Data Act Penalties and Fines: Article 40, the GDPR Fine Link and National Fine Levels

Apart from a smaller Chapter V fine power of the European Data Protection Supervisor (EDPS), every fine for a breach of the EU Data Act comes from national law.

Regulation (EU) 2023/2854 has been in force since 11 January 2024 and has applied since 12 September 2025 (Art. 50). Member States had to notify their penalty rules to the Commission by that same date (Art. 40(2)).

This page reads Article 40 paragraph by paragraph, then the GDPR fine link of Article 40(4) and 40(5), then the national fine levels as of 5 November 2026.

What Does Article 40 Require of Member States?

Article 40 Regulation (EU) 2023/2854 obliges every Member State to lay down penalty rules for infringements of the Data Act, to take all measures necessary to ensure they are implemented and to notify them to the Commission, while the Regulation itself fixes no amount. Article 40 sits in Chapter IX next to Article 37, whose competent authorities apply these penalties, as set out under Data Act enforcement.

Article 40 has five paragraphs, and the Commission has proposed a sixth.

Effective, Proportionate and Dissuasive Penalties under Article 40(1)

Penalties must be effective, proportionate and dissuasive, and Member States take all measures necessary to ensure they are implemented (Art. 40(1)). The Commission FAQ on the Data Act, version 1.4 of 22 January 2026, reads this in Q70 as leaving penalties unharmonised: Member States set them. The FAQ is a non-binding reading. The Data Act is a Regulation, directly applicable in all Member States, so national acts only designate authorities and set penalties.

The 12 September 2025 Notification Deadline and the Public Register

Member States had to notify their penalty rules and measures to the Commission by 12 September 2025, and must notify every later amendment affecting them without delay (Art. 40(2)). The second sentence of Article 40(2) obliges the Commission to "regularly update and maintain an easily accessible public register of those measures". Article 37 sets no date for designating competent authorities, so 12 September 2025 is a notification date for penalty rules, not a designation deadline.

Six Criteria for Setting a Penalty under Article 40(3)

Article 40(3) gives six non-exhaustive criteria, which Member States apply together with the recommendations of the European Data Innovation Board (EDIB):

• Nature, gravity, scale and duration of the infringement (a).
• Mitigation or remedy of the damage by the infringing party (b).
• Previous infringements (c).
• Financial benefits gained or losses avoided, where reliably established (d).
• Other aggravating or mitigating factors (e).
• Annual turnover in the preceding financial year in the Union (f).

Union turnover under point (f) is a criterion, not a cap; as of 5 November 2026, national laws use worldwide total turnover in Germany, EU turnover in the Netherlands and Accounting Act turnover in Finland. Recital 110 makes the EDIB the platform on which competent authorities evaluate, coordinate and adopt recommendations on setting penalties; see the European Data Innovation Board.

How the GDPR Fine Link of Article 40(4) and 40(5) Works

Article 40(4) and 40(5) Regulation (EU) 2023/2854 add two EU-level fine ceilings that apply only to data protection supervisors: GDPR supervisory authorities for Chapters II, III and V, and the EDPS for Chapter V. Both ceilings come from data protection law, the GDPR and Regulation (EU) 2018/1725, as the table shows.

Chapters IV and VI are fined only under national rules.

Fines up to the Article 83(5) GDPR Amount for Chapters II, III and V

For infringements of Chapters II, III and V, the authorities that supervise Regulation (EU) 2016/679 may, within their competence, impose administrative fines under Article 83 GDPR up to the Article 83(5) amount: EUR 20,000,000 or, for an undertaking, 4 % of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 40(4)). This link has applied since 12 September 2025 and reaches only matters within their competence, which Article 37(3) ties to personal data.

Chapters IV (unfair contractual terms) and VI (switching between data processing services) are outside Article 40(4), so fines there come only from national rules set under Article 40(1). Where the two Regulations conflict, the GDPR prevails (Art. 1(5)); see the Data Act vs the GDPR.

EDPS Fines for Chapter V Infringements

The European Data Protection Supervisor may fine Chapter V infringements within its competence under Article 66 of Regulation (EU) 2018/1725, up to EUR 50,000 per infringement and EUR 500,000 per year in total (Art. 40(5) with Art. 66(3)). Chapter V governs data requests by public sector bodies and Union bodies in exceptional need; Regulation (EU) 2018/1725 covers Union institutions, bodies, offices and agencies.

National Fine Levels as of 5 November 2026

As of 5 November 2026, the national Data Act fine rules covered here run from the four § 15(4) tiers of the German Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz (DADG) and the turnover-based caps of the Netherlands and Finland to Danish fines with no stated maximum, while France, Luxembourg and Poland have only pending bills. The table covers only the countries listed. The German tiers come from § 15 DADG.

Countries not listed are not covered here; see the country pages.

Germany: The § 15(4) DADG Fine Tiers by Offence Category

As of 5 November 2026, § 15(4) DADG sets four fine tiers, EUR 5,000,000, EUR 500,000, EUR 100,000 and EUR 50,000, each tied to a list of offences that point to Data Act articles. Only intentional conduct is punishable under § 15(1) and (2), not negligence (BT-Drs. 21/2998). The Bundesnetzagentur is the fining authority (§ 15(7) DADG), while the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, BfDI) imposes the Article 40(4) fines as regards personal data (§ 16 DADG).

Section 15 refers to the "Datenverordnung in der Fassung vom 13. Dezember 2023" (the Regulation as of 13 December 2023), so an adopted Digital Omnibus would need its own DADG amendment. No Bundesnetzagentur fine or decision under the DADG was found as of 5 November 2026. Forms and complaints are covered under the Data Act in Germany.

The Netherlands: ACM Fines up to the Sixth Category

As of 5 November 2026, the Dutch Uitvoeringswet dataverordening (Stb. 2025, 372) lets the Autoriteit Consument en Markt (ACM) fine up to the sixth fine category of Article 23(4) of the Dutch Criminal Code, EUR 1,100,000 since 1 January 2026 (Stb. 2025, 401), or 10 % of the infringer's EU turnover in the preceding financial year where that is higher (art. 8). The Dutch data protection authority, the Autoriteit Persoonsgegevens, fines up to the Article 40(4) amount.

France: Penalties Proposed in the Pending DDADUE Bill

As of 5 November 2026, France has no Data Act penalty law: the pending DDADUE bill (projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne) proposes fines of up to 3 % of worldwide turnover excluding tax of the last closed financial year, 5 % on repeat, or EUR 150,000 (EUR 375,000 on repeat) where no turnover basis exists. The bill proposes the Autorité de régulation des communications électroniques, des postes et de la distribution de la presse (Arcep) as the authority for the Regulation except Chapter VII.

Which Penalties besides Fines Can Authorities Use?

Fines are not the only penalty: recital 109 adds warnings, reprimands and orders to bring business practices into compliance, and asks competent authorities to use interim measures, where appropriate, while an investigation is ongoing. Recital 109 of Regulation (EU) 2023/2854 also names factors to weigh, such as the public interest at stake, the scope and kind of activities, the economic capacity of the infringing party and whether it systematically or recurrently fails to comply.

Article 37(5)(d) gives competent authorities the task of imposing effective, proportionate and dissuasive financial penalties, "which may include periodic penalties and penalties with retroactive effect", or of initiating legal proceedings for the imposition of fines. As of 5 November 2026, Germany adds a coercive fine (Zwangsgeld) of up to EUR 500,000 (§ 9(6) DADG), and the Dutch ACM may impose an administrative enforcement order (last onder bestuursdwang). The other powers are set out under Data Act competent authorities.

How to Reduce Penalty Exposure under the Data Act

Penalty exposure under the Data Act falls when a business runs seven checks and keeps evidence of each:

1. Map the obligations per role, starting with the scope check below.
2. Identify the competent Member State: the Member State of establishment or of main establishment, or, for a business outside the EU, the Member State of its legal representative (Art. 37(10), (11), (13)); see the Data Act for non-EU companies.
3. Check the national instrument, its caps and its turnover basis in the national table above.
4. Prioritise the duties in the EUR 500,000 tier of § 15(4) DADG: data access by design (Art. 3(1)), the user's right to access data (Art. 4(1)), sharing (Art. 5(1)) and the competing-product ban (Art. 4(10)).
5. Separate personal-data processes, which fall under the Article 40(4) GDPR route.
6. Document every mitigation and remediation step, which Article 40(3)(b) lists as a criterion.
7. Track the pending national bills and the Digital Omnibus proposal COM(2025) 837.

Two criteria work against the business: previous infringements (Art. 40(3)(c)) and financial benefits gained or losses avoided (Art. 40(3)(d)), so a repeated or profitable breach weighs more heavily.

As of 5 November 2026, German fines under § 15(1) and (2) DADG require intent, while the Danish datadelingsloven also reaches negligent breaches.

Every duty behind these penalties is listed in the Data Act compliance checklist.

Where Penalties Sit among Supervision, Complaints and Pending Changes

Penalties are the last step of a Data Act enforcement chain that starts with the competent authorities of Article 37, runs through complaints under Article 38 and ends with judicial remedies under Article 39. Four related topics sit beside the penalty rules:

• National status: dated authorities and penalty laws per country, under Data Act implementation by country.
• Complaints: a complaint to a competent authority under Article 38, or Data Act dispute settlement bodies certified under Article 10.
• Judicial remedy: against legally binding decisions of competent authorities, or where an authority fails to act on a complaint, before the courts of its Member State (Art. 39).
• Evaluation: by 12 September 2028, including "the efficacy of the enforcement regime required under Article 37" (Art. 49(1)(l)).

The Digital Omnibus proposal would add Article 40(6), under which Article 40 would not apply to a proposed new Chapter VIIc on the re-use of public sector data. Its status is pending: Commission proposal COM(2025) 837 of 19 November 2025, Council mandate agreed by Coreper on 21 October 2026 (ST 14756/26 of 22 October 2026), European Parliament committee stage (ITRE/LIBE, "Awaiting committee decision", no committee vote) as of 5 November 2026; not law (procedure 2025/0360(COD); Data Act amendments).

Questions about Data Act Penalties

Five questions recur about Data Act fines.

Does the Data Act set a maximum fine?

No: Article 40(1) leaves the amount to national law, and the only EU figure is the Article 83(5) GDPR ceiling that GDPR supervisory authorities may use, within their competence, for Chapters II, III and V (Art. 40(4)). The EDPS may fine Chapter V infringements up to EUR 50,000 per infringement and EUR 500,000 per year (Art. 40(5)).

Can a data protection authority fine a breach of the cloud switching rules?

No: Article 40(4) covers Chapters II, III and V only, so Chapter VI switching breaches are penalised under national rules set under Article 40(1). As of 5 November 2026, in Germany the Bundesnetzagentur fines the § 15(2) DADG offences, including the switching offences of Nos. 19 to 25 (§ 15(7) DADG).

Who can fine a company established outside the EU?

Until it designates a legal representative, a non-EU company within the Data Act is under the competence of all Member States where applicable, and any competent authority may penalise it unless another authority already has proceedings on the same facts (Art. 37(13)); recital 109 asks the acting Member State to inform all data coordinators and the Commission. As of 5 November 2026, Germany fines a failure to designate or mandate a representative up to EUR 50,000 (§ 15(2) Nos. 26 and 27 DADG); see the Data Act for non-EU companies.

Would the Digital Omnibus change Article 40?

The pending Commission proposal COM(2025) 837 would add Article 40(6), under which Article 40 would not apply to a new Chapter VIIc on the re-use of public sector data. As of 5 November 2026 it is pending (Coreper mandate of 21 October 2026, European Parliament committee stage), not law.

Are German fines under the DADG EU-wide amounts?

No: the § 15(4) DADG tiers apply only to offences that the Bundesnetzagentur prosecutes under German law, as of 5 November 2026. Every other Member State sets its own penalty rules under Article 40(1); the national table above shows the caps covered here.