Source: OJ L, 2023/2854, 22.12.2023

Article 28 Contractual transparency obligations on international access and transfer

Summary What does Article 28 of the Data act regulation say?

This article establishes a transparency obligation on providers of data processing services, requiring them to publicly disclose specific information about their infrastructure and data protection practices.

It sits alongside Article 32, which deals more substantively with the actual measures to prevent unlawful third-country governmental access to non-personal data — Article 28 is essentially the public-facing disclosure counterpart to those obligations.

Important points:

Providers of data processing services must publish on their websites the jurisdiction governing their ICT infrastructure and a description of measures taken to prevent unlawful international governmental access to non-personal data held in the Union.
This published information must be kept up to date.
Providers of data processing services must reference these websites in all contracts they conclude for their data processing services.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

1. Providers of data processing services shall make the following information available on their websites, and keep that information up to date:
  1. the jurisdiction to which the ICT infrastructure deployed for data processing of their individual services is subject;
  2. a general description of the technical, organisational and contractual measures adopted by the provider of data processing services in order to prevent international governmental access to or transfer of non-personal data held in the Union where such access or transfer would create a conflict with Union law or the national law of the relevant Member State.
1. The websites referred to in paragraph 1 shall be listed in contracts for all data processing services offered by providers of data processing services.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.