EU Data Act Penalties and Enforcement

Article 40 requires each Member State to set penalties for Data Act infringements, implement them, and make them effective, proportionate, and dissuasive. Member States had to notify the Commission of their rules and measures by 12 September 2025 and must notify later amendments without delay. The Commission must maintain an accessible public register of those measures.

Do not present a universal Data Act cap, a guessed share of worldwide turnover, or an unpublished national schedule as harmonised EU law. Establish the applicable national measure and authority first, then apply Article 40's common factors to the alleged infringement.

This page cannot calculate a fine without the national rule and case facts. It can identify the jurisdiction, enforcement route, statutory factors, and records needed for a defensible assessment.

When setting penalty rules and imposing penalties, Member States must take account of European Data Innovation Board recommendations and Article 40's non-exhaustive criteria. Preserve the underlying facts rather than only the final legal conclusion.

Tie the alleged infringement to the affected Data Act obligation, products or services, period, affected parties, remediation, previous infringements, reliably established benefit or avoided loss, and the infringing party's annual Union turnover in the preceding financial year. Turnover is a penalty factor here, not a universal percentage-based Data Act cap.

An entity established in one Member State is generally subject to that Member State's competence. An entity established in several Member States is subject to the Member State of its main establishment. A non-EU entity that offers covered products or services in the Union must appoint a legal representative and is subject to the Member State where that representative is located; until it does, all Member States may have competence where applicable.

Complaint venue is broader. A natural or legal person may complain to the relevant competent authority in the Member State of habitual residence, place of work, or establishment. Authorities must cooperate, so the place a complaint is lodged may differ from the Member State that supervises the entity.

Record both sides of that analysis: the complainant's permitted venue; the supervised entity's establishment, main establishment, or legal representative; the provision involved; and any sectoral or personal-data competence. Ask the data coordinator for routing information when the correct authority is unclear.

The Data Act covers personal and non-personal data, but it does not displace EU or national data-protection and privacy law. Article 1(5) says those laws continue to apply and prevail if they conflict with the Data Act.

For infringements of Chapters II, III, and V, a GDPR supervisory authority may, within its scope of competence, use Article 83 GDPR fines up to the amount in Article 83(5): EUR 20 million or, for an undertaking, 4% of total worldwide annual turnover in the preceding financial year, whichever is higher. That is a specific route, not the cap for every Data Act infringement. The European Data Protection Supervisor has a separate Article 40(5) route for Chapter V infringements within its competence.

Classify the issue before using either route: connected-product access, mandatory business-to-business sharing, public-sector access, cloud switching, trade secrets, or personal-data protection. Questions about legal basis, data-subject rights, and personal-data processing may require the data protection authority.

The Data Act gives affected natural and legal persons more than one route. Complaints can go to the relevant competent authority, and Article 39 preserves the right to an effective judicial remedy against legally binding authority decisions.

If a competent authority fails to act on a complaint, Article 39 gives an affected person, under national law, either an effective judicial remedy or review by an impartial body with appropriate expertise. Record the complaint and authority response because the dates and documents may matter to that remedy.

Some Data Act disputes also have specific challenge routes. A user may challenge an Article 4(2) security restriction or an Article 4 trade-secret withholding, suspension, or refusal. A third party may challenge an Article 5 trade-secret withholding, suspension, or refusal. The available routes are a competent authority complaint, a court or tribunal, or a dispute settlement body agreed with the data holder.

Article 48 also adds the Data Act to the EU representative-actions framework. A qualified entity may seek injunctive or redress measures for infringements that harm consumers' collective interests where Directive (EU) 2020/1828 and the applicable national procedure allow it. This route does not replace an individual's complaint or judicial remedy.

Do not publish a national penalty amount unless the current measure for the relevant Member State supports it.

Avoid saying the Commission itself is the primary penalty authority for ordinary Data Act infringements. The Commission supports enforcement through public information, the European Data Innovation Board, and registers, while Member State authorities are primarily responsible for enforcement.

Do not treat the Article 40 factors as a substitute for the national penalty rule. They shape the penalty analysis but do not supply the missing national amount or procedure.