Chapter VIII — Confidentiality and penalties

All parties shall respect the confidentiality of the following information and data obtained in carrying out their tasks in accordance with this Regulation:

(a) personal data;

(b) commercially confidential information and trade secrets of a natural or legal person, including intellectual property rights, unless disclosure is in the public interest.
Without prejudice to paragraph 1, information exchanged on a confidential basis between the competent national authorities and between competent national authorities and the Commission shall not be disclosed without the prior agreement of the competent national authority that originally provided the information.
Paragraphs 1 and 2 shall not affect the rights and obligations of the Commission, Member States and notified bodies with regard to the exchange of information and the dissemination of warnings, nor shall it affect the obligations of the persons concerned to provide information under criminal law.
The Commission and Member States may exchange confidential information with regulatory authorities of third countries with which they have bilateral or multilateral confidentiality agreements and arrangements when those agreements and arrangements ensure that any exchange of information is in accordance with applicable Union law.

Member States shall lay down the rules on penalties applicable to infringements by economic operators of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive and may include criminal penalties for serious infringements.
Member States shall, by 20 October 2026, notify the Commission of those rules and of those measures and shall notify it, without delay, of any subsequent amendment affecting them.