General Data Protection Regulation

CHAPTER V Table of Contents

103

GDPR - Pocket Edition

(g) the information provided to, and the protection of, children, and the

manner in which the consent of the holders of parental responsibility

over children is to be obtained;

(h) the measures and procedures referred to in Articles 24 and 25 and the

measures to ensure security of processing referred to in Article 32;

(i) the notification of personal data breaches to supervisory authorities and

the communication of such personal data breaches to data subjects;

(j) the transfer of personal data to third countries or international

organisations; or

(k) out-of-court proceedings and other dispute resolution procedures for

resolving disputes between controllers and data subjects with regard

to processing, without prejudice to the rights of data subjects pursuant

to Articles 77 and 79.

In addition to adherence by controllers or processors subject to this

Regulation, codes of conduct approved pursuant to paragraph 5 of this

Article and having general validity pursuant to paragraph 9 of this Article

may also be adhered to by controllers or processors that are not subject

to this Regulation pursuant to Article 3 in order to provide appropriate

safeguards within the framework of personal data transfers to third

countries or international organisations under the terms referred to in

point (e) of Article 46(2). Such controllers or processors shall make binding

and enforceable commitments, via contractual or other legally binding

instruments, to apply those appropriate safeguards including with regard

to the rights of data subjects.

A code of conduct referred to in paragraph 2 of this Article shall contain

mechanisms which enable the body referred to in Article 41(1) to carry

out the mandatory monitoring of compliance with its provisions by the

controllers or processors which undertake to apply it, without prejudice

to the tasks and powers of supervisory authorities competent pursuant to

Article 55 or 56.

Associations and other bodies referred to in paragraph 2 of this Article

which intend to prepare a code of conduct or to amend or extend an

existing code shall submit the draft code, amendment or extension to

the supervisory authority which is competent pursuant to Article 55. The

supervisory authority shall provide an opinion on whether the draft code,

amendment or extension complies with this Regulation and shall approve

that draft code, amendment or extension if it finds that it provides sufficient

appropriate safeguards.

Where the draft code, or amendment or extension is approved in accordance

with paragraph 5, andwhere the code of conduct concerned does not relate

to processing activities in several Member States, the supervisory authority

shall register and publish the code.

Where a draft code of conduct relates to processing activities in several

Member States, the supervisory authority which is competent pursuant to

Article 55 shall, before approving the draft code, amendment or extension,

submit it in the procedure referred to in Article 63 to the Board which shall

provide an opinion on whether the draft code, amendment or extension

complies with this Regulation or, in the situation referred to in paragraph 3

of this Article, provides appropriate safeguards.