EU Data Act International Government Access FAQ

The Article 32 safeguard is aimed at providers of data processing services, including cloud and edge service contexts covered by the Data Act's data processing services chapter. The protected data is non-personal data held in the Union and falling within the scope of the Regulation.

This is narrower than every foreign authority request a company might receive. Article 32 does not govern ordinary commercial transfers between businesses. A product manufacturer, connected-product data holder, support team, or ordinary business system owner should first ask whether the request is addressed to the provider of a data processing service and whether the requested material is non-personal data held in the Union.

Providers must maintain technical, organisational, and legal measures, including contractual measures, to prevent third-country governmental access or transfer where it would conflict with Union law or the national law of the relevant Member State. The Commission's explainer gives examples such as encryption, audits, and adherence to certification schemes.

Article 28 also creates a transparency obligation: providers must publish and keep updated the jurisdictions to which the ICT infrastructure deployed for their individual services is subject, and must describe the technical, organisational, and contractual measures used to prevent conflicting international governmental access or transfer.

No. A third-country court judgment, tribunal decision, or administrative authority decision requiring access to or transfer of covered non-personal data is recognised or enforceable only if it is based on an international agreement in force between the requesting third country and the Union or a Member State, such as a mutual legal assistance treaty.

Identify the exact legal instrument and the international agreement relied on. If no such agreement applies and compliance risks a conflict with EU or Member State law, access or transfer may occur only if all Article 32(3) safeguards are met. The provision does not validate the foreign order as a matter of EU law merely because those fallback conditions are satisfied.

Where there is no applicable international agreement and compliance risks a legal conflict, Article 32 permits access or transfer only if defined safeguards are met. The third-country system must require reasons and proportionality, the decision must be specific, the provider's reasoned objection must be reviewable by a competent third-country court or tribunal, and that court or tribunal must be empowered to take account of relevant legal interests protected by Union or Member State law.

This is the core conflict analysis. A provider should not answer only with a business approval or general law-enforcement cooperation statement; it needs a record showing how each Article 32 condition was checked for the request.

The provider may ask the relevant national body or authority competent for international cooperation in legal matters for an opinion on whether the Article 32 conditions are met. Article 32 identifies this route where the decision may relate to trade secrets, commercially sensitive data, intellectual property-protected content, or a transfer that may lead to re-identification.

The provider must ask that national body or authority for an opinion if it considers that the decision or judgment may affect national-security or defence interests of the Union or its Member States. If there is no reply within one month, or the opinion says the conditions are not met, the provider may reject the request for access to or transfer of non-personal data on those grounds.

Article 32 requires minimisation. If the conditions for access or transfer are met, the provider must provide the minimum amount of data permissible in response, based on its reasonable interpretation of the request or the interpretation of the relevant national body or authority.

The evidence file should therefore include both the requested data and the data actually disclosed. That lets a later reviewer see why excluded fields, logs, metadata, backups, or derived records were outside the minimum permissible response.

Yes. Article 32 requires the provider to inform the customer about a third-country authority request before complying. The exception applies where the request serves law-enforcement purposes, for as long as withholding notice is necessary to preserve the effectiveness of that activity.

Customer notice should be a controlled workflow, not an informal support message. The record should show whether notice was given, what was said, when it was sent, and, if notice was delayed or withheld, the documented law-enforcement reason.

International government access under Article 32 is separate from Chapter V business-to-government data sharing. Chapter V concerns qualifying EU public-sector bodies, the Commission, the European Central Bank, and Union bodies requesting privately held data because of an exceptional need. Article 32 concerns third-country governmental access to or transfer of non-personal data held in the Union by providers of data processing services.

Keeping those workflows separate matters because their triggers, requesters, data categories, and safeguards differ. A provider receiving a non-EU authority request should not reuse an EU public-emergency request template without checking Article 32.

Keep the received request, requester identity and authority, requested-data inventory, EU or Member State conflict assessment, international-agreement analysis, any national-authority opinion request or response, customer-notice record, minimisation analysis, and final disclosure or refusal log.

For standing compliance, keep the published Article 28 web disclosure, contract references to that web page, safeguard descriptions, control-owner assignments, and change history for technical, organisational, legal, and contractual measures. These records show that the provider had preventive controls before the request, not only a one-off response after escalation.

Freeze the request record and route it to legal, security, cloud operations, and the customer account owner. Confirm Article 32 scope, any international agreement supporting recognition or enforceability, the no-agreement safeguards, the national-authority opinion route, customer notice, and the minimum data that may be disclosed.

An ordinary support workflow is insufficient. The Data Act requires a provider-level conflict review in addition to identity verification of the requester.

Under the Data Act, record the legal basis first: whether the request is enforceable under an in-force international agreement or must pass the Article 32(3) conflict checks. If there is doubt, document the national-body opinion request, the one-month reply window, and the final reason for accepting or rejecting access.

Then keep the record narrow. Note the minimum amount of data disclosed under Article 32(4), the date and method of customer notice under Article 32(5), and the safeguard controls used to prevent broader access than the Regulation allows.

Article 32 expressly governs third-country governmental access to non-personal data held in the Union by providers of data processing services. It does not supply a route for personal data. A request spanning a mixed dataset can engage Article 32 for its non-personal part and EU data-protection, law-enforcement, or other applicable rules for its personal-data part.

Separate the personal and non-personal elements before deciding whether and how to respond. Do not assume that satisfying Article 32 makes disclosure of personal data lawful.