UK GDPRUK · retained 2016/679
Digiphile
Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 41 – Monitoring of approved codes of conduct

Articles

Article 41Monitoring of approved codes of conduct

1. Without prejudice to the tasks and powers of [F1the [F2Commission]] under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by [F1the [F2Commission]].
2. A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:
  • (a)
    demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of [F3the [F4Commission]];
  • (b)
    established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;
  • (c)
    established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and
  • (d)
    demonstrated to the satisfaction of [F5the [F6Commission]] that its tasks and duties do not result in a conflict of interests.
3. F7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4. Without prejudice to the tasks and powers of [F8the [F9Commission]] and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor F10....
4A. [F11 If the action taken by a body under paragraph 4 consists of suspending or excluding a controller or processor from the code, the body must inform the [F9Commission], giving reasons for taking that action.]
5. [X1 [F12The [F9Commission]] shall revoke the accreditation of a body as referred to in paragraph 1 if the requirements for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.]
6. This Article shall not apply to processing carried out by public authorities and bodies.

Amended text

This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations and footnotes

Textual Amendments

  1. F1 Words in Art. 41(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 35(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 Word in Art. 41(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(p); S.I. 2026/1015, reg. 2(c)
  3. F3 Words in Art. 41(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 35(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Word in Art. 41(2)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(p); S.I. 2026/1015, reg. 2(c)
  5. F5 Words in Art. 41(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 35(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Word in Art. 41(2)(d) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(p); S.I. 2026/1015, reg. 2(c)
  7. F7 Art. 41(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 35(4) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Words in Art. 41(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 35(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  9. F9 Word in Art. 41(4)(4A)(5) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(p); S.I. 2026/1015, reg. 2(c)
  10. F10 Words in Art. 41(4) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 83(a), 142(1); S.I. 2026/82, reg. 2(l)
  11. F11 Art. 41(4A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 83(b), 142(1); S.I. 2026/82, reg. 2(l)
  12. F12 Words in Art. 41(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 35(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Editorial Information

  1. X1 Substituted by Corrigendum to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union L 119 of 4 May 2016).

https://uk-gdpr.digiphile.law/article/article-41.html

Text as at 17 September 2026.

This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.