¹ Where this Regulation does not harmonise administrative penalties or where necessary in other cases, for example in cases of serious infringements of this Regulation, Member States should implement a system which provides for effective, proportionate and dissuasive penalties. ² The nature of such penalties, criminal or administrative, should be determined by Member State law.

This recital of the General Data Protection Regulation clarifies article 84 GDPR (Penalties).*