§ Data Act · Article 17
Data Act Article 17: Obligations, Deadlines & Penalties
At a glance
Article 17 of the Data Act imposes 18 obligations on Commission, European Central Bank, Union body and 1 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 17
Obligation 1
Specify the data required, including relevant metadata necessary to interpret and use those data.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
Obligation 2
Demonstrate that the conditions necessary for the existence of an exceptional need as referred to in Article 15 are met.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
demonstrate
- Deadline
-
—
- Penalty
-
—
Obligation 3
Explain the purpose of the request, the intended use of the data requested, the duration of that use, and how the processing of personal data addresses the exceptional need.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
explain
- Deadline
-
—
- Penalty
-
—
Obligation 4
Specify, if possible, when the data are expected to be erased by all parties that have access to them.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
Obligation 5
Justify the choice of data holder to which the request is addressed.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
justify
- Deadline
-
—
- Penalty
-
—
Obligation 6
Specify any other public sector bodies, Commission, European Central Bank, Union bodies, and third parties with which the data requested is expected to be shared.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
Obligation 7
Where personal data are requested, specify technical and organisational measures necessary to implement data protection principles and whether anonymisation can be applied.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
Obligation 8
State the legal provision allocating to the requesting entity the specific task carried out in the public interest relevant for requesting the data.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
state
- Deadline
-
—
- Penalty
-
—
Obligation 9
Specify the deadline by which the data are to be made available and the deadline by which the data holder may decline or seek modification of the request.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
Obligation 10
Make best efforts to avoid compliance with the data request resulting in the data holders’ liability for infringement of Union or national law.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
avoid
- Deadline
-
—
- Penalty
-
—
Obligation 11
Make the request in writing and express it in clear, concise and plain language understandable to the data holder.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
make
- Deadline
-
—
- Penalty
-
—
Obligation 12
Ensure the request is specific regarding the type of data requested and corresponds to data which the data holder has control over at the time of the request.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
ensure
- Deadline
-
—
- Penalty
-
—
Obligation 13
Ensure the request is proportionate to the exceptional need and duly justified regarding granularity, volume, and frequency of access.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
ensure
- Deadline
-
—
- Penalty
-
—
Obligation 14
Respect the legitimate aims of the data holder, committing to ensuring the protection of trade secrets and considering the cost and effort required.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
respect
- Deadline
-
—
- Penalty
-
—
Obligation 15
Concern non-personal data, and only if insufficient, request personal data in pseudonymised form and establish technical and organisational measures to protect the data.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
request
- Deadline
-
—
- Penalty
-
—
Obligation 16
Inform the data holder of the penalties that are to be imposed in the event of non-compliance with the request.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body, Commission, European Central Bank, Union body
- Action required
-
inform
- Deadline
-
—
- Penalty
-
—
Obligation 17
Where the request is made by a public sector body, transmit it to the data coordinator who shall make the request publicly available online without undue delay unless it creates a risk for public security.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
public sector body
- Action required
-
transmit
- Deadline
-
without undue delay
- Penalty
-
—
- Exemptions
- if publication creates a risk for public security
Obligation 18
Where the request is made by the Commission, the European Central Bank or a Union body, make it available online without undue delay.
Regulation (EU) 2023/2854, Article 17, Article 17
- Obligated entity
-
Commission, European Central Bank, Union body
- Action required
-
make available
- Deadline
-
without undue delay
- Penalty
-
—
§ Frequently asked
Questions about Article 17
Who must comply with Article 17 of the Data Act?
+
Commission, European Central Bank, Union body, public sector body.
What does Article 17 of the Data Act require?
+
specify demonstrate explain
What is the compliance deadline for Data Act Article 17?
+
without undue delay