---
title: "Art. 40 Data Act: Penalties"
canonical: "https://dposchool.com/data-act/article/40"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_40"
source_note: "Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2023-12-22"
language: "en"
publisher: "DPO School"
---

Art. 40 Data Act · Chapter IX: IMPLEMENTATION AND ENFORCEMENT

# Article 40 Data Act: Penalties

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

## Official text

### Article 40(1)

**1.** Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.

### Article 40(2)

**2.** Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.

### Article 40(3)

**3.** Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:

#### Article 40(3)(a)

**(a)** the nature, gravity, scale and duration of the infringement;

#### Article 40(3)(b)

**(b)** any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;

#### Article 40(3)(c)

**(c)** any previous infringements by the infringing party;

#### Article 40(3)(d)

**(d)** the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;

#### Article 40(3)(e)

**(e)** any other aggravating or mitigating factor applicable to the circumstances of the case;

#### Article 40(3)(f)

**(f)** infringing party’s annual turnover in the preceding financial year in the Union.

### Article 40(4)

**4.** For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.

### Article 40(5)

**5.** For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.

## Source

Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 40 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_40)

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[Data Act Navigator](https://dposchool.com/data-act) / [Chapter IX](https://dposchool.com/data-act/chapter/9) / Article 40

Previous: [Art. 39 Data Act: Right to an effective judicial remedy](https://dposchool.com/data-act/article/39)

Next: [Art. 41 Data Act: Model contractual terms and standard contractual clauses](https://dposchool.com/data-act/article/41)

## For AI agents

- Machine-readable index: https://dposchool.com/data-act/llms.txt
- JSON API: https://dposchool.com/data-act/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents