--- title: "Art. 40 GDPR: Codes of conduct" canonical: "https://dposchool.com/gdpr/article/40" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_40" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 40 GDPR · Chapter IV: Controller and processor · Section 5: Codes of conduct and certification # Article 40 GDPR: Codes of conduct Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Official text ### Article 40(1) **1.** The Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises. ### Article 40(2) **2.** Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to: #### Article 40(2)(a) **(a)** fair and transparent processing; #### Article 40(2)(b) **(b)** the legitimate interests pursued by controllers in specific contexts; #### Article 40(2)(c) **(c)** the collection of personal data; #### Article 40(2)(d) **(d)** the pseudonymisation of personal data; #### Article 40(2)(e) **(e)** the information provided to the public and to data subjects; #### Article 40(2)(f) **(f)** the exercise of the rights of data subjects; #### Article 40(2)(g) **(g)** the information provided to, and the protection of, children, and the manner in which the consent of the holders of parental responsibility over children is to be obtained; #### Article 40(2)(h) **(h)** the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32; #### Article 40(2)(i) **(i)** the notification of personal data breaches to supervisory authorities and the communication of such personal data breaches to data subjects; #### Article 40(2)(j) **(j)** the transfer of personal data to third countries or international organisations; or #### Article 40(2)(k) **(k)** out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79. ### Article 40(3) **3.** In addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved pursuant to paragraph 5 of this Article and having general validity pursuant to paragraph 9 of this Article may also be adhered to by controllers or processors that are not subject to this Regulation pursuant to Article 3 in order to provide appropriate safeguards within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (e) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards including with regard to the rights of data subjects. ### Article 40(4) **4.** A code of conduct referred to in paragraph 2 of this Article shall contain mechanisms which enable the body referred to in Article 41(1) to carry out the mandatory monitoring of compliance with its provisions by the controllers or processors which undertake to apply it, without prejudice to the tasks and powers of supervisory authorities competent pursuant to Article 55 or 56. ### Article 40(5) **5.** Associations and other bodies referred to in paragraph 2 of this Article which intend to prepare a code of conduct or to amend or extend an existing code shall submit the draft code, amendment or extension to the supervisory authority which is competent pursuant to Article 55. The supervisory authority shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation and shall approve that draft code, amendment or extension if it finds that it provides sufficient appropriate safeguards. ### Article 40(6) **6.** Where the draft code, or amendment or extension is approved in accordance with paragraph 5, and where the code of conduct concerned does not relate to processing activities in several Member States, the supervisory authority shall register and publish the code. ### Article 40(7) **7.** Where a draft code of conduct relates to processing activities in several Member States, the supervisory authority which is competent pursuant to Article 55 shall, before approving the draft code, amendment or extension, submit it in the procedure referred to in Article 63 to the Board which shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation or, in the situation referred to in paragraph 3 of this Article, provides appropriate safeguards. ### Article 40(8) **8.** Where the opinion referred to in paragraph 7 confirms that the draft code, amendment or extension complies with this Regulation, or, in the situation referred to in paragraph 3, provides appropriate safeguards, the Board shall submit its opinion to the Commission. ### Article 40(9) **9.** The Commission may, by way of implementing acts, decide that the approved code of conduct, amendment or extension submitted to it pursuant to paragraph 8 of this Article have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). ### Article 40(10) **10.** The Commission shall ensure appropriate publicity for the approved codes which have been decided as having general validity in accordance with paragraph 9. ### Article 40(11) **11.** The Board shall collate all approved codes of conduct, amendments and extensions in a register and shall make them publicly available by way of appropriate means. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 40 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_40) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 98](https://dposchool.com/gdpr/recital/98) ## EDPB guidance ### [Guidelines 04/2021 on codes of conduct as tools for transfers](https://dposchool.com/gdpr/guidance/edpb-04-2021) EDPB 04/2021 · Final · First published 14 July 2021 · Final version 22 February 2022 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042021-on-codes-of-conduct-as-tools-for-transfers_en) ### [Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-01-2019) EDPB 01/2019 · Final · First published 19 February 2019 · Final version 4 June 2019 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12019-on-codes-of-conduct-and-monitoring-bodies-under-regulation_en) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 40 Previous: [Art. 39 GDPR: Tasks of the data protection officer](https://dposchool.com/gdpr/article/39) Next: [Art. 41 GDPR: Monitoring of approved codes of conduct](https://dposchool.com/gdpr/article/41) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents