---
title: "Art. 19 Data Act: Obligations of public sector bodies, the Commission, the European Central Bank and Union bodies"
canonical: "https://dposchool.com/data-act/article/19"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_19"
source_note: "Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2023-12-22"
language: "en"
publisher: "DPO School"
---

Art. 19 Data Act · Chapter V: MAKING DATA AVAILABLE TO PUBLIC SECTOR BODIES, THE COMMISSION, THE EUROPEAN CENTRAL BANK AND UNION BODIES ON THE BASIS OF AN EXCEPTIONAL NEED

# Article 19 Data Act: Obligations of public sector bodies, the Commission, the European Central Bank and Union bodies

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

## Official text

### Article 19(1)

**1.** A public sector body, the Commission, the European Central Bank or a Union body receiving data pursuant to a request made under Article 14 shall:

#### Article 19(1)(a)

**(a)** not use the data in a manner incompatible with the purpose for which they were requested;

#### Article 19(1)(b)

**(b)** have implemented technical and organisational measures that preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular personal data, and safeguard the rights and freedoms of data subjects;

#### Article 19(1)(c)

**(c)** erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that received the data pursuant to Article 21(1) without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to documents in the context of transparency obligations.

### Article 19(2)

**2.** A public sector body, the Commission, the European Central Bank, a Union body or a third party receiving data under this Chapter shall not:

#### Article 19(2)(a)

**(a)** use the data or insights about the economic situation, assets and production or operation methods of the data holder to develop or enhance a connected product or related service that competes with the connected product or related service of the data holder;

#### Article 19(2)(b)

**(b)** share the data with another third party for any of the purposes referred to in point (a).

### Article 19(3)

**3.** Disclosure of trade secrets to a public sector body, the Commission, the European Central Bank or a Union body shall be required only to the extent that it is strictly necessary to achieve the purpose of a request under Article 15. In such a case, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata. The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, technical standards and the application of codes of conduct.

### Article 19(4)

**4.** A public sector body, the Commission, the European Central Bank or a Union body shall be responsible for the security of the data it receives.

## Source

Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 19 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_19)

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[Data Act Navigator](https://dposchool.com/data-act) / [Chapter V](https://dposchool.com/data-act/chapter/5) / Article 19

Previous: [Art. 18 Data Act: Compliance with requests for data](https://dposchool.com/data-act/article/18)

Next: [Art. 20 Data Act: Compensation in cases of an exceptional need](https://dposchool.com/data-act/article/20)

## For AI agents

- Machine-readable index: https://dposchool.com/data-act/llms.txt
- JSON API: https://dposchool.com/data-act/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents