{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2024/607 — Implementing act — Functioning of the information sharing system [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annexes/annex-ii","url":"https://www.headlesslaw.com/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annexes/annex-ii","title":"ANNEX II","family":"l2_unit_view","work_id":"spaces/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system","view_of":"/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Implementing Regulation (EU) 2024/607, OJ L, 2024/607, 16.2.2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_impl/2024/607/oj/eng","valid_from":"2024-03-07","valid_until":null,"content_id":"da59ec9d32a56f89","versions":["2024-03-07"],"version_url":"https://www.headlesslaw.com/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annexes/annex-ii/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annexes/annex-ii/versions/2026-10-26/rev/da59ec9d32a56f89","versions_url":"https://www.headlesslaw.com/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annexes/annex-ii/versions","relations_url":"https://www.headlesslaw.com/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annexes/annex-ii/relations","act_url":"https://www.headlesslaw.com/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system#annex-ii","source_line":"Commission Implementing Regulation (EU) 2024/607 · binding · OJ L, 2024/607, 16.2.2024 · dated 15 Feb 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-02-15","published_on":"2024-02-16","entry_into_force":"2024-03-07","locators":{"document_date":"CELLAR 32024R0607 work_date_document","published_on":"CELLAR 32024R0607 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R0607 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system","path":"/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system","name":"Commission Implementing Regulation (EU) 2024/607","number":"2024/607","celex":"32024R0607","title_official":"COMMISSION IMPLEMENTING REGULATION (EU) 2024/607 of 15 February 2024 on the practical and operational arrangements for the functioning of the information sharing system pursuant to Regulation (EU) 2022/2065 of the European Parliament and of the Council (‘Digital Services Act’)","document_date":"2024-02-15"},"position":{"kind":"annex","key":"annex-ii","index":2,"articles":18,"annexes":2},"prev":{"path":"/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annexes/annex-i","key":"annex-i","title":"ANNEX I"},"next":null,"act_anchor":"#annex-ii"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_impl/2024/607/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system.md","unit_text_sha256":"50e1a7c3a1a79d846aa9670e764c852008d35a5233189b3239f57017d72e6c70","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dsa/level-2/implementing-acts/2024-607-functioning-of-the-information-sharing-system/annex-ii","kind":"annex","key":"annex-ii","heading":"ANNEX II","text":"## ANNEX II\n\n<a id=\"annex-ii\"></a>Responsibilities of the commission as processor for data processing activities conducted in the context of AGORA by Digital Services Coordinators, other national authorities and the Board\n\n(1)\n\nThe Commission shall:\n\n(a)\n\nset up and ensure a secure and reliable communication infrastructure, the AGORA, on behalf of the Digital Services Coordinators, other national authorities and the Board that supports the exchange of information for coordinated investigations, consistency mechanisms and activities of the Board, and\n\n(b)\n\nprocess personal data only based on documented instructions from the controllers and joint controllers, unless required to do so under Union or Member State laws; in such a case, the Commission shall inform the controllers and joint controllers of that legal requirement before carrying on the processing activity, unless that law prohibits submitting such information on important grounds of public interest.\n\n(2)\n\nTo fulfil its obligations as processor for the Digital Services Coordinators, other national authorities and the Board, the Commission may use third parties as sub-processors. If it is the case, the controllers and joint controllers shall authorise the Commission to use sub-processors or replace sub-processors where necessary. The Commission shall inform the controllers and joint controllers of said use or replacement of sub-processors, thereby giving the controllers and joint controllers the opportunity to object to any such changes. The Commission shall ensure that the same data protection obligations as set out in this Regulation apply to these sub-processors.\n\n(3)\n\nThe processing by the Commission shall entail:\n\n(a)\n\nauthentication and access control with regard to all AGORA administrators and AGORA users;\n\n(b)\n\nauthorisation of AGORA administrators and AGORA users to create, update and delete any records and information contained in AGORA;\n\n(c)\n\nreception of the personal data referred to in Article 12(3) of this Regulation uploaded by national AGORA users and AGORA administrators by providing an application programming interface that allows national AGORA users and AGORA administrators to upload the relevant data;\n\n(d)\n\nstorage of the personal data in AGORA;\n\n(e)\n\nmaking the personal data available for access and download by AGORA administrators and AGORA users and any other necessary data processing activity;\n\n(f)\n\ndeletion of the personal data at their expiration date or upon instruction of the controller that submitted them;\n\n(g)\n\nafter the end of the provision of service, deletion of any remaining personal data unless Union or Member State laws require storage of such personal data.\n\n(4)\n\nThe Commission shall take all state of the art organisational, physical, and logical security measures to ensure AGORA functioning. To this end, the Commission shall:\n\n(a)\n\ndesignate a responsible entity for the security management of AGORA, communicate to the joint controllers its contact information and ensure its availability to react to security threats;\n\n(b)\n\nassume the responsibility for the security of AGORA, including regularly carrying out tests, evaluations and assessments of the security measures;\n\n(c)\n\nensure that AGORA administrators and AGORA users that are granted access to AGORA are subject to a contractual, professional or statutory obligation of confidentiality.\n\n(5)\n\nThe Commission shall take all necessary security measures to avoid compromising the smooth operational functioning of AGORA. This shall include:\n\n(a)\n\nrisk assessment procedures to identify and estimate potential threats to AGORA;\n\n(b)\n\naudit and review procedure to:\n\n—\n\ncheck the correspondence between the implemented security measures and the applicable security policy;\n\n—\n\ncontrol on a regular basis the integrity of AGORA files, security parameters and granted authorisations;\n\n—\n\ndetect security breaches and intrusions into AGORA;\n\n—\n\nimplement changes to mitigate existing security weaknesses in AGORA;\n\n—\n\ndefine the conditions under which to authorise, including at the request of controllers, and contribute to, the performance of independent audits, including inspections, and reviews on security measures subject to conditions that respect Protocol (No 7) to the Treaty on the Functioning of the European Union on the Privileges and Immunities of the European Union;\n\n(c)\n\nchanging the control procedure to document, measure the impact of a change before its implementation, and keep the controllers and joint controllers informed of any changes that can affect the communication with and/or the security of AGORA;\n\n(d)\n\nlaying down a maintenance and repair procedure to specify the rules and conditions to be respected when maintenance and/or repair of AGORA equipment is to be performed;\n\n(e)\n\nlaying down a security incident procedure to define the reporting and escalation scheme, inform without delay the controllers affected, inform without delay the controllers for them to notify the national data protection supervisory authorities of any personal data breach and define a disciplinary process to deal with security breaches in AGORA.\n\n(6)\n\nThe Commission shall take state of the art physical and logical security measures for the facilities hosting AGORA and for the controls of data and security access thereto. To this end, the Commission shall:\n\n(a)\n\nenforce physical security to establish distinct security perimeters and allowing detection of breaches in AGORA;\n\n(b)\n\ncontrol access to AGORA facilities and maintain a AGORA visitor register for tracing purposes;\n\n(c)\n\nensure that external individuals granted access to the premises are escorted by duly authorised staff;\n\n(d)\n\nensure that equipment cannot be added, replaced or removed without prior authorisation from the designated responsible bodies;\n\n(e)\n\ncontrol access from and to the AGORA;\n\n(f)\n\nensure that AGORA administrators and AGORA users who access AGORA are identified and authenticated;\n\n(g)\n\nreview the authorisation rights related to the access to AGORA in case of a security breach affecting AGORA;\n\n(h)\n\nkeep the integrity of the information transmitted through AGORA;\n\n(i)\n\nimplement technical and organisational security measures to prevent unauthorised access to personal data in AGORA;\n\n(j)\n\nimplement, whenever necessary, measures to block unauthorised access to AGORA (i.e., block a location/IP address).\n\n(7)\n\nThe Commission shall:\n\n(a)\n\ntake steps to protect its domain, including the severing of connections, in the event of substantial deviation from the principles and concepts for quality and security;\n\n(b)\n\nmaintain a risk management plan related to its area of responsibility;\n\n(c)\n\nmonitor, in real time, the performance of all the service components of AGORA, produce regular statistics and keep records;\n\n(d)\n\nprovide support for AGORA in English to AGORA administrators and AGORA users;\n\n(e)\n\nassist the controllers and joint controllers by appropriate technical and organisational measures for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of Regulation (EU) 2016/679;\n\n(f)\n\nsupport the controllers and joint controllers by providing information concerning AGORA to implement the obligations pursuant to Articles 32, 33, 34, 35 and 36 of Regulation (EU) 2016/679;\n\n(g)\n\nensure that data processed within AGORA is unintelligible to any person who is not authorised to access it;\n\n(h)\n\ntake all relevant measures to prevent unauthorised access to transmitted personal data via AGORA;\n\n(i)\n\ntake measures in order to facilitate communication between the controllers and joint controllers;\n\n(j)\n\nmaintain a record of processing activities carried out on behalf of the controllers and joint controllers in accordance with Article 31(2) of Regulation (EU) 2018/1725.\n\n","marks":[],"text_hash":"50e1a7c3a1a79d846aa9670e764c852008d35a5233189b3239f57017d72e6c70","revision":1}}