevant information using a standardised format.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
Commission
- Action required
-
communicate
- Deadline
-
without undue delay
- Penalty
-
—
Obligation 6
The Chair of the Board shall, without undue delay, inform by electronic means the members of the Board and the Commission of any relevant information communicated to it using a standardised format.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
Chair of the Board
- Action required
-
inform
- Deadline
-
without undue delay
- Penalty
-
—
Obligation 7
The secretariat of the Board shall, where necessary, provide translations of relevant information.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
secretariat of the Board
- Action required
-
provide translations
- Deadline
-
—
- Penalty
-
—
Obligation 8
The Chair of the Board shall, without undue delay, inform the supervisory authority and the Commission of the opinion and make it public.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
Chair of the Board
- Action required
-
inform
- Deadline
-
without undue delay
- Penalty
-
—
Obligation 9
The competent supervisory authority shall not adopt its draft decision within the period referred to in paragraph 3 (eight weeks, extendable by six).
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
competent supervisory authority
- Action required
-
refrain from adopting
- Deadline
-
within the period referred to in paragraph 3
- Penalty
-
—
Obligation 10
The supervisory authority shall take utmost account of the opinion of the Board.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
supervisory authority
- Action required
-
take account
- Deadline
-
—
- Penalty
-
—
Obligation 11
The supervisory authority shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.
Regulation (EU) 2016/679, Article 64, Article 64
- Obligated entity
-
supervisory authority
- Action required
-
communicate
- Deadline
-
within two weeks after receiving the opinion
- Penalty
-
—
§ Frequently asked
Questions about Article 64
Who must comply with Article 64 of the GDPR?
+
Board, Chair of the Board, Commission, competent supervisory authority, secretariat of the Board, supervisory authorities, supervisory authority.
What does Article 64 of the GDPR require?
+
communicate issue opinion adopt
What is the compliance deadline for GDPR Article 64?
+
within eight weeks; within the period referred to in paragraph 3; within two weeks after receiving the opinion; without undue delay