Eu Code Of Conduct

EU Code of Conduct Adherence per Articles 40-41 GDPR

Overview

Articles 40 and 41 of the GDPR encourage the drawing up of codes of conduct intended to contribute to the proper application of the GDPR, taking account of the specific features of the various processing sectors. A code of conduct approved under Art. 40 provides a demonstrable compliance mechanism that controllers and processors can adhere to, offering evidentiary weight during supervisory authority investigations and serving as a factor in administrative fine calculations under Art. 83(2)(j).

The EDPB adopted Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679, providing detailed guidance on the approval process, content requirements, monitoring body accreditation, and adherence mechanisms. As of 2024, the EDPB has issued opinions on several transnational codes and national supervisory authorities have approved domestic codes across sectors including cloud computing, direct marketing, clinical trials, and credit information.

Sentinel Compliance Group adheres to two approved codes of conduct: the EU Cloud Code of Conduct (SCOPE Europe) for its cloud processing activities and a national code for direct marketing activities approved by the Belgian DPA.

Legal Framework

Article 40 — Codes of Conduct

Art. 40(1): Member States, supervisory authorities, the Board, and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of the GDPR.

Art. 40(2): Codes of conduct may cover a wide range of processing areas:

Art. 40(3): Codes may be adhered to by controllers or processors not subject to the GDPR to provide appropriate safeguards for international transfers under Art. 46(2)(e), provided the code includes binding and enforceable commitments from the third-country controller or processor.

Art. 40(5): Draft codes must be submitted to the competent supervisory authority for approval. The supervisory authority provides an opinion on whether the code complies with the GDPR.

Art. 40(7): For transnational codes (covering processing activities in several Member States), the supervisory authority submits the draft to the EDPB, which issues an opinion. If the EDPB opinion is positive, the Board submits it to the Commission, which may adopt an implementing act giving general validity within the Union.

Article 41 — Monitoring Bodies

Art. 41(1): Monitoring of compliance with a code of conduct pursuant to Art. 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.

Art. 41(2): Accreditation requirements for monitoring bodies:

Art. 41(4): The monitoring body may take appropriate action in cases of infringement, including suspension or exclusion of the controller or processor from the code. It shall inform the competent supervisory authority of such actions and reasons.

EDPB Approval Requirements (Guidelines 1/2019)

Code Content Requirements

The EDPB requires approved codes to meet the following substantive criteria:

1. Added Value

The code must provide specific, practical guidance beyond merely restating GDPR provisions:

• Sector-specific interpretations of GDPR principles
• Concrete implementation guidance for the target sector
• Standardised templates, procedures, or technical measures
• Clear rules that resolve ambiguity in GDPR application to the sector

2. Scope and Applicability

• Clear definition of the sector, processing activities, and types of controllers/processors covered
• Explicit statement of which GDPR provisions the code addresses
• Geographic scope (national or transnational)
• Membership criteria and eligibility requirements

3. Representativeness

• The code owner must represent a sufficient portion of the sector
• Evidence of consultation with stakeholders including data subjects, consumer organizations, and supervisory authorities
• Support from a significant number of potential adherents

4. Effective Monitoring Mechanism

• Identification of a monitoring body meeting Art. 41 requirements
• Description of monitoring procedures including regular audits, complaint handling, and enforcement actions
• Graduated enforcement measures (warning, corrective action, suspension, exclusion)
• Annual reporting on monitoring activities

5. Complaint Handling

• Accessible complaint mechanism for data subjects
• Defined timelines for complaint investigation and resolution
• Right to escalate to the supervisory authority
• Published complaint statistics

Procedural Requirements

National Code Approval Process

1. Code Owner drafts code with stakeholder consultation
   ↓
2. Code Owner submits draft to competent Supervisory Authority
   ↓
3. Supervisory Authority assesses compliance with GDPR and EDPB Guidelines
   ↓
4. Supervisory Authority requests amendments (iterative process)
   ↓
5. Supervisory Authority approves the code (Art. 40(5))
   ↓
6. Supervisory Authority registers and publishes the code (Art. 40(6))
   ↓
7. Commission compiles approved codes in a register (Art. 40(11))

Transnational Code Approval Process

1. Code Owner drafts code with multi-country stakeholder consultation
   ↓
2. Code Owner submits draft to the lead Supervisory Authority
   ↓
3. Lead Supervisory Authority conducts initial assessment
   ↓
4. Lead Supervisory Authority submits draft to EDPB for opinion (Art. 40(7))
   ↓
5. EDPB Secretariat circulates to all concerned Supervisory Authorities
   ↓
6. EDPB issues opinion (positive, positive with conditions, or negative)
   ↓
7. If positive: Lead Supervisory Authority approves the code
   ↓
8. Commission may adopt implementing act giving general validity (Art. 40(9))

Monitoring Body Accreditation

Accreditation Process

1. Application: The proposed monitoring body submits an accreditation application to the competent supervisory authority
2. Assessment: The supervisory authority evaluates the application against Art. 41 requirements and the EDPB accreditation criteria
3. Decision: The supervisory authority grants or denies accreditation
4. Duration: Accreditation is typically granted for a period of five years, renewable
5. Review: The supervisory authority may review and revoke accreditation if the monitoring body no longer meets the requirements

Monitoring Body Functions

Monitoring Methodology

The monitoring body assesses adherent compliance through:

• Documentation Review: Privacy policies, processing records, DPIAs, DPAs, and other documented evidence
• Technical Assessment: Verification of technical measures specified in the code
• Interviews: Discussions with key personnel responsible for privacy compliance
• Sample Testing: Testing of specific controls (DSAR handling, consent mechanisms, deletion processes)
• Complaint Analysis: Review of data subject complaints and their resolution
• Incident Review: Assessment of data breach handling in accordance with code requirements

Adherence Declaration