Source: OJ L, 2023/2854, 22.12.2023

Current language: EN

Article 31 Specific regime for certain data processing services


Summary What does Article 31 of the Data act regulation say?

Article 31 carves out specific exemptions from the switching and interoperability obligations established in the preceding articles of this Chapter.

It applies to two narrow categories of data processing services: those that are fully custom-built for an individual customer and not offered at broad commercial scale, and those provided purely for testing and evaluation purposes.

As an exception article, it directly limits the reach of obligations found in Articles 23, 29, and 30, meaning providers of these bespoke or non-production services are not held to the same switching facilitation standards as mainstream commercial providers.

Important points:

  • Providers of data processing services that are custom-built for a single customer and not broadly commercialised are exempt from key switching and interoperability obligations.
  • Data processing services provided as non-production versions for testing and evaluation are also fully exempt from this Chapter's obligations.
  • Providers of data processing services falling under these exemptions are required to inform the prospective customer, before contract conclusion, of which obligations from this Chapter do not apply.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. The obligations laid down in Article 23, point (d), Article 29 and Article 30(1) and (3) shall not apply to data processing services of which the majority of main features has been custom-built to accommodate the specific needs of an individual customer or where all components have been developed for the purposes of an individual customer, and where those data processing services are not offered at broad commercial scale via the service catalogue of the provider of data processing services.

    1. The obligations laid down in this Chapter shall not apply to data processing services provided as a non-production version for testing and evaluation purposes and for a limited period of time.

    1. Prior to the conclusion of a contract on the provision of the data processing services referred to in this Article, the provider of data processing services shall inform the prospective customer of the obligations of this Chapter that do not apply.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod