---
title: "Non-Personal Data Across Borders | Pitch"
description: "What the Data Act and the Data Governance Act require when a foreign court or authority wants access to non-personal data held in the EU, and what cloud…"
url: https://pitch.law/academy/non-personal-data-across-borders
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# Non-Personal Data Across Borders

What the Data Act and the Data Governance Act require when a foreign court or authority wants access to non-personal data held in the EU, and what cloud providers must tell their customers.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

Most people know the transfer rules for personal data: Chapter V of the [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) and the debate after Schrems II. Fewer know that the EU also protects non-personal data, such as machine readings, production figures, aggregated statistics or anonymised datasets, against access by foreign governments. Two regulations do that, with almost identical wording.

### The texts and their dates

- **The Data Act**, [Regulation (EU) 2023/2854](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854), in force since 11 January 2024 and applicable from 12 September 2025 ([Article 50](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_50)). Chapter VII, "Unlawful international governmental access and transfer of non-personal data", consists of a single provision: [Article 32](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_32). [Article 28](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_28) adds a transparency duty.
- **The Data Governance Act**, [Regulation (EU) 2022/868](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R0868), in force since 23 June 2022 and applicable from 24 September 2023 ([Article 38](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_38)). The counterpart is [Article 31](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_31), "International access and transfer", with specific transfer conditions in [Article 5(9) to (14)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_5).

### Who is caught

Under the Data Act, the duties fall on **providers of data processing services**. Article 2(8) defines these as digital services that give a customer on-demand network access to a shared pool of configurable, scalable and elastic computing resources. In practice that covers cloud infrastructure, platforms and many SaaS offerings. Chapter VII applies to "any non-personal data held in the Union by providers of data processing services" (Article 1(2)(f)), and the Act reaches providers "irrespective of their place of establishment" when they serve customers in the Union (Article 1(3)(f)). A Belgian hosting company and a non-EU hyperscaler selling to Belgian customers are both in scope.

Under the Data Governance Act, Article 31 binds four groups: public sector bodies, anyone granted a right to re-use protected public-sector data under Chapter II, **data intermediation services providers** and **recognised data altruism organisations**. A research spin-off that obtains confidential data from a government agency, or a data marketplace that has notified itself as an intermediary, carries the duty.

### The duty to prevent unlawful access

Both texts start the same way. The provider (Data Act Article 32(1)) or the DGA actor (Article 31(1)) must take technical, organisational and legal measures, "including contracts" or "contractual arrangements", to prevent international or third-country governmental access to, and transfer of, non-personal data held in the Union "where such transfer or access would create a conflict with Union law or with the national law of the relevant Member State". The Data Act asks for "all adequate" measures, the DGA for "all reasonable" ones.

### When a foreign order may be followed

Paragraph 2 of both articles says a decision or judgment of a third-country court or authority is recognised or enforceable only if it rests on an international agreement, such as a mutual legal assistance treaty, between that country and the EU or a Member State.

Without such an agreement, paragraph 3 applies where complying would risk a conflict with Union or national law. Access or transfer may then take place only if all three conditions are met:

1. the foreign system requires the reasons and proportionality of the order to be set out, and the order to be specific, for instance linked to certain suspected persons or infringements;
2. a reasoned objection by the addressee can be reviewed by a competent court in that country; and
3. that court may take into account the legal interests of the data provider protected by EU or Member State law.

The Data Act adds a procedure. The addressee may ask the national authority competent for international cooperation in legal matters whether the conditions are met, in particular where trade secrets, IP-protected content or a risk of re-identification are involved. If national security or defence may be affected, asking that opinion is mandatory. With no reply within one month, or a negative opinion, the provider may reject the request on those grounds (Article 32(3), second subparagraph).

Two duties follow in both texts. Only the **minimum amount of data** permissible is handed over, based on a reasonable interpretation of the request (paragraph 4). And the provider must **inform the customer** (Data Act) or the **data holder** (DGA) of the request before complying, unless the request serves law enforcement and for as long as secrecy is needed to keep that effective (paragraph 5).

### Transparency for cloud customers

Article 28 of the Data Act requires providers of data processing services to publish, and keep up to date on their website: (a) the jurisdiction to which the ICT infrastructure for each service is subject, and (b) a general description of the technical, organisational and contractual measures they take to prevent unlawful international governmental access or transfer. Those web pages must be listed in the contracts for all their data processing services (Article 28(2)).

### Re-users of protected public-sector data

Chapter II of the DGA covers public-sector data protected by commercial or statistical confidentiality, third-party IP or personal data protection (Article 3(1)). Article 5 adds transfer rules for re-users:

- A re-user who intends to transfer such non-personal data to a third country must say so, with the purpose, when it requests re-use (Article 5(9)).
- Unless the country has been declared equivalent by the Commission (Article 5(12)), the public sector body transmits confidential or IP-protected non-personal data only if the re-user contractually commits to keep the confidentiality and IP obligations after the transfer and to accept the jurisdiction of the courts of the body's Member State (Article 5(10)).
- Specific Union acts may label certain non-personal data categories "highly sensitive", after which special transfer conditions follow by delegated act (Article 5(13)).
- The re-user may transfer only to third countries for which the requirements of paragraphs 10, 12 and 13 are met (Article 5(14)).

Recognised data altruism organisations must also tell data subjects and data holders, before processing, where any processing in a third country takes place and for which objectives of general interest ([Article 21(1)(b)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_21)).

### Enforcement

Under [Article 34](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_34) of the DGA, Member States set penalties for breaches of Article 5(14) and Article 31. The Data Act also leaves penalties to the Member States ([Article 40](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_40)).

### Health data: the same pattern

The European Health Data Space Regulation, [Regulation (EU) 2025/327](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R0327), copies the model for non-personal electronic health data. [Article 89](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_89) repeats the duty to prevent, the three conditions and the notice to the data holder. [Article 88](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_88) treats certain non-personal health data sent to users in third countries as "highly sensitive" under DGA Article 5(13) where re-identification is a risk. These provisions apply from 26 March 2027. Our article on [secondary use and data permits in the European Health Data Space](https://pitch.law/academy/european-health-data-space-secondary-use-and-data-permits) explains the wider system.

## In practice

### A Belgian SaaS provider with a non-EU parent

Take a Belgian company that hosts sensor data for European manufacturers on infrastructure run by its US parent. The data are non-personal, so the GDPR transfer rules are not the issue. The Data Act is.

It should publish an Article 28 page that names the jurisdiction of the infrastructure behind each service and describes its safeguards, and list that page in every customer contract. Internally, it needs a written procedure for foreign requests: who receives them, who checks whether a treaty applies, who tests the three conditions of Article 32(3), when to ask the national authority for an opinion, and how the customer is informed. Intra-group agreements should oblige the parent to pass on any request it receives and to disclose nothing without that check.

### A spin-off re-using confidential public data

A university spin-off obtains confidential company data from a public agency under the DGA and wants a partner lab in a third country to run part of the analysis. It has to state that intention in its re-use request (Article 5(9)). Unless that country has been declared equivalent, it signs a commitment to keep the confidentiality and IP obligations and to accept the courts of the agency's Member State (Article 5(10)). Leaving the transfer out of the request and adding it later is the classic mistake.

### Buying cloud as a customer

If you put production or R\&D data in the cloud, read the provider's Article 28 page before signing and check that the contract refers to it. Then add what the Act implies but your form may not say: prompt notice of any third-country request (within the limit of Article 32(5)), disclosure limited to the minimum, cooperation if you want to object, and a duty to keep the Article 28 information current. If a provider's terms let it hand data to "any competent authority" without those steps, that is a point to negotiate.

### A short checklist

- Map which of your datasets are non-personal and where they are held.
- Determine your role: provider of data processing services, DGA re-user, data intermediation services provider or data altruism organisation.
- Write the request-handling procedure and train the people who receive legal mail.
- Align intra-group and subcontractor agreements with Article 32 or Article 31.
- Keep a log of requests, opinions sought and data disclosed.

## Frequently asked questions

### Do these rules forbid storing non-personal data outside the EU?

Not as such. Article 32 of the Data Act and Article 31 of the DGA are aimed at governmental access and transfers that would conflict with EU or national law. They require measures and set conditions for complying with foreign orders. Re-users of protected public-sector data under the DGA do face real transfer conditions in Article 5.

### We are a customer. What do we actually get?

From your provider: the Article 28 information on its website, a reference to it in your contract, and notice before it complies with a third-country request, unless a law enforcement exception applies. Anything beyond that, such as audit rights or a right to object, you need to agree in the contract.

### What if data are anonymised personal data?

Anonymised data are non-personal, so these rules apply to them. The DGA allows certain categories to be declared highly sensitive where re-identification is a risk, and the EHDS does exactly that for some health data. If data can still be linked to a person, they remain personal data and Chapter V of the GDPR applies.

### Does a US subpoena count as a decision of a third-country authority?

Article 32 refers to any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority. Whether a specific order meets the paragraph 3 conditions is a case-by-case legal assessment, which is why the Act lets the provider ask a national authority for an opinion.

## How this connects

Clauses on governmental access belong in every cloud, hosting and data-sharing contract. We draft and negotiate them as part of [data licensing and data sharing](https://pitch.law/solutions/data-licensing-sharing) and our [commercial contracts](https://pitch.law/solutions/commercial-contracts-transactions) work. When a provider sends its own terms, our [contract review](https://pitch.law/technologies/clause-library-risk-review) checks the access and notice clauses against our playbook, and once signed, [rights and obligations tracking](https://pitch.law/technologies/contract-obligations) keeps duties such as notice periods in view. For personal data, start with [international data transfers after Schrems II](https://pitch.law/academy/international-data-transfers-post-schrems-ii).

### At a glance

- **Provisions cited:** Data Act Articles 1(2)(f), 1(3)(f), 2(8), 28, 32, 40 and 50; DGA Articles 3(1), 5(9) to (14), 21(1)(b), 31, 34 and 38; EHDS Articles 88 and 89; GDPR Chapter V.
- **Key dates:** DGA applies 24-09-2023; Data Act applies 12-09-2025; EHDS Articles 88 and 89 apply 26-03-2027.
- **In this series:** [The Data Governance Act: data intermediaries and data altruism](https://pitch.law/academy/data-governance-act-data-intermediaries-and-data-altruism); [Data for AI: data spaces and licensing training data](https://pitch.law/academy/data-for-ai-data-spaces-and-licensing-training-data); [Re-using public-sector data](https://pitch.law/academy/re-using-public-sector-data-open-data-and-high-value-datasets); [European Health Data Space I](https://pitch.law/academy/european-health-data-space-secondary-use-and-data-permits).
- **Related reading:** [The EU Data Act](https://pitch.law/academy/eu-data-act); [International data transfers](https://pitch.law/academy/international-data-transfers-post-schrems-ii); [SaaS agreements](https://pitch.law/academy/saas-agreements).

## In short

- Who must guard non-personal data against foreign government access
- The three conditions for complying with a foreign order
- What cloud providers must publish and list in their contracts
- Transfer conditions for re-users of protected public-sector data
- Practical steps for providers and for customers

## Related solutions

- [Solutions](https://pitch.law/solutions/data-licensing-sharing)
  ### [Data Licensing and Data Sharing](https://pitch.law/solutions/data-licensing-sharing)
  [Share or license data without giving away more than you meant to. Clear scope, settled ownership of what is derived from it, and the GDPR layer built in.](https://pitch.law/solutions/data-licensing-sharing)
- [Solutions](https://pitch.law/solutions/commercial-contracts-transactions)
  ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions)
  [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/clause-library-risk-review)
  ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review)
  [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review)
- [Technology](https://pitch.law/technologies/contract-obligations)
  ### [Contract Management: Rights and Obligations](https://pitch.law/technologies/contract-obligations)
  [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://pitch.law/technologies/contract-obligations)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
  [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)