GDPR Procedural Regulation
Data & Privacy
- Data Act
- Data Governance Act
- EHDS
- ePrivacy Directive
- GDPR
- GDPR Procedural Regulation
AI & Trust
- Artificial Intelligence Act
- Product Liability Directive
Cybersecurity
- Cyber Resilience Act
- Cybersecurity Act
- DORA
- NIS2
Digital Services & Media
- Digital Markets Act
- Digital Services Act
- European Media Freedom Act
GDPR Procedural Regulation
- Recitals
CHAPTER I
GENERAL PROVISIONSArticles 1 — 3
CHAPTER II
LODGING OF COMPLAINTS AND EARLY RESOLUTIONArticles 4 — 5
CHAPTER III
COOPERATION UNDER ARTICLE 60 OF REGULATION (EU) 2016/679Articles 6 — 23
CHAPTER IV
ADMINISTRATIVE FILE, COOPERATION FILE AND TREATMENT OF CONFIDENTIAL INFORMATIONArticles 24 — 26
CHAPTER V
DISPUTE RESOLUTIONArticles 27 — 30
CHAPTER VII
GENERAL AND FINAL PROVISIONSArticles 34 — 37
GDPR-PR
GDPR-PR Article 25. Identification and protection of confidential information
- 1.Any information, documents or parts of documents shall be considered confidential in so far as they contain trade secrets as defined in Directive (EU) 2016/943 of the European Parliament and the Council or other confidential information in accordance with Union or national law.
- 2.Unless otherwise provided for by Union or national law, information collected, produced or obtained by a supervisory authority in a case concerning cross-border processing under Regulation (EU) 2016/679, which is considered confidential pursuant to paragraph 1, shall not be communicated or made accessible to a party under investigation, a complainant or any third person.
- 3.A party under investigation, a complainant, or a third person submitting information that it considers to be confidential shall clearly identify that information, giving reasons for the confidentiality claimed. The party under investigation, complainant, or third person shall always provide the full version of the information. Where possible, it shall also provide a proposed non-confidential version.
- 4.Without prejudice to paragraph 3, the supervisory authority to which the information is submitted may require the parties under investigation, or any other person that submits documents, to identify the documents or parts of documents that they consider to contain trade secrets or other confidential information belonging to them and to identify the persons concerned with regard to the confidentiality of those trade secrets or other confidential information.
- 5.The supervisory authority to which the information is submitted shall set an appropriate time-limit no longer than six weeks for parties under investigation and any other person claiming that the information submitted is confidential to:
- (a)substantiate their claims that the information submitted contains trade secrets or other confidential information for each individual document or part of document, statement, or part of statement;
- (b)propose, where possible, a non-confidential version of the documents and statements, in which the trade secrets or other confidential information are redacted;
- (c)provide a concise, non-confidential, description of each piece of redacted information.
- 6.If the parties under investigation or any other person fails to comply with paragraphs 4 and 5, the supervisory authority to which the information is submitted may assume that the documents or statements concerned do not contain trade secrets or other confidential information.
- 7.The supervisory authority to which the information is submitted shall determine whether or not the information or relevant and specific parts of documents are confidential, in accordance with paragraph 1. It shall ensure that the redaction of documents is limited to what is necessary and proportionate to protect the confidential information. The supervisory authority to which the information is submitted shall inform the other supervisory authorities about the confidential nature of the information when transmitted.
- 8.Information regarded as confidential information under the national law of the supervisory authority to which the information is submitted and exchanged between supervisory authorities in the application of Regulation (EU) 2016/679, shall continue to be treated as confidential by the supervisory authority receiving it.