EU Data Act Penalties and Enforcement

The Data Act leaves penalty rules to Member States. Article 40 requires each Member State to lay down penalties for infringements of the Regulation and to take the measures needed to implement them.

That means a compliance note should not present a universal Data Act fine cap, a guessed percentage of worldwide turnover, or an unpublished national schedule as if it were already harmonised EU law. The grounded statement is narrower: Member State penalties must be effective, proportionate, and dissuasive, and Member States had to notify the Commission of their rules and measures by 12 September 2025 and later amendments without delay.

For search visitors comparing risk, the practical takeaway is to track the national implementing measure for the relevant Member State and then apply Article 40's penalty factors to the facts of the alleged infringement.

Article 40 lists non-exhaustive criteria for penalty decisions. The file should therefore show more than a final legal conclusion; it should preserve facts that an authority could use to assess severity and proportionality.

The most useful internal record ties the alleged infringement to its affected Data Act obligation, the products or services involved, the time period, impacted parties, remediation steps, prior similar issues, any financial benefit or avoided loss that can be reliably established, and the infringing party's annual turnover in the Union for the preceding financial year.

Article 37 requires each Member State to designate one or more competent authorities for Data Act application and enforcement. If a Member State designates more than one authority, it must designate a data coordinator to facilitate cooperation and assist entities on Data Act application and enforcement questions.

For a complaint or enforcement intake, record the complainant's habitual residence, place of work, or establishment, the supervised entity's establishment or legal representative, the Data Act provision involved, and whether another authority has sectoral or personal-data competence.

Article 38 gives natural and legal persons the right to lodge complaints with the relevant competent authority if they consider their Data Act rights have been infringed. The data coordinator must provide information needed to lodge complaints with the appropriate competent authority upon request.

The Data Act covers personal and non-personal data, but it does not supersede the GDPR. Article 1(5) says personal data protection law continues to apply and prevails in the event of conflict.

Article 37(3) gives GDPR supervisory authorities responsibility for monitoring Data Act application insofar as personal data protection is concerned. Article 40 then gives DPAs, within their competence, power to impose GDPR-style administrative fines for infringements of Data Act obligations in Chapters II, III, and V.

In practice, a Data Act enforcement file should mark whether the issue is about access to connected-product data, B2B mandatory data sharing, public-sector access, cloud switching, trade secrets, or personal data protection. Personal data questions such as valid legal basis, data subject access, portability, and classification of personal data may need DPA handling.

The Data Act gives affected natural and legal persons more than one route. Complaints can go to the relevant competent authority, and Article 39 preserves the right to an effective judicial remedy against legally binding authority decisions.

Where a competent authority fails to act on a complaint, Article 39 gives affected persons a route, under national law, to judicial remedy or review by an impartial body with appropriate expertise. That makes complaint tracking operationally important: missed responses, incomplete authority packets, and unclear ownership can become part of the dispute record.

Some Data Act disputes also have specific challenge routes. For example, where a data holder suspends, withholds, or refuses sharing on trade secret or security grounds, the user or third party may challenge the decision through a competent authority complaint, court or tribunal, or agreed dispute settlement body.

A useful penalties page should be explicit about what is not yet grounded. Avoid publishing national penalty amounts unless the applicable national measure is identified in the grounding source and current for the relevant Member State.

Avoid saying the Commission itself is the primary penalty authority for ordinary Data Act infringements. The Commission supports enforcement through public information, the European Data Innovation Board, and registers, while Member State authorities are primarily responsible for enforcement.

Avoid treating Article 40 factors as optional compliance theatre. They are the facts that make a penalty decision easier or harder to defend.