{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2023-12-22","gaps":[],"covered":["Data Act L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/data-act/articles/28","url":"https://www.headlesslaw.com/data-act/articles/28","title":"Article 28 — Contractual transparency obligations on international access and transfer","family":"l1_generated","work_id":"dataact","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":"2025-09-12","application":{"state":"applicable","next":null,"dates":[{"at":"2025-09-12","note":"Article 50(1)"}]},"version_label":"Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng","valid_from":"2023-12-22","valid_until":"2025-09-12","revision":1,"content_id":"6ebef65c52a39fa8","change_date":null,"nearest_versions":["2023-12-22"],"first_text_date":"2023-12-13","correction_applies":false,"versions":["2023-12-22"],"version_url":"https://www.headlesslaw.com/data-act/articles/28/versions/2023-12-22","revision_url":"https://www.headlesslaw.com/data-act/articles/28/versions/2023-12-22/rev/6ebef65c52a39fa8","versions_url":"https://www.headlesslaw.com/data-act/articles/28/versions","relations_url":"https://www.headlesslaw.com/data-act/articles/28/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dataact/articles/28.md","body_sha256":"e424463b26862b38670351d41a5ea44a055b1d44648cafc2a6ef59d8a29ee4be"},"units":[{"locator":"dataact/art/28","kind":"article","status":"in_force","label":null,"heading":"Contractual transparency obligations on international access and transfer","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"dataact/art/28/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"Providers of data processing services shall make the following information available on their websites, and keep that information up to date:","marks":[],"revision":1,"text_hash":"0d82ad6fb31cb4987f80d2eaba5ea3e92ac06358571baa2a3008e7adf54ddb19","reason":null},{"locator":"dataact/art/28/para/1/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"the jurisdiction to which the ICT infrastructure deployed for data processing of their individual services is subject;","marks":[],"revision":1,"text_hash":"8abc9f87a8fb03feba981334935e396e14b6f9a4c7a18d95e8dc4b0a0401e1d5","reason":null},{"locator":"dataact/art/28/para/1/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"a general description of the technical, organisational and contractual measures adopted by the provider of data processing services in order to prevent international governmental access to or transfer of non-personal data held in the Union where such access or transfer would create a conflict with Union law or the national law of the relevant Member State.","marks":[],"revision":1,"text_hash":"5c833e59ab66151e20969708903b3e5d2d7c88fdc12005ad0f240f89375269d3","reason":null},{"locator":"dataact/art/28/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"The websites referred to in paragraph 1 shall be listed in contracts for all data processing services offered by providers of data processing services.","marks":[],"revision":1,"text_hash":"b768aaee6e4511a0984af6c1bfb74b0825ce7f07aadcc06a3c8eaa0926691803","reason":null}],"markdown":"---\ntitle: \"Article 28 — Contractual transparency obligations on international access and transfer\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854\"\nsource_retrieved: 2026-10-03\nshortTitle: \"Article 28 — Contractual transparency obligations on international access and transfer\"\ninstrument_type: level1_regulation\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Regulation (EU) 2023/2854\"\ninstrument: dataact\ncelex: \"32023R2854\"\nregulation: Data Act\nregulation-full: \"Regulation (EU) 2023/2854\"\narticle: 28\nstatus: in_force\nobject_id: eu.dataact.legal_text.article.28\ntext_version: \"Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023\"\nsource_url: \"https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng)*\n\n1. <a id=\"p-1\"></a>Providers of data [processing](https://www.headlesslaw.com/definitions/data-act/processing) services shall make the following information available on their websites, and keep that information up to date:\n\n    <a id=\"p-1-a\"></a>**(a)** the jurisdiction to which the ICT infrastructure deployed for data processing of their individual services is subject;\n\n    <a id=\"p-1-b\"></a>**(b)** a general description of the technical, organisational and contractual measures adopted by the provider of data processing services in order to prevent international governmental access to or transfer of [non-personal data](https://www.headlesslaw.com/definitions/data-act/non-personal-data) held in the Union where such access or transfer would create a conflict with Union law or the national law of the relevant Member State.\n2. <a id=\"p-2\"></a>The websites referred to in paragraph 1 shall be listed in contracts for all data processing services offered by providers of data processing services.\n\n***\n\n[Chapter VI — Switching between data processing services](../chapters/vi.md) · [← Article 27](27.md) · [Article 29 →](29.md)\n"}