Art. 92 GDPR – Exercise of the delegation
| Paragraph | What it says | Covers |
|---|---|---|
| Art. 92(1) | The Commission’s power to adopt delegated acts is subject to the conditions in this Article. | Scope of the power |
| Art. 92(2) | The delegations in Article 12(8) and Article 43(8) run for an indeterminate period from 24 May 2016. | Duration |
| Art. 92(3) | The European Parliament or the Council may revoke either delegation at any time, from the day after publication in the Official Journal or a later date. Delegated acts already in force stay valid. | Revocation |
| Art. 92(4) | The Commission notifies each delegated act to the Parliament and the Council simultaneously. | Notification |
| Art. 92(5) | A delegated act enters into force only if neither institution objects within three months, or both say earlier that they will not object. Either can extend the period by three months. | Objection |
Full text of Article 92
- The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
- The delegation of power referred to in Article 12(8) and Article 43(8) shall be conferred on the Commission for an indeterminate period of time from 24 May 2016.
- 1The delegation of power referred to in Article 12(8) and Article 43(8) may be revoked at any time by the European Parliament or by the Council. 2A decision of revocation shall put an end to the delegation of power specified in that decision. 3It shall take effect the day following that of its publication in the Official Journal of the European Union or at a later date specified therein. 4It shall not affect the validity of any delegated acts already in force.
- As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
- 1A delegated act adopted pursuant to Article 12(8) and Article 43(8) shall enter into force only if no objection has been expressed by either the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. 2That period shall be extended by three months at the initiative of the European Parliament or of the Council.
In short
Article 92 is about the Commission, not about controllers. Two GDPR provisions let the European Commission fill in detail by delegated act: the content and procedures for standardised icons (Art. 12(8)) and the requirements for certification mechanisms (Art. 43(8)). Article 92 sets the terms. The power has no end date, but the European Parliament or the Council can revoke it at any time, and either can stop an individual act by objecting within three months. It places no duties on controllers or processors.
Key Facts
| Chapter | Chapter X – Delegated acts and implementing acts (Art. 92–93) |
|---|---|
| Applies to | The European Commission, the European Parliament and the Council |
| Maximum fine | None. Article 92 imposes no obligations on controllers or processors, and it is not among the provisions listed in Art. 83(4)–(6) |
| Delegations covered | Standardised icons (Art. 12(8)); certification requirements (Art. 43(8)) |
| Duration | Indeterminate, from 24 May 2016, the day the GDPR entered into force (Art. 92(2); Art. 99(1)) |
| Objection period | Three months from notification, extendable once by three months (Art. 92(5)) |
| Treaty basis | Article 290 TFEU, as Recital 166 states |
| Explained by recitals | 166; see also 58 and 60 (icons) and 100 (certification) |
What the Commission Can Add, and on What Terms
Article 290 of the Treaty on the Functioning of the EU lets the legislator delegate to the Commission the power to adopt non-legislative acts of general application that supplement or amend non-essential elements of a legislative act. The legislative act has to set the objectives, content, scope and duration of the delegation, and it may let the Parliament or the Council revoke it or object to individual acts (Art. 290 TFEU). Article 92 is where the GDPR does that.
The GDPR uses the power twice. Under Article 12(8), the Commission can determine the information standardised icons should present and the procedures for providing them. Under Article 43(8), it can specify the requirements for data protection certification mechanisms. Recital 166 names both and adds that the Commission should carry out appropriate consultations, including at expert level, and send the relevant documents to the Parliament and the Council in good time.
No deadline, but a standing veto
The delegation has no expiry date and no obligation to use it: Articles 12(8) and 43(8) say the Commission “shall be empowered”, not that it must act. The control sits with the co-legislators instead. Either can revoke the delegation outright (Art. 92(3)), and no individual act enters into force while either can still object (Art. 92(5)).
Delegated Acts and Implementing Acts in the GDPR
Chapter X gives the Commission two different tools. Article 92 governs delegated acts; Article 93 governs implementing acts, adopted with a committee of Member State representatives. The GDPR says which tool applies each time.
| Tool | Procedure | Used for | Adopted so far |
|---|---|---|---|
| Delegated act | Art. 92: Parliament and Council can revoke or object | Standardised icons (Art. 12(8)); certification requirements (Art. 43(8)) | The Commission’s 2024 report on the GDPR does not mention any (COM(2024) 357) |
| Implementing act | Art. 93: committee of Member States | Including technical standards for certification (Art. 43(9)), standard contractual clauses (Art. 28(7) and 46(2)(c)) and adequacy decisions (Art. 45(3)) | Standard contractual clauses in 2021 and adequacy decisions such as the EU-US Data Privacy Framework in 2023, as the 2024 report records |
Article 92 in Practice: Icons and Certification
Article 92 sets the conditions under which the Commission can use its two delegations. The table below records the documented steps in both areas, from the drafting of the GDPR to the Commission’s latest report.
| Date | Who | What happened | Why it matters for Article 92 |
|---|---|---|---|
| 12 Mar 2014 | European Parliament | Its first-reading position included a set of icons in an annex to a proposed Article 13 a; in a small test reported by researchers, participants did not understand the icons’ graphic scheme or pictograms (Springer, 2015) | The adopted GDPR has no icon annex; icons were left to a Commission delegated act under Art. 12(8) |
| 24 May 2016 | GDPR | The Regulation enters into force (Art. 99(1)) | Both delegations start, for an indeterminate period (Art. 92(2)) |
| 11 Apr 2018 | Article 29 Working Party | Adopts revised transparency guidelines, WP260 rev.01 (ec.europa.eu) | Says the GDPR gives the Commission responsibility for a code of icons, which should be evidence-based and preceded by extensive research |
| 25 May 2018 | EDPB | Endorses WP260 rev.01 at its first plenary (Endorsement 1/2018) | The icons guidance becomes the Board’s position |
| 10 Oct 2022 | EDPB | Approves Europrivacy as the first European Data Protection Seal (Opinion 28/2022) | Certification works through criteria approved under Art. 42(5), without an Art. 43(8) delegated act |
| 25 Jul 2024 | European Commission | Second report on the application of the GDPR (COM(2024) 357) | Lists the tools the Commission adopted, such as the 2021 standard contractual clauses, and mentions no delegated act; reports that businesses find certification slow and complex to develop |
The list covers the steps documented in the sources linked. It is not a register of all Commission work on icons or certification.
Standardised icons (Art. 12(8))
The legal basis exists; a common code of icons would come from the Commission.
- Article 12(7) lets Article 13 and 14 information be given in combination with standardised icons, which must be machine-readable where presented electronically.
- The Article 29 Working Party said icons only work if the symbols are standardised and recognised across the EU, and that the GDPR gives the Commission responsibility for a code of icons, with the Board able to give an opinion (WP260 rev.01; Art. 70(1)(r)).
- It added that any standardisation should rest on evidence, after extensive research with industry and the public on how well icons work.
Certification requirements (Art. 43(8))
Certification works through criteria approved under Article 42(5), without a delegated act.
- Supervisory authorities and the Board approve certification criteria, and authorities approve accreditation requirements, as covered under Article 43.
- The Board approved Europrivacy as the first European Data Protection Seal in Opinion 28/2022.
- The Commission reported in 2024 that businesses find certification slow and complex to develop, and asked authorities to give clearer approval timelines (COM(2024) 357, section 5.1).
Recitals That Explain Article 92
- Recital 166 – Delegated Acts of the CommissionDelegates the Article 290 TFEU power to the Commission, names certification and standardised icons, and calls for consultations, including at expert level, and timely transmission of documents to the Parliament and the Council.
- Recital 58 – The Principle of TransparencyCalls for concise, easily accessible information in clear and plain language and, where appropriate, visualisation: the idea behind standardised icons.
- Recital 60 – Information ObligationSays the information owed to data subjects may be given in combination with standardised icons, machine-readable where presented electronically: the subject of the Article 12(8) delegation.
- Recital 100 – CertificationEncourages certification mechanisms and data protection seals and marks: the subject of the Article 43(8) delegation.
Checklist: What Article 92 Means for Your Compliance Work
- Give the full Article 13 and 14 information; icons, if you use them, can only accompany it (Art. 12(7); WP260 rev.01)
- If you present icons electronically, make them machine-readable (Art. 12(7))
- For certification, work from criteria approved under Art. 42(5) by your authority or the Board, not from a delegated act
- Watch the Official Journal: a delegated act on icons or certification would apply only after the objection period in Art. 92(5) has run
- If a delegation is ever revoked, check whether any act adopted under it was already in force, since those stay valid (Art. 92(3))
Frequently Asked Questions about Article 92
Keeping privacy notices clear without waiting for official icons?
Layered notices and clear, consistent wording carry the Article 13 and 14 information today. Keeping them in step with what you actually process is the part that takes ongoing work.