Recital 152
Recital 152 of the GDPR, as in force since 25 May 2018. Its key is gdpr-recitals:rec-152.
Where this Regulation does not harmonise administrative penalties or where necessary in other cases, for example in cases of serious infringements of this Regulation, Member States should implement a system which provides for effective, proportionate and dissuasive penalties. The nature of such penalties, criminal or administrative, should be determined by Member State law.