<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2023-12-22","gaps":[],"covered":["Data Act L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/data-act/recitals/37","url":"https://www.headlesslaw.com/data-act/recitals/37","title":"Recital 37","family":"l1_recital_view","work_id":"dataact","view_of":"/data-act/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854","valid_from":"2023-12-22","valid_until":null,"content_id":"dfd5597b1a644cba","versions":["2023-12-22"],"version_url":"https://www.headlesslaw.com/data-act/recitals/37/versions/2023-12-22","revision_url":"https://www.headlesslaw.com/data-act/recitals/37/versions/2023-12-22/rev/dfd5597b1a644cba","versions_url":"https://www.headlesslaw.com/data-act/recitals/37/versions","relations_url":"https://www.headlesslaw.com/data-act/recitals/37/relations","act_url":"https://www.headlesslaw.com/data-act/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"dataact","path":"/data-act/recitals","name":"Data Act","number":"Regulation (EU) 2023/2854","celex":"32023R2854","title_official":null,"document_date":null},"position":{"kind":"recital","key":"37","index":37,"articles":119,"annexes":0},"prev":{"path":"/data-act/recitals/36","key":"36","title":"Recital 36"},"next":{"path":"/data-act/recitals/38","key":"38","title":"Recital 38"},"act_anchor":""}}} -->
# Recital 37

*In force · Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854)*

In order to prevent the exploitation of users, third parties to whom data has been made available at the request of the user should process those data only for the purposes agreed with the user and share them with another third party only with the agreement of the user to such data sharing.