{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2025/2050 — Delegated act — Conditions to share data with vetted researchers [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/annexes/annex","url":"https://www.headlesslaw.com/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/annexes/annex","title":"ANNEX","family":"l2_unit_view","work_id":"spaces/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers","view_of":"/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2025/2050, OJ L, 2025/2050, 9.10.2025","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/2050/oj/eng","valid_from":"2025-10-29","valid_until":null,"content_id":"cb448e472ae46720","versions":["2025-10-29"],"version_url":"https://www.headlesslaw.com/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/annexes/annex/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/annexes/annex/versions/2026-10-26/rev/cb448e472ae46720","versions_url":"https://www.headlesslaw.com/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/annexes/annex/versions","relations_url":"https://www.headlesslaw.com/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/annexes/annex/relations","act_url":"https://www.headlesslaw.com/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers#annex","source_line":"Commission Delegated Regulation (EU) 2025/2050 · binding · OJ L, 2025/2050, 9.10.2025 · dated 1 Jul 2025 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2025-07-01","published_on":"2025-10-09","entry_into_force":"2025-10-29","locators":{"document_date":"CELLAR 32025R2050 work_date_document","published_on":"CELLAR 32025R2050 official-journal-act_date_publication","entry_into_force":"CELLAR 32025R2050 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers","path":"/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers","name":"Commission Delegated Regulation (EU) 2025/2050","number":"2025/2050","celex":"32025R2050","title_official":"COMMISSION DELEGATED REGULATION (EU) 2025/2050 of 1 July 2025 supplementing Regulation (EU) 2022/2065 of the European Parliament and of the Council by laying down the technical conditions and procedures under which providers of very large online platforms and of very large online search engines are to share data with vetted researchers (Text with EEA relevance)","document_date":"2025-07-01"},"position":{"kind":"annex","key":"annex","index":1,"articles":16,"annexes":1},"prev":{"path":"/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/articles/16","key":"16","title":"Article 16 — Entry into force"},"next":null,"act_anchor":"#annex"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/2050/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers.md","unit_text_sha256":"74705c7682f506ce856f9ec5a8e4fe743327bdc884c66556c3501c49ee757cf9","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dsa/level-2/delegated-acts/2025-2050-conditions-to-share-data-with-vetted-researchers/annex","kind":"annex","key":"annex","heading":"ANNEX","text":"## ANNEX\n\n<a id=\"annex\"></a>Responsibilities of the Commission as processor for data processing activities conducted in the context of the DSA data access portal\n\n1.\n\nThe Commission shall set up and ensure a secure and reliable IT infrastructure, the DSA data access portal, on behalf of the Digital Services Coordinators, that supports and streamlines the management of the data access process for researchers, research organisations, data providers and Digital Services Coordinators.\n\n2.\n\nTo fulfil its obligations as processor for the Digital Services Coordinators, the Commission may use third parties as sub-processors. If it is the case, the controllers shall authorise the Commission to use sub-processors or replace sub-processors where necessary. The Commission shall inform the controllers of said use or replacement of sub-processors, thereby giving the controllers the opportunity to object to any such changes. The Commission shall ensure that the same data protection obligations as set out in this Regulation apply to these sub-processors.\n\n3.\n\nThe processing by the Commission shall process personal data only insofar as necessary for the:\n\n(a)\n\nauthentication and access control with regard to all DSA data access portal users;\n\n(b)\n\nauthorisation implementation of requests by DSA data access portal users to create, update and delete any information contained in the application within the DSA data access portal;\n\n(c)\n\nreception of the personal data referred to in Article 5(3) of this Regulation uploaded by DSA data access portal users;\n\n(d)\n\nstorage of the personal data in the DSA data access portal;\n\n(e)\n\ndeletion of the personal data at their expiration date or upon instruction of the controller;\n\n(f)\n\nafter the end of the provision of services provided by the DSA data access portal, deletion of any remaining personal data unless Union or Member State laws require storage of such personal data.\n\n4.\n\nThe Commission shall take all state of the art organisational, physical, and logical security measures to ensure the DSA data access portal functioning. To this end, the Commission shall:\n\n(a)\n\ndesignate a responsible entity for the security management of the DSA data access portal, communicate to the controllers its contact information and ensure its availability to react to security threats;\n\n(b)\n\nassume the responsibility for the security of the DSA data access portal, including regularly carrying out tests, evaluations and assessments of the security measures.\n\n5.\n\nThe Commission shall take all necessary security measures to avoid compromising the smooth operational functioning of the DSA data access portal. This shall include:\n\n(a)\n\nrisk assessment procedures to identify and estimate potential threats to the DSA data access portal;\n\n(b)\n\naudit and review procedure to:\n\n(i)\n\ncheck the correspondence between the implemented security measures and the applicable security policy;\n\n(ii)\n\ncontrol on a regular basis the integrity of the DSA data access portal, security parameters and granted authorisations;\n\n(iii)\n\ndetect security breaches and intrusions into the DSA data access portal;\n\n(iv)\n\nimplement changes to mitigate existing security weaknesses in the DSA data access portal;\n\n(v)\n\ndefine the conditions under which to authorise, including at the request of controllers, and contribute to, the performance of independent audits, including inspections, and reviews on security measures subject to conditions that respect Protocol (No 7) to the Treaty on the Functioning of the European Union on the Privileges and Immunities of the European Union;\n\n(c)\n\nchanging the control procedure to document, measure the impact of a change before its implementation, and keep the controllers informed of any changes that can affect the communication with and/or the security of the DSA data access portal;\n\n(d)\n\nlaying down a maintenance and repair procedure to specify the rules and conditions to be respected when maintenance and/or repair of the DSA data access portal is to be performed;\n\n(e)\n\nlaying down a security incident procedure to define the reporting and escalation scheme, inform without delay the controllers affected, inform without delay the controllers for them to notify the national data protection supervisory authorities of any personal data breach and define a disciplinary process to deal with security breaches in the DSA data access portal.\n\n6.\n\nThe Commission shall take state of the art physical and logical security measures for the facilities hosting the DSA data access portal and for the controls of data and security access thereto. To this end, the Commission shall:\n\n(a)\n\nenforce physical security to establish distinct security perimeters and allowing detection of breaches in the DSA data access portal;\n\n(b)\n\ncontrol access to the DSA data access portal facilities;\n\n(c)\n\nensure that equipment cannot be added, replaced or removed without prior authorisation from the designated responsible bodies;\n\n(d)\n\ncontrol access from and to the DSA data access portal;\n\n(e)\n\nensure that the DSA data access portal users who access the DSA data access portal are authenticated;\n\n(f)\n\nreview the authorisation rights related to the access to the DSA data access portal in case of a security breach affecting the DSA data access portal;\n\n(g)\n\nkeep the integrity of the information transmitted through the DSA data access portal;\n\n(h)\n\nimplement technical and organisational security measures to prevent unauthorised access to personal data in the DSA data access portal;\n\n(i)\n\nimplement, whenever necessary, measures to block unauthorised access to the DSA data access portal (i.e. block a location/IP address).\n\n7.\n\nThe Commission shall:\n\n(a)\n\ntake steps to protect its domain, including the severing of connections, in the event of substantial deviation from the principles and concepts for quality and security;\n\n(b)\n\nmaintain a risk management plan related to its area of responsibility;\n\n(c)\n\nmonitor, in real time, the performance of all the service components of the DSA data access portal, produce regular statistics and keep records;\n\n(d)\n\nprovide support for the DSA data access portal in English to the DSA data access portal users;\n\n(e)\n\nassist the controllers by appropriate technical and organisational measures for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of Regulation (EU) 2016/679;\n\n(f)\n\nsupport the controllers by providing information concerning the DSA data access portal to implement the obligations pursuant to Articles 32, 33, 34, 35 and 36 of Regulation (EU) 2016/679;\n\n(g)\n\nensure that data processed within the DSA data access portal is unintelligible to any person who is not authorised to access it;\n\n(h)\n\ntake all relevant measures to prevent unauthorised access to transmitted personal data via the DSA data access portal;\n\n(i)\n\ntake measures in order to facilitate communication between the controllers;\n\n(j)\n\nmaintain a record of processing activities carried out on behalf of the controllers in accordance with Article 31(2) of Regulation (EU) 2018/1725.\n\n","marks":[],"text_hash":"74705c7682f506ce856f9ec5a8e4fe743327bdc884c66556c3501c49ee757cf9","revision":1}}