EU Data Act B2G exceptional need FAQ

The EU Data Act allows a Chapter V request only where the requesting public body or EU institution demonstrates an exceptional need to use certain data, including metadata needed to interpret and use it, for a statutory public-interest task. The need must be limited in time and scope.

There are two routes. For a public emergency, the requested data must be necessary to respond to that emergency and unavailable by alternative means in a timely and effective way under equivalent conditions. Outside a public emergency, the request is limited to non-personal data, must support a specific public-interest task explicitly provided by law, and can be used only after other means to obtain the data have been exhausted.

The Data Act context is the starting point for this answer. The request side is limited to public-sector bodies of Member States, the Commission, the European Central Bank, and Union bodies. The receiving side is a data holder that is a legal person, other than a public-sector body, and that holds the requested data.

A public-sector body from one Member State can request data from a data holder in another Member State, but cross-border requests have an extra protection step: the competent authority in the data holder's Member State examines the request under the Article 22 procedure.

The Data Act context is the starting point for this answer. A valid request must be written in clear, concise, plain language and must be specific about the data requested, the data holder chosen, the public-interest task, the purpose and intended use, the duration of use, any planned onward sharing, and the deadlines for making data available and for declining or seeking modification.

The request must also justify why the exceptional-need conditions are met, be proportionate in data type, volume, granularity, and frequency of access, respect the data holder's legitimate aims and trade-secret protection, and state the legal provision allocating the relevant public-interest task to the requesting body.

The Data Act context is the starting point for this answer. A data holder should keep the written request, the basis for accepting or challenging it, the response deadline, the data disclosed or withheld, and the safeguards applied to the transfer. The record should also show any cross-border notification and any competent-authority contact.

If the data holder relies on a refusal or a request for modification, it should record the reason and the relevant Article 18 ground. If the request is fulfilled, the record should include the purpose limitation, security measures, any trade-secret identification, and later erasure or onward-sharing notices.

The Data Act context is the starting point for this answer. For non-emergency requests, only non-personal data may be requested. For public-emergency requests, the request should concern non-personal data first, and personal data may only be included if non-personal data is insufficient to respond to the need. In that case, the data holder must anonymise the data where possible, or pseudonymise it where disclosure of personal data is strictly necessary.

Where personal data is involved, the request must identify the technical and organisational safeguards needed to protect data-protection principles, and the relevant supervisory authority must be notified.

The Data Act context is the starting point for this answer. A data holder may decline or seek modification without undue delay, and in any event within five working days for data necessary to respond to a public emergency or within 30 working days for other exceptional-need requests.

The Data Act gives three listed grounds: the data holder does not control the requested data; a similar request for the same purpose was previously submitted by another eligible public body or EU institution and the data holder has not been notified that the earlier data was erased; or the request does not meet the Article 17 requirements.

The Data Act context is the starting point for this answer. Data received under Chapter V does not become open public-sector information for general reuse. It must be used only for the purpose stated in the request, protected with technical and organisational measures, and erased once no longer necessary for that stated purpose unless archiving is required under transparency rules.

Trade secrets may be disclosed only to the extent strictly necessary for the Article 15 purpose. The data holder or trade-secret holder must identify the protected data, including relevant metadata, and the requesting body must take necessary and appropriate measures to preserve confidentiality before disclosure.

The Data Act context is the starting point for this answer. For a public-emergency request, data holders other than microenterprises and small enterprises must make the necessary data available free of charge, but may request public acknowledgement. The Commission's explanation states that micro and small companies may ask for reasonable remuneration not exceeding incurred technical and organisational costs, plus public acknowledgement upon request.

For non-emergency exceptional-need requests under Article 15(1)(b), the data holder is entitled to fair compensation covering technical and organisational costs, including anonymisation, pseudonymisation, aggregation, and technical adaptation where applicable, plus a reasonable margin. There is an exception where the task is official statistics and national law does not allow purchase of the data.

The Data Act context is the starting point for this answer. Keep enough evidence to show whether the request was valid, how the company responded, what data was made available or withheld, and which safeguards governed the data after transfer. The evidence file should be built around the Article 17 request contents and the Article 18 response, not around generic compliance notes.

A useful record includes the written request, requester identity, statutory task and legal provision, exceptional-need route, public-emergency declaration or non-emergency exhaustion analysis, data scope and metadata, personal-data analysis, trade-secret identification, timestamps, refusal or modification reasons, compensation calculation, delivery logs, onward-sharing notices, erasure notice, and competent-authority communications.

For b2g exceptional need, the Data Act record should identify the source clause, Commission guidance, actor role, dataset, request or contract trigger, and the owner who approved the interpretation.

For b2g exceptional need, keep the cited external URL, decision date, reviewer, unresolved assumptions, and implementation artifact together so the answer remains auditable.

For b2g exceptional need, the Data Act workflow should name the legal, product, procurement, cloud, support, or security owner who can change the affected process.

For b2g exceptional need, use one accountable owner per action, then record consulted teams and evidence dependencies separately.

For b2g exceptional need, the Data Act evidence should be concrete enough for a later reviewer to reconstruct why the team classified the product, service, request, or contract in scope.

For b2g exceptional need, useful evidence includes source URLs, data inventories, contract clauses, request logs, technical controls, customer notices, and approval records.

For b2g exceptional need, the Data Act answer should be reviewed when the product, service model, dataset, customer role, public-sector request path, or contract wording changes.

For b2g exceptional need, set a review date and an event trigger instead of relying on a one-time legal note.