Art. 55 Professional secrecy | DORA regulation | DORA

This article establishes the professional secrecy obligations that govern confidential information handled under DORA.

It sets out who is bound by these obligations and what restrictions apply to the disclosure of information exchanged between competent authorities.

The article connects directly to the supervisory and cooperation framework established elsewhere in the regulation, ensuring that sensitive information shared in that context remains protected.

Important points:

All persons who work, or have worked, for competent authorities under this regulation — including auditors, experts, and those to whom powers have been delegated — are bound by professional secrecy obligations.
Competent authorities are required to treat all information exchanged concerning business or operational conditions and economic or personal affairs as confidential, unless disclosure is stated permissible at the time of communication or is required for legal proceedings.
Information covered by professional secrecy cannot be disclosed to any other person or authority except as provided for under Union or national law.

1. Any confidential information received, exchanged or transmitted pursuant to this Regulation shall be subject to the conditions of professional secrecy laid down in paragraph 2.
1. The obligation of professional secrecy applies to all persons who work, or who have worked, for the competent authorities pursuant to this Regulation, or for any authority or market undertaking or natural or legal person to whom those competent authorities have delegated their powers, including auditors and experts contracted by them.
1. Information covered by professional secrecy, including the exchange of information among competent authorities under this Regulation and competent authorities designated or established in accordance with Directive (EU) 2022/2555, shall not be disclosed to any other person or authority except by virtue of provisions laid down by Union or national law;
1. All information exchanged between the competent authorities pursuant to this Regulation that concerns business or operational conditions and other economic or personal affairs shall be considered confidential and shall be subject to the requirements of professional secrecy, except where the competent authority states, at the time of communication, that such information may be disclosed or where such disclosure is necessary for legal proceedings.