GDPR Art. 41 EN

Monitoring of approved codes of conduct

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.¶

Codes of Conduct Monitoring Supervisory Authorities 31
2.
A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:¶

Codes of Conduct 71
1. a)
  demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority; ¶
  Supervisory Authorities Supervision
2. b)
  established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation; ¶
  Controllers
3. c)
  established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and ¶
  Processors Controllers
4. d)
  demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests. ¶
  Supervisory Authorities Supervision
3.

The competent supervisory authority shall submit the draft criteria for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63.¶

Supervisory Authorities Supervision 3
4.

Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. It shall inform the competent supervisory authority of such actions and the reasons for taking them.¶

Processors Supervisory Authorities Supervision 14
5.

The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the conditions for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.¶

Supervisory Authorities Supervision 1
6.

This Article shall not apply to processing carried out by public authorities and bodies.¶

1

Connections by provision

41(1) 15 Case Law 15 Guidance 1 News .md

Case Law 15

Judgment of the General Court (Fourth Chamber) of 20 July 2016 (Extracts).#Athanassios Oikonomopoulos v European Commission.#Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence.#Case Judgment of the Court (Grand Chamber) of 22 November 2022.#WM and Sovim SA v Luxembourg Business Registers.#Requests for a preliminary ruling from the Tribunal d'arrondissement de Luxembourg.#Reference for a preliminary ruling – Prevention of the use of the financial system for the purposes of money laundering or terrorist financing – Directive (EU) 2018/843 amending Directive (EU) 2015/849 – Amendment to Article 30(5), first subparagraph, point (c), of Directive 2015/849 – Access for any member Judgment of the General Court (Fourth Chamber, Extended Composition) of 7 June 2023.#TC v European Parliament.#Law governing the institutions – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Reasonable time – Burden of proof – Right to be heard – Protection of personal data – Article 9 of Regulation (EU) 2018/1725 – Article 26 of the Staff Regulations.#Case T-309/21. Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶57 Judgment of the General Court (Fourth Chamber, Extended Composition) of 7 June 2023.#TC v European Parliament.#Law governing the institutions – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Reasonable time – Burden of proof – Right to be heard – Protection of personal data – Article 9 of Regulation (EU) 2018/1725 – Article 26 of the Staff Regulations.#Case T-309/21. ¶43 Judgment of the General Court (Fourth Chamber, Extended Composition) of 7 June 2023.#TC v European Parliament.#Law governing the institutions – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Reasonable time – Burden of proof – Right to be heard – Protection of personal data – Article 9 of Regulation (EU) 2018/1725 – Article 26 of the Staff Regulations.#Case T-309/21. ¶47 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶49 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – +7 more

Guidance 15

Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment Overview on resources made available by Member States to the Data Protection Authorities and on enforcement actions by the Data Protection Authorities Guidelines 02/2022 on the application of Article 60 GDPR Opinion 14/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro ¶123 Guidelines 02/2022 on the application of Article 60 GDPR +7 more

News 1

Article 41 of the GDPR (General Data Protection Regulation).

41(2) 16 Case Law 55 Guidance .md

Case Law 16

Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – Judgment of the General Court (Fourth Chamber, Extended Composition) of 7 June 2023.#TC v European Parliament.#Law governing the institutions – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Reasonable time – Burden of proof – Right to be heard – Protection of personal data – Article 9 of Regulation (EU) 2018/1725 – Article 26 of the Staff Regulations.#Case T-309/21. Judgment of the General Court (Fifth Chamber, Extended Composition) of 24 May 2023.#Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd v European Commission.#Competition – Data market – Administrative procedure – Article 18(3) and Article 24(1)(d) of Regulation (EC) No 1/2003 – Request for information – Virtual data room – Obligation to state reasons – Legal certainty – Rights of the defence – Necessity of the information requested – Misuse of powers – Right to privacy – Proportionality – ¶135 Judgment of the Court (Fifth Chamber) of 3 July 2025.#European Parliament v TC.#Appeal – Law governing the institutions – European Parliament – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Article 41(2) of the Charter of Fundamental Rights of the European Union – Right to be heard – Right of access to the file – Regulation (EU) 2018/1725 – Protection of natural persons with regard to the processing of pers ¶0 Judgment of the Court (Fifth Chamber) of 3 July 2025.#European Parliament v TC.#Appeal – Law governing the institutions – European Parliament – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Article 41(2) of the Charter of Fundamental Rights of the European Union – Right to be heard – Right of access to the file – Regulation (EU) 2018/1725 – Protection of natural persons with regard to the processing of pers ¶38 Judgment of the Court (Fifth Chamber) of 3 July 2025.#European Parliament v TC.#Appeal – Law governing the institutions – European Parliament – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Article 41(2) of the Charter of Fundamental Rights of the European Union – Right to be heard – Right of access to the file – Regulation (EU) 2018/1725 – Protection of natural persons with regard to the processing of pers ¶74 Judgment of the Court (Fifth Chamber) of 3 July 2025.#European Parliament v TC.#Appeal – Law governing the institutions – European Parliament – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Article 41(2) of the Charter of Fundamental Rights of the European Union – Right to be heard – Right of access to the file – Regulation (EU) 2018/1725 – Protection of natural persons with regard to the processing of pers ¶86 Judgment of the Court (Fifth Chamber) of 3 July 2025.#European Parliament v TC.#Appeal – Law governing the institutions – European Parliament – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Article 41(2) of the Charter of Fundamental Rights of the European Union – Right to be heard – Right of access to the file – Regulation (EU) 2018/1725 – Protection of natural persons with regard to the processing of pers +8 more

Guidance 55

Opinion 17/2019 on the UK data protection supervisory authority draft accreditation requirements for a code of conduct monitoring body pursuant to article 41 GDPR Opinion 2/2020 on the Belgium data protection supervisory authority draft accreditation requirements for a code of conduct monitoring body pursuant to article 41 GDPR Opinion 3/2020 on the France data protection supervisory authority draft accreditation requirements for a code of conduct monitoring body pursuant to article 41 GDPR Opinion 1/2020 on the Spanish data protection supervisory authority draft accreditation requirements for a code of conduct monitoring body pursuant to article 41 GDPR Guidelines 03/2021 on the application of Article 65(1)(a) GDPR Opinion 11/2020 on the draft decision of the competent supervisory authority of Ireland regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR Opinion 12/2020 on the draft decision of the competent supervisory authority of Finland regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR Opinion 13/2020 on the the draft decision of the competent supervisory authority of Italy regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR +47 more

41(2)(a) 25 Case Law 1 Guidance 1 News .md

Case Law 25

Judgment of the General Court (Fourth Chamber, Extended Composition) of 7 June 2023.#TC v European Parliament.#Law governing the institutions – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Reasonable time – Burden of proof – Right to be heard – Protection of personal data – Article 9 of Regulation (EU) 2018/1725 – Article 26 of the Staff Regulations.#Case T-309/21. Judgment of the General Court (Eighth Chamber, Extended Composition) of 26 April 2023.#Single Resolution Board v European Data Protection Supervisor.#Protection of personal data – Procedure for granting compensation to shareholders and creditors following the resolution of a bank – Decision of the EDPS in which it found that the SRB failed to fulfil its obligations concerning the processing of personal data – Article 15(1)(d) of Regulation (EU) 2018/1725 – Concept of personal data – Article 3(1) Judgment of the General Court (First Chamber, Extended Composition) of 10 September 2025.#Meta Platforms Ireland Ltd v European Commission.#Digital services – Regulation (EU) 2022/2065 – Commission decision determining the amount of the supervisory fee for 2023 – Article 43(3) to (5) of Regulation 2022/2065 – Article 4(2) of Delegated Regulation (EU) 2023/1127 – Method for calculating the number of average monthly active recipients – Temporal adjustment of the effects of an annulment.#Case T-55/ Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – Judgment of the Court (First Chamber) of 4 September 2025.#European Data Protection Supervisor v Single Resolution Board.#Appeal – Protection of natural persons with regard to the processing of personal data – Procedure for granting compensation to shareholders and creditors of a banking institution following the resolution of that institution – Decision of the European Data Protection Supervisor finding that the Single Resolution Board failed to fulfil its obligations relating to the processing CJEU - T‑183/23 - Ballmann v European Data Protection Board ¶89 Judgment of the Court (Fifth Chamber) of 3 July 2025.#European Parliament v TC.#Appeal – Law governing the institutions – European Parliament – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Article 41(2) of the Charter of Fundamental Rights of the European Union – Right to be heard – Right of access to the file – Regulation (EU) 2018/1725 – Protection of natural persons with regard to the processing of pers ¶11 Judgment of the General Court (First Chamber, Extended Composition) of 10 September 2025.#Meta Platforms Ireland Ltd v European Commission.#Digital services – Regulation (EU) 2022/2065 – Commission decision determining the amount of the supervisory fee for 2023 – Article 43(3) to (5) of Regulation 2022/2065 – Article 4(2) of Delegated Regulation (EU) 2023/1127 – Method for calculating the number of average monthly active recipients – Temporal adjustment of the effects of an annulment.#Case T-55/ +17 more

Guidance 1

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

News 1

Article 41 of the GDPR (General Data Protection Regulation).

41(2)(b) 43 Case Law 1 Guidance .md

Case Law 43

CJEU - T‑183/23 - Ballmann v European Data Protection Board Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – CJEU - C-141/12 and C-372/12 - YS and Others (Joined Cases) ¶76 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶86 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶19 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶87 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶119 Judgment of the Court (Fifth Chamber) of 3 July 2025.#European Parliament v TC.#Appeal – Law governing the institutions – European Parliament – Rules governing expenses and allowances for Members of Parliament – Parliamentary assistance allowance – Recovery of sums unduly paid – Article 41(2) of the Charter of Fundamental Rights of the European Union – Right to be heard – Right of access to the file – Regulation (EU) 2018/1725 – Protection of natural persons with regard to the processing of pers +35 more

Guidance 1

EDPB Annual Report 2025

41(2)(c) 2 Case Law 3 Guidance .md

Case Law 2

Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶64 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access –

Guidance 3

Guidelines 02/2022 on the application of Article 60 GDPR ¶265 Guidelines 02/2022 on the application of Article 60 GDPR ¶113 Guidelines 02/2022 on the application of Article 60 GDPR

41(3) 2 Case Law 1 Guidance .md

Case Law 2

Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶64 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access –

Guidance 1

Recommendations on calculating the audit cycle in EU Large-Scale IT Systems

41(4) 2 Case Law 11 Guidance 1 News .md

Case Law 2

Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶64 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access –

Guidance 11

Guidelines 04/2022 on the calculation of administrative fines under the GDPR Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 Opinion 12/2024 on the draft decision of the French Supervisory Authority regarding the “Code of Conduct for Service Providers in Clinical Research” submitted by EUCROF Opinion 10/2021 on the draft decision of the competent supervisory authority of Hungary regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR Opinion 23/2021 on the draft decision of the competent supervisory authority of Czech Republic regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR Opinion 02/2023 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR ¶59 Opinion 10/2021 on the draft decision of the competent supervisory authority of Hungary regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR ¶50 Opinion 23/2021 on the draft decision of the competent supervisory authority of Czech Republic regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR +3 more

News 1

DeFine is a calculator for GDPR fines based on method of the EDPB

41(5) 1 Guidance .md

Guidance 1

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

41(6) 1 Guidance .md

Guidance 1

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Related across sources

News ICO (UK) - ACRO Criminal Records Office News VG Berlin - 42 K 51.25 News VG Berlin - 42 K 73/25 News Too Little, Too Late: Flock Admits Their Technology Needs Reforms Enforcement AEPD (Spain) - PS/00249/2025 News Joint statement on surveillance and interception in Bangladesh