---
title: "Recital 37 Data Act"
canonical: "https://dposchool.com/data-act/recital/37"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#rct_37"
source_note: "Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-30"
language: "en"
publisher: "DPO School"
---

Recitals

# Recital 37 Data Act

Official Journal text of 22 December 2023. Retrieved 30 October 2026.

## Official text

In order to prevent the exploitation of users, third parties to whom data has been made available at the request of the user should process those data only for the purposes agreed with the user and share them with another third party only with the agreement of the user to such data sharing.

## Source

Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Recital 37 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#rct_37)

Official Journal text of 22 December 2023. Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[Data Act Navigator](https://dposchool.com/data-act) / [Recitals](https://dposchool.com/data-act/recitals) / Recital 37

Previous: [Recital 36 Data Act](https://dposchool.com/data-act/recital/36)

Next: [Recital 38 Data Act](https://dposchool.com/data-act/recital/38)

## For AI agents

- Machine-readable index: https://dposchool.com/data-act/llms.txt
- JSON API: https://dposchool.com/data-act/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents