---
title: "Art. 41 GDPR: Monitoring of approved codes of conduct"
canonical: "https://dposchool.com/gdpr/article/41"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_41"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 41 GDPR · Chapter IV: Controller and processor · Section 5: Codes of conduct and certification

# Article 41 GDPR: Monitoring of approved codes of conduct

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Official text

### Article 41(1)

**1.** Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.

### Article 41(2)

**2.** A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:

#### Article 41(2)(a)

**(a)** demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority;

#### Article 41(2)(b)

**(b)** established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;

#### Article 41(2)(c)

**(c)** established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

#### Article 41(2)(d)

**(d)** demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests.

### Article 41(3)

**3.** The competent supervisory authority shall submit the draft requirements for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63.

### Article 41(4)

**4.** Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. It shall inform the competent supervisory authority of such actions and the reasons for taking them.

### Article 41(5)

**5.** The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the requirements for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.

### Article 41(6)

**6.** This Article shall not apply to processing carried out by public authorities and bodies.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 41 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_41)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 99](https://dposchool.com/gdpr/recital/99)

## EDPB guidance

### [Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-01-2019)

EDPB 01/2019 · Final · First published 19 February 2019 · Final version 4 June 2019

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12019-on-codes-of-conduct-and-monitoring-bodies-under-regulation_en)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 41

Previous: [Art. 40 GDPR: Codes of conduct](https://dposchool.com/gdpr/article/40)

Next: [Art. 42 GDPR: Certification](https://dposchool.com/gdpr/article/42)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents