UK GDPRUK · retained 2016/679
Digiphile
Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 40 – Codes of conduct

Articles

Article 40Codes of conduct

1. [F1The [F2Commission]] shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises.
2. Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to:
  • (a)
    fair and transparent processing;
  • (b)
    the legitimate interests pursued by controllers in specific contexts;
  • (c)
    the collection of personal data;
  • (d)
    the pseudonymisation of personal data;
  • (e)
    the information provided to the public and to data subjects;
  • (f)
    the exercise of the rights of data subjects;
  • (g)
    the information provided to, and the protection of, children, and the manner in which the consent of the holders of parental responsibility over children is to be obtained;
  • (h)
    the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32;
  • (i)
    the notification of personal data breaches to [F3the [F4Commission]] and the communication of such personal data breaches to data subjects;
  • (j)
    the transfer of personal data to third countries or international organisations; or
  • (k)
    out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79.
3. In addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved pursuant to paragraph 5 of this Article F5... may also be adhered to by controllers or processors that are not subject to this Regulation pursuant to Article 3 in order to provide F6... safeguards within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (e) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those F6... safeguards including with regard to the rights of data subjects.
4. A code of conduct referred to in paragraph 2 of this Article shall contain mechanisms which enable the body referred to in Article 41(1) to carry out the mandatory monitoring of compliance with its provisions by the controllers or processors which undertake to apply it, without prejudice to the tasks and powers of [F7the [F8Commission]].
5. Associations and other bodies referred to in paragraph 2 of this Article which intend to prepare a code of conduct or to amend or extend an existing code shall submit the draft code, amendment or extension to [F9the [F8Commission], [F10which]] shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation and shall approve that draft code, amendment or extension if [F11the [F8Commission] finds] that it [F12is capable of providing safeguards for the purposes of Article 46].
6. Where the draft code, or amendment or extension is approved in accordance with paragraph 5, [F13the [F8Commission]] shall register and publish the code.
7. F14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8. F14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9. F14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10. F14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
11. F14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Amended text

This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations and footnotes

Textual Amendments

  1. F1 Words in Art. 40(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 Word in Art. 40(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(o); S.I. 2026/1015, reg. 2(c)
  3. F3 Words in Art. 40(2)(i) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Word in Art. 40(2)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(o); S.I. 2026/1015, reg. 2(c)
  5. F5 Words in Art. 40(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(4) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Words in Art. 40(3) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 5(2) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  7. F7 Words in Art. 40(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Word in Art. 40(4)-(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(o); S.I. 2026/1015, reg. 2(c)
  9. F9 Words in Art. 40(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  10. F10 Word in Art. 40(5) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(5); S.I. 2026/1015, reg. 2(c)
  11. F11 Words in Art. 40(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  12. F12 Words in Art. 40(5) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 5(3) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  13. F13 Words in Art. 40(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  14. F14 Art. 40(7)-(11) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 34(8) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Related recitals

Rec. 98Rec. 99

https://uk-gdpr.digiphile.law/article/article-40.html

Text as at 17 September 2026.

This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.