§ Data Governance Act · Article 21
Data Governance Act Article 21: Obligations, Deadlines & Penalties
At a glance
Article 21 of the Data Governance Act imposes 9 obligations on recognised data altruism organisation. At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 21
Obligation 1
Inform data subjects or data holders prior to any processing of their data in a clear and easily comprehensible manner of the objectives of general interest and the specified, explicit and legitimate purpose for which personal data is to be processed.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
inform
- Deadline
-
prior to any processing
- Penalty
-
—
Obligation 2
Inform data subjects or data holders of the location of and the objectives of general interest for which it permits any processing carried out in a third country, where the processing is carried out by the recognised data altruism organisation.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
inform
- Deadline
-
prior to any processing
- Penalty
-
—
Obligation 3
Not use the data for other objectives than those of general interest for which the data subject or data holder allows the processing.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
refrain from using
- Deadline
-
—
- Penalty
-
—
Obligation 4
Not use misleading marketing practices to solicit the provision of data.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
refrain from using
- Deadline
-
—
- Penalty
-
—
Obligation 5
Provide tools for obtaining consent from data subjects or permissions to process data made available by data holders.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
provide
- Deadline
-
—
- Penalty
-
—
Obligation 6
Provide tools for easy withdrawal of such consent or permission.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
provide
- Deadline
-
—
- Penalty
-
—
Obligation 7
Take measures to ensure an appropriate level of security for the storage and processing of non-personal data that it has collected based on data altruism.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
ensure
- Deadline
-
—
- Penalty
-
—
Obligation 8
Inform data holders in the event of any unauthorised transfer, access or use of the non-personal data that it has shared.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
inform
- Deadline
-
without delay
- Penalty
-
—
Obligation 9
Specify the third-country jurisdiction in which the data use is intended to take place where the recognised data altruism organisation facilitates data processing by third parties.
Regulation (EU) 2022/868, Article 21, Article 21
- Obligated entity
-
recognised data altruism organisation
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 21
Who must comply with Article 21 of the Data Governance Act?
+
recognised data altruism organisation.
What does Article 21 of the Data Governance Act require?
+
inform refrain from using provide
What is the compliance deadline for Data Governance Act Article 21?
+
prior to any processing; without delay