--- title: "Article 18 — Compliance with requests for data" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854" source_retrieved: 2026-10-03 shortTitle: "Article 18 — Compliance with requests for data" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2023/2854" instrument: dataact celex: "32023R2854" regulation: Data Act regulation-full: "Regulation (EU) 2023/2854" article: 18 status: in_force object_id: eu.dataact.legal_text.article.18 text_version: "Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023" source_url: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng" check_status: matched verified: true last_checked: 2026-10-26 --- *In force · Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng)* 1. A [data holder](https://www.headlesslaw.com/definitions/data-act/data-holder) receiving a request to make data available under this Chapter shall make the data available to the requesting [public sector body](https://www.headlesslaw.com/definitions/data-act/public-sector-body), the Commission, the European Central Bank or a Union body without undue delay, taking into account necessary technical, organisational and legal measures. 2. Without prejudice to specific needs regarding the availability of data defined in Union or national law, a data holder may decline or seek the modification of a request to make data available under this Chapter without undue delay and, in any event, no later than five working days after the receipt of a request for the data necessary to respond to a [public emergency](https://www.headlesslaw.com/definitions/data-act/public-emergency) and without undue delay and, in any event, no later than 30 working days after the receipt of such a request in other cases of an exceptional need, on any of the following grounds: **(a)** the data holder does not have control over the data requested; **(b)** a similar request for the same purpose has been previously submitted by another public sector body or the Commission, the European Central Bank or a Union body and the data holder has not been notified of the erasure of the data pursuant to [Article 19(1)](19.md), point (c); **(c)** the request does not meet the conditions laid down in [Article 17(1)](17.md) and (2). 3. If the data holder decides to decline the request or to seek its modification in accordance with paragraph 2, point (b), it shall indicate the identity of the public sector body or the Commission, the European Central Bank or the Union body that previously submitted a request for the same purpose. 4. Where the data requested includes [personal data](https://www.headlesslaw.com/definitions/data-act/personal-data), the data holder shall properly anonymise the data, unless the compliance with the request to make data available to a public sector body, the Commission, the European Central Bank or a Union body requires the disclosure of personal data. In such cases, the data holder shall pseudonymise the data. 5. Where the public sector body, the Commission, the European Central Bank or the Union body wishes to challenge a data holder’s refusal to provide the data requested, or where the data holder wishes to challenge the request and the matter cannot be resolved by an appropriate modification of the request, the matter shall be referred to the competent authority designated pursuant to [Article 37](37.md) of the Member State where the data holder is established. *** [Chapter V — Making data available to public sector bodies, the Commission, the European Central Bank and Union bodies based on an exceptional need](../chapters/v.md) · [← Article 17](17.md) · [Article 19 →](19.md)