# Codes of conduct 40(1) — GDPR — provision context

> Focused context for a single provision (40(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-40#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Codes of conduct** (GDPR, full article: https://overview.legal/laws/gdpr/art-40).

## Provision text

### 40(1)

The Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises.


## Topics on this provision

- **Supervision** — https://overview.legal/topics/toezicht
  Oversight and enforcement by supervisory authorities

## Cited by (exact-provision citations)

- **Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per** (case-law) — https://overview.legal/posts/132371
- **Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14.** (case-law) — https://overview.legal/posts/132356
- **Judgment of the Court (First Chamber) of 7 December 2023.#UF and AB v Land Hessen.#Requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by** (case-law) — https://overview.legal/posts/132278
- **Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per** ¶16 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132371
- **Judgment of the Court (First Chamber) of 7 December 2023.#UF and AB v Land Hessen.#Requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by** ¶104 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132278
- **Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14.** ¶19 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132356
- **Judgment of the Court (First Chamber) of 7 December 2023.#UF and AB v Land Hessen.#Requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by** ¶101 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132278
- **Opinion 17/2021 on the draft decision of the French Supervisory Authority regarding the European code of conduct submitted by the Cloud Infrastructure Service Providers (CISPE)** (guidance) — https://overview.legal/posts/126026
- **EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT** (guidance) — https://overview.legal/posts/51178
- **EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT** (guidance) — https://overview.legal/posts/51076
- **Opinion 16/2021 on the draft decision of the Belgian Supervisory Authority regarding the “EU Data Protection Code of Conduct for Cloud Service Providers” submitted by Scope Europe** (guidance) — https://overview.legal/posts/126028
- **Opinion 12/2024 on the draft decision of the French Supervisory Authority regarding the “Code of Conduct for Service Providers in Clinical Research” submitted by EUCROF** (guidance) — https://overview.legal/posts/125740

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-40#par-1 · 2026-08-22