3.

Personal data supplied which should not have been supplied or received shall be deleted. Data which are lawfully supplied and received shall be deleted: if they are not or no longer necessary for the purpose for which they were supplied; if personal data have been supplied without request, the receiving body shall immediately check if they are necessary for the purposes for which they were supplied; following the expiry of the maximum period for keeping data laid down in the national law of the supplying Member State where the supplying body informed the receiving body of that maximum period at the time of supplying the data. Where there is reason to believe that deletion would prejudice the interests of the data subject, the data shall be blocked instead of being deleted in compliance with national law. Blocked data may be supplied or used solely for the purpose which prevented their deletion.

← art_28__para_2__text_1 · All articles · art_28__para_3__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-15 · Text as adopted (Official Journal); later amendments are not incorporated in this text.