{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":null,"checked_against":null},"truncation":{"shown":21,"total":21,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/gdpr/articles/40","url":"https://www.headlesslaw.com/gdpr/articles/40","title":"Article 40 — Codes of conduct","work_id":"gdpr","date_state":"current","as_of":"2026-11-02","relations_url":"https://www.headlesslaw.com/gdpr/articles/40/relations"},"as_of":"2026-11-02","counts":{"refers_to:out":9,"refers_to:in":12},"relations":[{"edge_id":"b56a6012f7b932357c0f","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 55","dst_raw":"eu.gdpr.article.55","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/55","url":"/gdpr/articles/55","title":"Competence","key":"55","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.4"}},{"edge_id":"dc20c1551d01e7bcd057","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 41(1)","dst_raw":"eu.gdpr.article.41","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/41","url":"/gdpr/articles/41","title":"Monitoring of approved codes of conduct","key":"41","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.4"}},{"edge_id":"57c0f1d3b3b3619b31fd","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 63","dst_raw":"eu.gdpr.article.63","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/63","url":"/gdpr/articles/63","title":"Consistency mechanism","key":"63","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.7"}},{"edge_id":"abbaea3b6aee8b899588","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 55","dst_raw":"eu.gdpr.article.55","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/55","url":"/gdpr/articles/55","title":"Competence","key":"55","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.7"}},{"edge_id":"0b3eeefb3276984c75f5","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 46(2)","dst_raw":"eu.gdpr.article.46","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/46","url":"/gdpr/articles/46","title":"Transfers subject to appropriate safeguards","key":"46","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.3"}},{"edge_id":"b9b70360044cfa55cbdc","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 3","dst_raw":"eu.gdpr.article.3","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/3","url":"/gdpr/articles/3","title":"Territorial scope","key":"3","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.3"}},{"edge_id":"c3b725e3b3a08c167dd4","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 32","dst_raw":"eu.gdpr.article.32","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/32","url":"/gdpr/articles/32","title":"Security of processing","key":"32","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.2.point.h"}},{"edge_id":"d64231d565fd29f799e7","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 93(2)","dst_raw":"eu.gdpr.article.93","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/93","url":"/gdpr/articles/93","title":"Committee procedure","key":"93","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.9"}},{"edge_id":"29d0701329fbdddc1ca7","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 55","dst_raw":"eu.gdpr.article.55","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/55","url":"/gdpr/articles/55","title":"Competence","key":"55","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.5"}},{"edge_id":"06e598138d8a00497cca","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40(5)","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/57/para/1/pt/m","url":"/gdpr/articles/57#p-1-m","title":"Tasks","key":"57(1)(m)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.57","source_block_id":"eu.gdpr.article.57.paragraph.1.point.m"}},{"edge_id":"1a81c0f0c0238c4d4080","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40(9)","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/70/para/1/pt/x","url":"/gdpr/articles/70#p-1-x","title":"Tasks of the Board","key":"70(1)(x)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.70","source_block_id":"eu.gdpr.article.70.paragraph.1.point.x"}},{"edge_id":"3bd79cf1af8213f659a0","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/28/para/5","url":"/gdpr/articles/28#p-5","title":"Processor","key":"28(5)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.28","source_block_id":"eu.gdpr.article.28.paragraph.5"}},{"edge_id":"67482ea2305bd99bc8c4","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/32/para/3","url":"/gdpr/articles/32#p-3","title":"Security of processing","key":"32(3)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.32","source_block_id":"eu.gdpr.article.32.paragraph.3"}},{"edge_id":"7a9cbb2b35911d122a99","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/41/para/1","url":"/gdpr/articles/41#p-1","title":"Monitoring of approved codes of conduct","key":"41(1)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.41","source_block_id":"eu.gdpr.article.41.paragraph.1"}},{"edge_id":"818a5e931673a3ce52b3","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/46/para/2/pt/e","url":"/gdpr/articles/46#p-2-e","title":"Transfers subject to appropriate safeguards","key":"46(2)(e)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.46","source_block_id":"eu.gdpr.article.46.paragraph.2.point.e"}},{"edge_id":"880c8932d7f7210690e4","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/24/para/3","url":"/gdpr/articles/24#p-3","title":"Responsibility of the controller","key":"24(3)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.24","source_block_id":"eu.gdpr.article.24.paragraph.3"}},{"edge_id":"9383860547bb6c33e90a","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/83/para/2/pt/j","url":"/gdpr/articles/83#p-2-j","title":"General conditions for imposing administrative fines","key":"83(2)(j)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.83","source_block_id":"eu.gdpr.article.83.paragraph.2.point.j"}},{"edge_id":"b3f14d6989bf06370fb7","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/35/para/8","url":"/gdpr/articles/35#p-8","title":"Data protection impact assessment","key":"35(8)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.35","source_block_id":"eu.gdpr.article.35.paragraph.8"}},{"edge_id":"bb548de137034d96938d","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40(1)","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/57/para/1/pt/m","url":"/gdpr/articles/57#p-1-m","title":"Tasks","key":"57(1)(m)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.57","source_block_id":"eu.gdpr.article.57.paragraph.1.point.m"}},{"edge_id":"bbf9602d207704441ea4","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40(5)","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/58/para/3/pt/d","url":"/gdpr/articles/58#p-3-d","title":"Powers","key":"58(3)(d)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.58","source_block_id":"eu.gdpr.article.58.paragraph.3.point.d"}},{"edge_id":"c53a558daa9db1d7f65c","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40(7)","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/64/para/1/pt/b","url":"/gdpr/articles/64#p-1-b","title":"Opinion of the Board","key":"64(1)(b)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.64","source_block_id":"eu.gdpr.article.64.paragraph.1.point.b"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}