<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/recitals/164","url":"https://www.headlesslaw.com/gdpr/recitals/164","title":"Recital 164","family":"l1_recital_view","work_id":"gdpr","view_of":"/gdpr/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Regulation (EU) 2016/679, OJ L 119, 4.5.2016","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","valid_from":"2016-05-04","valid_until":null,"content_id":"59a4e42ec554415d","versions":["2016-05-04"],"version_url":"https://www.headlesslaw.com/gdpr/recitals/164/versions/2016-05-04","revision_url":"https://www.headlesslaw.com/gdpr/recitals/164/versions/2016-05-04/rev/59a4e42ec554415d","versions_url":"https://www.headlesslaw.com/gdpr/recitals/164/versions","relations_url":"https://www.headlesslaw.com/gdpr/recitals/164/relations","act_url":"https://www.headlesslaw.com/gdpr/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"gdpr","path":"/gdpr/recitals","name":"GDPR","number":"Regulation (EU) 2016/679","celex":"32016R0679","title_official":null,"document_date":null},"position":{"kind":"recital","key":"164","index":164,"articles":173,"annexes":0},"prev":{"path":"/gdpr/recitals/163","key":"163","title":"Recital 163"},"next":{"path":"/gdpr/recitals/165","key":"165","title":"Recital 165"},"act_anchor":""}}} -->
# Recital 164

*In force · Regulation (EU) 2016/679, OJ L 119, 4.5.2016 · Checked against EUR-Lex on 1 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)*

As regards the powers of the supervisory authorities to obtain from the controller or processor access to personal data and access to their premises, Member States may adopt by law, within the limits of this Regulation, specific rules in order to safeguard the professional or other equivalent secrecy obligations, in so far as necessary to reconcile the right to the protection of personal data with an obligation of professional secrecy. This is without prejudice to existing Member State obligations to adopt rules on professional secrecy where required by Union law.