§ Data Act · Article 18
Data Act Article 18: Obligations, Deadlines & Penalties
At a glance
Article 18 of the Data Act imposes 7 obligations on data holder, public sector body. At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 18
Obligation 1
A data holder receiving a request to make data available shall make the data available to the requesting public sector body, the Commission, the European Central Bank or a Union body without undue delay, taking into account necessary technical, organisational and legal measures.
Regulation (EU) 2023/2854, Article 18, Article 18
- Obligated entity
-
data holder
- Action required
-
make available
- Deadline
-
without undue delay
- Penalty
-
—
Obligation 2
A data holder may decline or seek the modification of a request to make data available without undue delay and, in any event, no later than five working days after the receipt of a request for the data necessary to respond to a public emergency.
Regulation (EU) 2023/2854, Article 18, Article 18
- Obligated entity
-
data holder
- Action required
-
decline or seek modification
- Deadline
-
no later than five working days after receipt
- Penalty
-
—
Obligation 3
A data holder may decline or seek the modification of a request to make data available without undue delay and, in any event, no later than 30 working days after the receipt of such a request in other cases of an exceptional need.
Regulation (EU) 2023/2854, Article 18, Article 18
- Obligated entity
-
data holder
- Action required
-
decline or seek modification
- Deadline
-
no later than 30 working days after receipt
- Penalty
-
—
Obligation 4
If the data holder decides to decline the request or to seek its modification on the ground that a similar request was previously submitted, it shall indicate the identity of the public sector body or Union body that previously submitted a request for the same purpose.
Regulation (EU) 2023/2854, Article 18, Article 18
- Obligated entity
-
data holder
- Action required
-
indicate identity
- Deadline
-
—
- Penalty
-
—
Obligation 5
Where the data requested includes personal data, the data holder shall properly anonymise the data, unless the compliance with the request requires the disclosure of personal data.
Regulation (EU) 2023/2854, Article 18, Article 18
- Obligated entity
-
data holder
- Action required
-
anonymise
- Deadline
-
—
- Penalty
-
—
Obligation 6
Where compliance with the request requires the disclosure of personal data, the data holder shall pseudonymise the data.
Regulation (EU) 2023/2854, Article 18, Article 18
- Obligated entity
-
data holder
- Action required
-
pseudonymise
- Deadline
-
—
- Penalty
-
—
Obligation 7
Where the public sector body wishes to challenge a data holder’s refusal to provide the data requested, or where the data holder wishes to challenge the request and the matter cannot be resolved by an appropriate modification, the matter shall be referred to the competent authority designated pursuant to Article 37 of the Member State where the data holder is established.
Regulation (EU) 2023/2854, Article 18, Article 18
- Obligated entity
-
public sector body, data holder
- Action required
-
refer to competent authority
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 18
Who must comply with Article 18 of the Data Act?
+
data holder, public sector body.
What does Article 18 of the Data Act require?
+
make available decline or seek modification indicate identity
What is the compliance deadline for Data Act Article 18?
+
no later than 30 working days after receipt; no later than five working days after receipt; without undue delay