EU Data Act · Chapter VI · Switching Between Data Processing Services
Article 28
Contractual transparency obligations on international access and transfer
Precise reading
Providers must make available (website, kept current) the jurisdictions their infrastructure sits in, and describe technical/organisational/contractual measures against unlawful third-country governmental access to non-personal data.
A summary of the operative demand, not the statute.
Plain reading
Where your data physically lives, and what shields it from foreign subpoenas — published, not whispered.
Paraphrase.
Facts
| Applies from | 12 September 2025 |
|---|---|
| Binds | Data Processing Service Provider |
| Cross-references | Article 32 |
| On the trace | Stop 3, Cloud service |
| Rights that rest on it | Your data can't be quietly reached across borders. |
The Regulation in the Official Journal · This article in the knowledge base
Not legal advice. This is the author’s own reading of the law, written to help facilities managers ask better questions. It has not been reviewed by a lawyer. For decisions, read the official text and take legal advice.