---
title: "Art. 84 GDPR: Penalties"
canonical: "https://dposchool.com/gdpr/article/84"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_84"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 84 GDPR · Chapter VIII: Remedies, liability and penalties

# Article 84 GDPR: Penalties

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

Member States must lay down the rules on other penalties for infringements of the Regulation, in particular for infringements not subject to administrative fines, and take all measures necessary to ensure they are implemented. Such penalties must be effective, proportionate and dissuasive.

## Official text

### Article 84(1)

**1.** Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.

### Article 84(2)

**2.** Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 84 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_84)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 149](https://dposchool.com/gdpr/recital/149)

## Court of Justice judgments

### [C-655/23, IP v Quirin Privatbank AG](https://dposchool.com/gdpr/case/c-655-23)

Judgment of 4 September 2025 · ECLI:EU:C:2025:655

The GDPR does not itself give a right to a court order stopping future unlawful processing, though national law may; negative feelings from loss of control can be damage if proven; fault and any injunction cannot reduce compensation.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-655/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0655)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VIII](https://dposchool.com/gdpr/chapter/8) / Article 84

Previous: [Art. 83 GDPR: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83)

Next: [Art. 85 GDPR: Processing and freedom of expression and information](https://dposchool.com/gdpr/article/85)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents