---
type: Statutory Article
title: "Article 28 — Contractual transparency obligations on international access and transfer"
description: "Where your data physically lives, and what shields it from foreign subpoenas — published, not whispered."
resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
tags: ["eu-data-act", "chapter-vi", "switching", "safeguards"]
instrument: eu-data-act
article: 28
chapter: "VI"
binds: ["dps-provider"]
applies_from: 2025-09-12
cross_refs: [32]
attaches_to: ["cloud"]
legal_review: none
generated: { by: claude-code/opus-5.5, at: "2026-10-09T00:00:00Z" }
status: draft
sources:
  - id: eli
    resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
    title: "Regulation (EU) 2023/2854, Official Journal"
  - id: prototype
    resource: "https://github.com/DavidJCrawford/stewardship-explorer/blob/main/src/data/act.json"
    title: "stewardship-explorer act.json (author's summaries, July 2026)"
---

# Precise reading

Providers must make available (website, kept current) the jurisdictions their infrastructure sits in, and describe technical/organisational/contractual measures against unlawful third-country governmental access to non-personal data.[^eli]

*A faithful summary of the operative demand, not the statutory text.*

# Plain reading

Where your data physically lives, and what shields it from foreign subpoenas — published, not whispered.

*Paraphrase.*

# Facts

| | |
| --- | --- |
| Chapter | VI — [Switching Between Data Processing Services](/law/eu-data-act/chapters.md) |
| Binds | [Data Processing Service Provider](/law/eu-data-act/actors.md) |
| Applies from | 2025-09-12 |
| Cross-references | [Article 32](/law/eu-data-act/articles/article-32.md) |
| Where it attaches in the building | [cloud](/building/components/cloud.md) |

# Rights that rest on it

- [Your data can't be quietly reached across borders.](/rights/borders.md)

[^eli]: Regulation (EU) 2023/2854, Official Journal