---
type: Right
title: "Your data can't be quietly reached across borders."
description: "Providers must publish where it lives and shield it from unlawful foreign access."
tags: ["right", "eu-data-act"]
instrument: eu-data-act
articles: [28, 32]
applies_from: 2025-09-12
attaches_to: ["cloud", "cloud-ai"]
pairs_with: ["gdpr"]
legal_review: none
# Dated phases, for the rulebook's time axis. Every date is one of the
# Act's milestones; verify checks it.
phases:
  - { date: 2025-09-12, what: "Applies" }
generated: { by: claude-code/opus-5.5, at: "2026-10-09T00:00:00Z" }
status: draft
sources:
  - id: eli
    resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
    title: "Regulation (EU) 2023/2854"
  - id: prototype
    resource: "https://github.com/DavidJCrawford/stewardship-explorer/blob/main/src/data/rights.json"
    title: "stewardship-explorer rights.json"
---

# The right

**Your data can't be quietly reached across borders.** Providers must publish where it lives and shield it from unlawful foreign access.

The jurisdictions your data sits in must be published, and your provider must take real measures against foreign governmental access that would conflict with EU or national law.[^eli]

# The law behind it

[Article 28](/law/eu-data-act/articles/article-28.md), [Article 32](/law/eu-data-act/articles/article-32.md). Applies from 2025-09-12.

# Where it lives in the building

[cloud](/building/components/cloud.md), [cloud-ai](/building/components/cloud-ai.md)

# The wider rulebook

[gdpr](/law/wider-rulebook/gdpr.md)

[^eli]: Regulation (EU) 2023/2854