§ Data Act · Article 19
Data Act Article 19: Obligations, Deadlines & Penalties
At a glance
Article 19 of the Data Act imposes 9 obligations on Union body, data holder, public sector body and 4 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 19
Obligation 1
A public sector body, the Commission, the European Central Bank or a Union body receiving data pursuant to a request made under Article 14 shall not use the data in a manner incompatible with the purpose for which they were requested.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body
- Action required
-
not use
- Deadline
-
—
- Penalty
-
—
Obligation 2
A public sector body, the Commission, the European Central Bank or a Union body receiving data pursuant to a request made under Article 14 shall have implemented technical and organisational measures that preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular personal data, and safeguard the rights and freedoms of data subjects.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body
- Action required
-
implement
- Deadline
-
—
- Penalty
-
—
Obligation 3
A public sector body, the Commission, the European Central Bank or a Union body receiving data pursuant to a request made under Article 14 shall erase the data as soon as they are no longer necessary for the stated purpose.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body
- Action required
-
erase
- Deadline
-
as soon as they are no longer necessary for the stated purpose
- Penalty
-
—
- Exemptions
- unless archiving of the data is required in accordance with Union or national law on public access to documents in the context of transparency obligations
Obligation 4
A public sector body, the Commission, the European Central Bank or a Union body receiving data pursuant to a request made under Article 14 shall inform the data holder and individuals or organisations that received the data pursuant to Article 21(1) without undue delay that the data have been erased.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body
- Action required
-
inform
- Deadline
-
without undue delay
- Penalty
-
—
- Exemptions
- unless archiving of the data is required in accordance with Union or national law on public access to documents in the context of transparency obligations
Obligation 5
A public sector body, the Commission, the European Central Bank, a Union body or a third party receiving data under this Chapter shall not use the data or insights about the economic situation, assets and production or operation methods of the data holder to develop or enhance a connected product or related service that competes with the connected product or related service of the data holder.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body, third party
- Action required
-
not use
- Deadline
-
—
- Penalty
-
—
Obligation 6
A public sector body, the Commission, the European Central Bank, a Union body or a third party receiving data under this Chapter shall not share the data with another third party for any of the purposes referred to in point (a).
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body, third party
- Action required
-
not share
- Deadline
-
—
- Penalty
-
—
Obligation 7
In cases where disclosure of trade secrets is strictly necessary to achieve the purpose of a request under Article 15, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
data holder, trade secret holder
- Action required
-
identify
- Deadline
-
—
- Penalty
-
—
Obligation 8
The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, technical standards and the application of codes of conduct.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body
- Action required
-
take measures
- Deadline
-
prior to the disclosure of trade secrets
- Penalty
-
—
Obligation 9
A public sector body, the Commission, the European Central Bank or a Union body shall be responsible for the security of the data it receives.
Regulation (EU) 2023/2854, Article 19, Article 19
- Obligated entity
-
public sector body, the Commission, the European Central Bank, Union body
- Action required
-
ensure security
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 19
Who must comply with Article 19 of the Data Act?
+
Union body, data holder, public sector body, the Commission, the European Central Bank, third party, trade secret holder.
What does Article 19 of the Data Act require?
+
not use implement erase
What is the compliance deadline for Data Act Article 19?
+
as soon as they are no longer necessary for the stated purpose; prior to the disclosure of trade secrets; without undue delay