News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Article 40 of the General Data Protection Regulation (GDPR).

Codes of Conduct International Transfer Supervision Prior Consultation Pseudonymization
Jan 5, 2026

Full text

(1) Encouraging codes of conduct: Guidelines from the EDPB: * EDPB, 'Guidelines 1/2019 on codes of conduct and data protection authorities pursuant to Regulation 2016/679', 4 June 2019 (version 2.0) (available here), and * EDPB, 'Guidelines 1/2019 on codes of conduct and data protection authorities pursuant to Regulation 2016/679', 4 June 2019 (version 2.0) (available [https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201901_v2.0_codesofconduct_en.pdf here]), and * EDPB, 'Guidelines 04/2021 on codes of conduct as mechanisms for data sharing', 22 February 2022 (version 2.0), (available [https://www.edpb.europa.eu/system/files/2022-03/edpb_guidelines_codes_conduct_transfers_after_public_consultation_en_1.pdf here]). * EDPB, 'Guidelines 04/2021 on codes of conduct as mechanisms for data sharing', 22 February 2022 (version 2.0), (available [https://www.edpb.europa.eu/system/files/2022-03/edpb_guidelines_codes_conduct_transfers_after_public_consultation_en_1.pdf here]). --- This content has been automatically translated using machine translation. The original version is available in the source language. --- This content was automatically translated using machine translation. The original version is available in the source language.

How it connects

References

Related across sources

C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) Jun 29, 2010 Personal Data Legitimate Interest Right to Restriction
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
C-293/12 Digital Rights Ireland Ltd v Minister for Communications C-293/12 (Digital Rights Ireland) CJEU Apr 8, 2014 IP Address Storage Limitation Right to be Forgotten
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervisory Authorities IP Address Supervision
Guidelines 04/2021 Codes of Conduct as tools for transfers Guidelines on codes of conduct and monitoring bodies Guidelines ·EDPB Feb 22, 2022 International Transfer Processing Agreement Codes of Conduct
Related documents