---
type: Statutory Article
title: "Article 11 — Technical protection measures on the unauthorised use or disclosure of data"
description: "Protection is legitimate; protection-as-obstruction is not. The lock guards the agreement, never the exit."
resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
tags: ["eu-data-act", "chapter-iii", "safeguards"]
instrument: eu-data-act
article: 11
chapter: "III"
binds: ["data-holder", "third-party"]
applies_from: 2025-09-12
cross_refs: [4, 5, 6, 8]
attaches_to: ["cloud", "head-end", "local-ai"]
legal_review: none
generated: { by: claude-code/opus-5.5, at: "2026-10-09T00:00:00Z" }
status: draft
sources:
  - id: eli
    resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
    title: "Regulation (EU) 2023/2854, Official Journal"
  - id: prototype
    resource: "https://github.com/DavidJCrawford/stewardship-explorer/blob/main/src/data/act.json"
    title: "stewardship-explorer act.json (author's summaries, July 2026)"
---

# Precise reading

Data holders may apply appropriate technical protection (including smart contracts, encryption) to enforce agreed conditions — but not to hinder the user's rights; unauthorised use or onward disclosure triggers deletion/destruction duties and possible compensation.[^eli]

*A faithful summary of the operative demand, not the statutory text.*

# Plain reading

Protection is legitimate; protection-as-obstruction is not. The lock guards the agreement, never the exit.

*Paraphrase.*

# Facts

| | |
| --- | --- |
| Chapter | III — [Obligations for Data Holders Obliged to Make Data Available Pursuant to Union Law](/law/eu-data-act/chapters.md) |
| Binds | [Data Holder](/law/eu-data-act/actors.md), [Third Party / Data Recipient](/law/eu-data-act/actors.md) |
| Applies from | 2025-09-12 |
| Cross-references | [Article 4](/law/eu-data-act/articles/article-04.md), [Article 5](/law/eu-data-act/articles/article-05.md), [Article 6](/law/eu-data-act/articles/article-06.md), [Article 8](/law/eu-data-act/articles/article-08.md) |
| Where it attaches in the building | [cloud](/building/components/cloud.md), [head-end](/building/components/head-end.md), [local-ai](/building/components/local-ai.md) |

# Rights that rest on it

- None of the seven rights rests on this article directly.

[^eli]: Regulation (EU) 2023/2854, Official Journal