Article 40. Codes of conduct

(1) The Centre shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Law, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises.

(2) Associations and other bodies representing categories of controllers or processors may draw up codes of conduct, or amend existing codes, for the purpose of specifying the application of this Law, such as with regard to:

1. a) fair and transparent processing;
2. b) the legitimate interests pursued by controllers in specific contexts;
3. c) the collection of personal data;
4. d) the pseudonymisation of personal data;
5. e) informing the public and data subjects;
6. f) the exercise of the rights of data subjects;
7. g) informing and protecting children, and the manner in which the consent of the legal representatives of children is to be obtained;
8. h) the measures and procedures referred to in art. 24 and 25 and the measures to ensure security of processing referred to in art. 32;
9. i) notifying the Centre of personal data breaches and informing data subjects of such breaches;
10. j) the transfer of personal data to other states or to international organisations; or
11. k) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to art. 72 and art. 74.

(3) In addition to adherence by controllers or processors subject to this Law, codes of conduct approved pursuant to paragraph (5) may also be adhered to by controllers or processors that are not subject to this Law pursuant to art. 3, in order to provide appropriate safeguards within the framework of transfers of personal data to other states or to international organisations under the conditions referred to in art. 46(2)(d). Such controllers or processors shall make binding and enforceable commitments, via contractual instruments or other binding legal acts, to apply those appropriate safeguards, including with regard to the rights of data subjects.

(4) A code of conduct referred to in paragraph (2) shall contain mechanisms which enable the body referred to in art. 41(1) to carry out the mandatory monitoring of compliance with its provisions by the controllers or processors which undertake to apply it, without prejudice to the tasks and powers of the Centre.

(5) Associations and other bodies referred to in paragraph (2) which intend to draw up a code of conduct or to amend an existing code shall submit the draft code or amendment to the Centre. The Centre shall provide an opinion on whether the draft code or amendment complies with this Law and shall approve it if it finds that it provides sufficient appropriate safeguards.

(6) Where the draft code or amendment is approved in accordance with paragraph (5), the Centre shall register and publish the code on its official website.

(7) The Centre shall keep a register of the approved codes of conduct and amendments and shall ensure the publication on its official website of the updated and consolidated texts of the codes of conduct after approval of amendments to them.