Komentarz do art. 41

Jump to content

GDPR – commentary

A continuously updated commentary on the General Data Protection Regulation.
We only write about what is important in practice.

The monitoring of approved codes of conduct

  • Approved codes of conduct must be monitored by entities accredited for this purpose.

The code of conduct must provide for mechanisms for carrying out mandatory monitoring of compliance with the code by controllers or processors who have undertaken to apply it. The indication in the code of conduct, to be applied by private sector controllers or processors of an accredited entity, that they will monitor compliance with the code of conduct, is a prerequisite for the supervisory authority to be able to approve the submitted code.

Compliance with the code of conduct may be monitored by an entity with adequate expertise in the relevant field and accredited by the competent supervisory authority for this purpose. In 2021, the POPDP has developed accreditation requirements for code of conduct monitors.

The monitoring entity shall take appropriate action in the event of a breach of the code by the controller or processor, including suspending or excluding the controller or processor from applying the code.

The power of the accredited body to monitor compliance with the code of conduct does not exclude the supervisory authority’s power to monitor compliance with the GDPR provisions.