---
type: Statutory Article
title: "Article 40 — Penalties"
description: "The teeth: GDPR-calibre fines stand behind the access and sharing duties."
resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
tags: ["eu-data-act", "chapter-ix", "enforcement"]
instrument: eu-data-act
article: 40
chapter: "IX"
binds: ["authority"]
applies_from: 2025-09-12
cross_refs: [37]
attaches_to: []
legal_review: none
generated: { by: claude-code/opus-5.5, at: "2026-10-09T00:00:00Z" }
status: draft
sources:
  - id: eli
    resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
    title: "Regulation (EU) 2023/2854, Official Journal"
  - id: prototype
    resource: "https://github.com/DavidJCrawford/stewardship-explorer/blob/main/src/data/act.json"
    title: "stewardship-explorer act.json (author's summaries, July 2026)"
---

# Precise reading

Member States lay down effective, proportionate, dissuasive penalties; for certain infringements (incl. Ch. II duties intersecting personal data), GDPR-style administrative fines up to EUR 20M / 4% of worldwide annual turnover apply via supervisory authorities.[^eli]

*A faithful summary of the operative demand, not the statutory text.*

# Plain reading

The teeth: GDPR-calibre fines stand behind the access and sharing duties.

*Paraphrase.*

# Facts

| | |
| --- | --- |
| Chapter | IX — [Implementation and Enforcement](/law/eu-data-act/chapters.md) |
| Binds | [Competent Authority / Data Coordinator](/law/eu-data-act/actors.md) |
| Applies from | 2025-09-12 |
| Cross-references | [Article 37](/law/eu-data-act/articles/article-37.md) |
| Where it attaches in the building | Nowhere in the building directly. |

# Rights that rest on it

- None of the seven rights rests on this article directly.

[^eli]: Regulation (EU) 2023/2854, Official Journal