EU Data Act B2G exceptional need FAQ

The EU Data Act allows a Chapter V request only where the requesting public body or EU institution demonstrates an exceptional need to use certain data, including metadata needed to interpret and use it, for a statutory public-interest task. The need must be limited in time and scope.

There are two routes. For a public emergency, the requested data must be necessary to respond to that emergency and unavailable by alternative means in a timely and effective way under equivalent conditions. Outside a public emergency, the request is limited to non-personal data, must support a specific public-interest task explicitly provided by law, and can be used only after other means to obtain the data have been exhausted.

The request side is limited to public-sector bodies of Member States, the Commission, the European Central Bank, and Union bodies. The receiving side is a data holder that is a legal person, other than a public-sector body, and that holds the requested data.

A public-sector body from one Member State can request data from a data holder in another Member State, but cross-border requests have an extra protection step: the competent authority in the data holder's Member State examines the request under the Article 22 procedure.

A valid request must be written in clear, concise, plain language and must be specific about the data requested, the data holder chosen, the public-interest task, the purpose and intended use, the duration of use, any planned onward sharing, and the deadlines for making data available and for declining or seeking modification.

The request must also justify why the exceptional-need conditions are met, be proportionate in data type, volume, granularity, and frequency of access, respect the data holder's legitimate aims and trade-secret protection, and state the legal provision allocating the relevant public-interest task to the requesting body.

A data holder should keep the written request, the basis for accepting or challenging it, the response deadline, the data disclosed or withheld, and the safeguards applied to the transfer. The record should also show any cross-border notification and any competent-authority contact.

If the data holder relies on a refusal or a request for modification, it should record the reason and the relevant Article 18 ground. If the request is fulfilled, the record should include the purpose limitation, security measures, any trade-secret identification, and later erasure or onward-sharing notices.

For non-emergency requests, only non-personal data may be requested. For public-emergency requests, the request must concern non-personal data unless those data are demonstrably insufficient. If personal data are required, Article 17 requires the request to seek them in pseudonymised form and specify the safeguards; Article 18 requires the data holder to anonymise the data unless compliance requires disclosure of personal data, in which case the holder must pseudonymise them.

Where personal data is involved, the request must identify the technical and organisational safeguards needed to protect data-protection principles, and the relevant supervisory authority must be notified.

A data holder may decline or seek modification without undue delay, and in any event within five working days for data necessary to respond to a public emergency or within 30 working days for other exceptional-need requests.

The Data Act gives three listed grounds: the data holder does not control the requested data; a similar request for the same purpose was previously submitted by another eligible public body or EU institution and the data holder has not been notified that the earlier data was erased; or the request does not meet the Article 17 requirements.

Data received under Chapter V does not become open public-sector information for general reuse. It must be used only for the purpose stated in the request, protected with technical and organisational measures, and erased once no longer necessary for that stated purpose unless archiving is required under Union or national public-access law in the context of transparency obligations.

Trade secrets may be disclosed only to the extent strictly necessary for the Article 15 purpose. The data holder or trade-secret holder must identify the protected data, including relevant metadata, and the requesting body must take necessary and appropriate measures to preserve confidentiality before disclosure.

For a public-emergency request, data holders other than microenterprises and small enterprises must make the necessary data available free of charge, but may request public acknowledgement. Article 20(3) applies the Article 20(2) compensation rule when a microenterprise or small enterprise makes a claim, so the calculation covers the technical and organisational costs incurred to comply plus a reasonable margin. Those enterprises may also request public acknowledgement.

For non-emergency exceptional-need requests under Article 15(1)(b), the data holder is entitled to fair compensation covering technical and organisational costs, including anonymisation, pseudonymisation, aggregation, and technical adaptation where applicable, plus a reasonable margin. There is an exception where the task is official statistics and national law does not allow purchase of the data.

Keep enough evidence to show whether the request was valid, how the company responded, what data was made available or withheld, and which safeguards governed the data after transfer. Build the evidence file around the Article 17 request contents and the Article 18 response, not generic compliance notes.

A useful record includes the written request, requester identity, statutory task and legal provision, exceptional-need route, a public-emergency determination or declaration, or a non-emergency exhaustion analysis, data scope and metadata, personal-data analysis, trade-secret identification, timestamps, refusal or modification reasons, compensation calculation, delivery logs, onward-sharing notices, erasure notice, and competent-authority communications.

Assign one request owner with authority to control the five- or 30-working-day decline-or-modification clock and coordinate legal, privacy, security, data engineering, finance, and records teams. Give separate named owners the legal-validity review, data extraction, confidentiality controls, compensation calculation, and authority communications.

The requesting body retains responsibility for the Article 17 request, purpose limitation, security, onward-sharing notices, and erasure. The data holder should name internal owners who obtain and preserve the evidence needed to challenge a defective request or prove a compliant disclosure.

Reassess the decision if the requester, statutory task, exceptional-need branch, requested data, availability of alternative means, data-holder control, personal-data content, trade-secret scope, intended recipients, or use period changes. A revised or repeated request needs its own Article 17 and Article 18 review.

Reopen the file when the public emergency ends, the stated purpose is completed, an onward transfer is proposed, erasure becomes due, a similar request arrives, or a competent authority challenges the request or response. Use both a review date and these event triggers.