lexiara

art_17__para_2

Data Act
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (Text with EEA relevance) · European Union

2. A request for data made pursuant to paragraph 1 of this Article shall: be made in writing and expressed in clear, concise and plain language understandable to the data holder; be specific regarding the type of data requested and correspond to data which the data holder has control over at the time of the request; be proportionate to the exceptional need and duly justified, regarding the granularity and volume of the data requested and frequency of access of the data requested; respect the legitimate aims of the data holder, committing to ensuring the protection of trade secrets in accordance with Article 19(3), and the cost and effort required to make the data available; concern non-personal data, and only if this is demonstrated to be insufficient to respond to the exceptional need to use data, in accordance with Article 15(1), point (a), request personal data in pseudonymised form and establish the technical and organisational measures that are to be taken to protect the data; inform the data holder of the penalties that are to be imposed pursuant to Article 40 by the competent authority designated pursuant to Article 37 in the event of non-compliance with the request; where the request is made by a public sector body, be transmitted to the data coordinator referred to in Article 37 of the Member State where the requesting public sector body is established, who shall make the request publicly available online without undue delay unless the data coordinator considers that such publication would create a risk for public security; where the request is made by the Commission, the European Central Bank or a Union body, be made available online without undue delay; where personal data are requested, be notified without undue delay to the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 in the Member State where the public sector body is established. The European Central Bank and Union bodies shall inform the Commission of their requests.

· All articles ·

Source: EUR-Lex (Cellar) · retrieved 2026-10-13 · Text as adopted (Official Journal); later amendments are not incorporated in this text.