<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2023-12-22","gaps":[],"covered":["Data Act L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/data-act/articles/28","url":"https://www.headlesslaw.com/data-act/articles/28","title":"Article 28 — Contractual transparency obligations on international access and transfer","family":"l1_generated","work_id":"dataact","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":"2025-09-12","application":{"state":"applicable","next":null,"dates":[{"at":"2025-09-12","note":"Article 50(1)"}]},"version_label":"Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng","valid_from":"2023-12-22","valid_until":"2025-09-12","revision":1,"content_id":"6ebef65c52a39fa8","change_date":null,"nearest_versions":["2023-12-22"],"first_text_date":"2023-12-13","correction_applies":false,"versions":["2023-12-22"],"version_url":"https://www.headlesslaw.com/data-act/articles/28/versions/2023-12-22","revision_url":"https://www.headlesslaw.com/data-act/articles/28/versions/2023-12-22/rev/6ebef65c52a39fa8","versions_url":"https://www.headlesslaw.com/data-act/articles/28/versions","relations_url":"https://www.headlesslaw.com/data-act/articles/28/relations","source_line":null,"attribution":null}} -->
---
title: "Article 28 — Contractual transparency obligations on international access and transfer"
type: regulation
legal_status: in_force
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854"
source_retrieved: 2026-10-03
shortTitle: "Article 28 — Contractual transparency obligations on international access and transfer"
instrument_type: level1_regulation
authority: Commission
binding: true
binding_character: binding
mica_level2: false
legal_basis: "Regulation (EU) 2023/2854"
instrument: dataact
celex: "32023R2854"
regulation: Data Act
regulation-full: "Regulation (EU) 2023/2854"
article: 28
status: in_force
object_id: eu.dataact.legal_text.article.28
text_version: "Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023"
source_url: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
check_status: matched
verified: true
last_checked: 2026-10-26
---

*In force · Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng)*

1. <a id="p-1"></a>Providers of data [processing](https://www.headlesslaw.com/definitions/data-act/processing) services shall make the following information available on their websites, and keep that information up to date:

    <a id="p-1-a"></a>**(a)** the jurisdiction to which the ICT infrastructure deployed for data processing of their individual services is subject;

    <a id="p-1-b"></a>**(b)** a general description of the technical, organisational and contractual measures adopted by the provider of data processing services in order to prevent international governmental access to or transfer of [non-personal data](https://www.headlesslaw.com/definitions/data-act/non-personal-data) held in the Union where such access or transfer would create a conflict with Union law or the national law of the relevant Member State.
2. <a id="p-2"></a>The websites referred to in paragraph 1 shall be listed in contracts for all data processing services offered by providers of data processing services.

***

[Chapter VI — Switching between data processing services](../chapters/vi.md) · [← Article 27](27.md) · [Article 29 →](29.md)
