---
title: "Art. 28 Data Act: Contractual transparency obligations on international access and transfer"
canonical: "https://dposchool.com/data-act/article/28"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_28"
source_note: "Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2023-12-22"
language: "en"
publisher: "DPO School"
---

Art. 28 Data Act · Chapter VI: SWITCHING BETWEEN DATA PROCESSING SERVICES

# Article 28 Data Act: Contractual transparency obligations on international access and transfer

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

## Official text

### Article 28(1)

**1.** Providers of data processing services shall make the following information available on their websites, and keep that information up to date:

#### Article 28(1)(a)

**(a)** the jurisdiction to which the ICT infrastructure deployed for data processing of their individual services is subject;

#### Article 28(1)(b)

**(b)** a general description of the technical, organisational and contractual measures adopted by the provider of data processing services in order to prevent international governmental access to or transfer of non-personal data held in the Union where such access or transfer would create a conflict with Union law or the national law of the relevant Member State.

### Article 28(2)

**2.** The websites referred to in paragraph 1 shall be listed in contracts for all data processing services offered by providers of data processing services.

## Source

Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 28 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_28)

Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[Data Act Navigator](https://dposchool.com/data-act) / [Chapter VI](https://dposchool.com/data-act/chapter/6) / Article 28

Previous: [Art. 27 Data Act: Obligation of good faith](https://dposchool.com/data-act/article/27)

Next: [Art. 29 Data Act: Gradual withdrawal of switching charges](https://dposchool.com/data-act/article/29)

## For AI agents

- Machine-readable index: https://dposchool.com/data-act/llms.txt
- JSON API: https://dposchool.com/data-act/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents