http://www.legislation.gov.uk/eudr/2013/40/article/11Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHADirective 2013/40/EU of the European Parliament and of the CouncilDirective 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA2020-12-11King's Printer of Acts of Parliamenthttps://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32013L0040texttext/xmlen2013-08-12 Sanctions against legal persons Article 11 1 Member States shall take the necessary measures to ensure that a legal person held liable pursuant to Article 10(1) is punishable by effective, proportionate and dissuasive sanctions, which shall include criminal or non-criminal fines and which may include other sanctions, such as: a exclusion from entitlement to public benefits or aid; b temporary or permanent disqualification from the practice of commercial activities; c placing under judicial supervision; d judicial winding-up; e temporary or permanent closure of establishments which have been used for committing the offence. 2 Member States shall take the necessary measures to ensure that a legal person held liable pursuant to Article 10(2) is punishable by effective, proportionate and dissuasive sanctions or other measures.