EU Data Act · Chapter IX · Implementation and Enforcement
Article 40
Penalties
Precise reading
Member States lay down effective, proportionate, dissuasive penalties; for certain infringements (incl. Ch. II duties intersecting personal data), GDPR-style administrative fines up to EUR 20M / 4% of worldwide annual turnover apply via supervisory authorities.
A summary of the operative demand, not the statute.
Plain reading
The teeth: GDPR-calibre fines stand behind the access and sharing duties.
Paraphrase.
Facts
| Applies from | 12 September 2025 |
|---|---|
| Binds | Competent Authority / Data Coordinator |
| Cross-references | Article 37 |
| On the trace | Not at any stop. |
| Rights that rest on it | None of the seven. |
The Regulation in the Official Journal · This article in the knowledge base
Not legal advice. This is the author’s own reading of the law, written to help facilities managers ask better questions. It has not been reviewed by a lawyer. For decisions, read the official text and take legal advice.