---
title: "Art. 18 Data Act: Compliance with requests for data"
canonical: "https://dposchool.com/data-act/article/18"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_18"
source_note: "Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2023-12-22"
language: "en"
publisher: "DPO School"
---

Art. 18 Data Act · Chapter V: MAKING DATA AVAILABLE TO PUBLIC SECTOR BODIES, THE COMMISSION, THE EUROPEAN CENTRAL BANK AND UNION BODIES ON THE BASIS OF AN EXCEPTIONAL NEED

# Article 18 Data Act: Compliance with requests for data

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

## Official text

### Article 18(1)

**1.** A data holder receiving a request to make data available under this Chapter shall make the data available to the requesting public sector body, the Commission, the European Central Bank or a Union body without undue delay, taking into account necessary technical, organisational and legal measures.

### Article 18(2)

**2.** Without prejudice to specific needs regarding the availability of data defined in Union or national law, a data holder may decline or seek the modification of a request to make data available under this Chapter without undue delay and, in any event, no later than five working days after the receipt of a request for the data necessary to respond to a public emergency and without undue delay and, in any event, no later than 30 working days after the receipt of such a request in other cases of an exceptional need, on any of the following grounds:

#### Article 18(2)(a)

**(a)** the data holder does not have control over the data requested;

#### Article 18(2)(b)

**(b)** a similar request for the same purpose has been previously submitted by another public sector body or the Commission, the European Central Bank or a Union body and the data holder has not been notified of the erasure of the data pursuant to Article 19(1), point (c);

#### Article 18(2)(c)

**(c)** the request does not meet the conditions laid down in Article 17(1) and (2).

### Article 18(3)

**3.** If the data holder decides to decline the request or to seek its modification in accordance with paragraph 2, point (b), it shall indicate the identity of the public sector body or the Commission, the European Central Bank or the Union body that previously submitted a request for the same purpose.

### Article 18(4)

**4.** Where the data requested includes personal data, the data holder shall properly anonymise the data, unless the compliance with the request to make data available to a public sector body, the Commission, the European Central Bank or a Union body requires the disclosure of personal data. In such cases, the data holder shall pseudonymise the data.

### Article 18(5)

**5.** Where the public sector body, the Commission, the European Central Bank or the Union body wishes to challenge a data holder’s refusal to provide the data requested, or where the data holder wishes to challenge the request and the matter cannot be resolved by an appropriate modification of the request, the matter shall be referred to the competent authority designated pursuant to Article 37 of the Member State where the data holder is established.

## Source

Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 18 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_18)

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[Data Act Navigator](https://dposchool.com/data-act) / [Chapter V](https://dposchool.com/data-act/chapter/5) / Article 18

Previous: [Art. 17 Data Act: Requests for data to be made available](https://dposchool.com/data-act/article/17)

Next: [Art. 19 Data Act: Obligations of public sector bodies, the Commission, the European Central Bank and Union bodies](https://dposchool.com/data-act/article/19)

## For AI agents

- Machine-readable index: https://dposchool.com/data-act/llms.txt
- JSON API: https://dposchool.com/data-act/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents