Codes of conduct are increasingly being used to concretise specific sections of the General Data Protection Regulation. Against the backdrop of the general discussion in administrative law on regulated self-regulation, Tim Templin investigates how Article 40 of the GDPR is being put into practice with codes of conduct that have so far been approved.