# Article 5 — Processing of personal data in the DSA data access portal **Commission Delegated Regulation (EU) 2025/2050 · binding · OJ L, 2025/2050, 9.10.2025 · dated 1 Jul 2025 [in force]** *In force · Commission Delegated Regulation (EU) 2025/2050, OJ L, 2025/2050, 9.10.2025 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg_del/2025/2050/oj/eng)* 1. Where personal data are registered in and exchanged via the DSA data access portal, the processing shall take place only in so far as it is proportionate and necessary for the purpose of the data access process and publication of relevant information. 2. The processing of personal data shall take place in the DSA data access portal only in respect of the following categories of data subjects: **(a)** natural persons having an account on the DSA data access portal; **(b)** natural persons whose personal data is contained in the DSA data access portal or in any other exchange pursuant to this Regulation concerning the data access process. 3. The processing of personal data shall take place in the DSA data access portal only in respect of the following categories of personal data: **(a)** identity data, such as name, user ID; **(b)** contact information such as address, email address, contact details; **(c)** personal data contained in the documentation demonstrating the affiliation to a research organisation, and any other personal information deemed necessary for the purpose of participating in the data access process. 4. The processing of personal data referred to in paragraph 1 shall be performed using information technology infrastructure located in the European Economic Area.