Article 84 GDPR - Penalties

1. Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.
2. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Frequently Asked Questions

Short answers to common questions about this provision. They are general information and not legal advice.

Paragraph 1 obliges them to lay down rules on other penalties applicable to infringements of the Regulation, in particular for infringements not subject to administrative fines under Article 83, and to take all measures necessary to ensure they are implemented. Those penalties must be effective, proportionate and dissuasive.

The words "in particular" show that the provision is aimed above all at closing the gap left by Article 83, whose fine tiers in paragraphs 4 to 6 do not cover every provision of the Regulation. Member States remain free to attach additional penalties to infringements that are already finable, since the text does not confine national penalties to the uncovered infringements.

Yes. The article leaves the form of the penalty to Member State law, and Recital 149 expressly contemplates rules on criminal penalties for infringements of the Regulation, including the deprivation of profits obtained through the infringement.

The Regulation does not exclude cumulation, since Article 83 fines and Article 84 penalties serve as parallel enforcement tracks. Recital 149 cautions, however, that the imposition of criminal penalties and administrative penalties should not lead to a breach of the ne bis in idem principle as interpreted in the Member State concerned.

Yes. Paragraph 2 required each Member State to notify the Commission of the provisions adopted under paragraph 1 by 25 May 2018 and obliges it to notify, without delay, any subsequent amendment affecting them.