See Full Document Text
Official Journal EN
of the European Union L series
2026/1447 3.7.2026
COMMISSION DECISION(EU) 2026/1447
of 30 June 2026
laying down internal rules concerning the provision of information to data subjects and the
restriction of certain data-subjects’ rights in relation to the processing of personal data by the
Commission for the purpose of investigation, enforcement and monitoring under Regulation
(EU) 2022/2560 of the European Parliament and of the Council
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the
protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and
agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision
No 1247/2002/EC(1), and in particular Article 25 thereof,
Whereas:
(1) Regulation (EU) 2022/2560 of the European Parliament and of the Council(2)empowers the Commission to collect
information for investigation, enforcement, and monitoring purposes through several means, such as requests for
information, inspections, conducting interviews. Moreover, Regulation (EU) 2022/2560 obliges undertakings and
economic operators to notify to the Commission concentrations and public procurement procedures involving
foreign financial contributions provided certain thresholds are met. Effective investigation, enforcement and
monitoring under Regulation (EU) 2022/2560 requires cooperation between the Member States and the
Commission, as well as a seamless exchange of information between the Member States and the Commission.
(2) The tasks under Regulation (EU) 2022/2560 are carried out by the Directorate-General responsible for Competition
and by the Directorate-General responsible for Internal Market, Industry, Entrepreneurship and SMEs.
(3) In the context of the investigation, enforcement, and monitoring tasks pursuant to Regulation (EU) 2022/2560, the
Commission processes information. That information includes personal data of natural persons, such as informants,
staff of the undertakings under investigation, as well as natural persons whose personal data is contained in
documents obtained in connection with investigation, enforcement and monitoring activities in accordance with
Regulation (EU) 2022/2560.
(4) Personal data processing, within the meaning of Article 3(3) of Regulation (EU) 2018/1725, carried out in the course
of investigation, enforcement and monitoring activities under Regulation (EU) 2022/2560, may take place even
before the Commission formally initiates the preliminary review, continue throughout the in-depth investigation and
may continue even after the formal closure of the investigation, for example, for compliance monitoring or screening
activities, assessing the need for initiating new investigative activities or legal proceedings.
(5) In order to fulfil its tasks under Regulation (EU) 2022/2560, the Commission as data controller collects and further
processes several categories of personal data, such as identification data, contact details and other case-related
information (such as personal data contained in documents, statements, opinions and records). Although unlikely,
the categories of personal data processed might also include special categories of personal data as referred to in
Article 10(1) of Regulation (EU) 2018/1725, as well as personal data relating to criminal convictions and offences as
referred to in Article 11 of Regulation (EU) 2018/1725.
(1) OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj.
(2) Regulation (EU) 2022/2560 of the European Parliament and of the Council of 14 December 2022 on foreign subsidies distorting the
internal market (OJ L 330, 23.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2560/oj).
ELI: http://data.europa.eu/eli/dec/2026/1447/oj 1/7EN
OJ L, 3.7.2026
(6) While carrying out its tasks under Regulation (EU) 2022/2560, the Commission is bound to respect the rights of
natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of
Fundamental Rights of the European Union and by Article 16(1) of the Treaty on the Functioning of the European
Union, as well as the requirements of Regulation (EU) 2018/1725. At the same time, the Commission, in the context
of its activities under Regulation (EU) 2022/2560, is required to comply with strict rules of confidentiality and
professional secrecy referred to in Article 43 of that Regulation.
(7) In certain circumstances, it might be necessary to reconcile the rights of data subjects pursuant to
Regulation (EU) 2018/1725 with the need to ensure that the Commission can effectively carry out its tasks of
investigation, enforcement and monitoring pursuant to Regulation (EU) 2022/2560, including in cooperation with
competent authorities of the Member States, or the fundamental rights and freedoms of other data subjects. To that
effect, Article 25(1) of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict, under
strict conditions, the application of Articles 14 to 22, 35 and 36 of Regulation (EU) 2018/1725, as well as its
Article 4, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 22 of
Regulation (EU) 2018/1725.
(8) In certain circumstances, it is necessary to reconcile the rights of data subjects with the need to safeguard the
investigation, enforcement and monitoring conducted by the Commission under Regulation (EU) 2022/2560 in the
exercise of its official authority in the public interest of the Union pursuant to Article 25(1), point (g), in conjunction
with point (c), of Regulation (EU) 2018/1725. The Commission might apply restrictions, where for instance,
exercising those rights would jeopardise an ongoing investigation, for instance where there is a risk of evidence
being destroyed or tampered with, or a risk of interference with key actors during an investigation.
(9) In certain circumstances, it is necessary to balance the rights of data subjects against the fundamental rights and
freedoms of other persons concerned, such as informants or any other natural person who has reported to the
Commission in the context of its investigation, enforcement and monitoring activities pursuant to
Regulation (EU) 2022/2560. In such cases, the Commission may need to restrict access to the identity, statements
and other personal data of such persons, in order to protect the rights and freedoms of all concerned pursuant to
Article 25(1), point (h), of Regulation (EU) 2018/1725. The Commission may decide to do so, in particular to
protect those persons against possible retaliation. Only if the reporting person so authorises, the Commission may
reveal their identity. If required by law or a judicial authority, the Commission is to reveal their identity.
(10) In cases where data subjects submit a request to access their personal data, they should be given access to such
personal data including that provided by a reporting person. To protect the reporting persons’ confidentiality and
ensure that their rights are not adversely affected, the Commission should be allowed not to provide the data subject
with the name of the reporting person, as well as any other information that would allow their direct or indirect
identification.
(11) In addition, in order to carry out its tasks to ensure the effective application of Regulation (EU) 2022/2560, in
particular in the context of cooperation between the Commission and competent authorities in the Member States,
the Commission may restrict the application of data subjects’ rights to safeguard the exercise of its official authority
in the public interest, as referred to in Article 25(1), point (g), in conjunction with point (c), of
Regulation (EU) 2018/1725. The Commission may do so in a situation where the purpose of a restriction imposed
by a Member State authority would be jeopardised were the Commission not to apply an equivalent restriction in
respect of the same personal data. In the application of such a restriction the Commission should consult the
Member State concerned on the relevant potential grounds for imposing restrictions and the necessity and
proportionality of those restrictions, unless that would jeopardise the activities of the Commission.
(12) When restricting data subjects’ rights, the Commission should make sure that such restrictions respect the essence of
fundamental rights and freedoms, are strictly necessary and are a proportionate measure in a democratic society. The
Commission should provide a justification for the applicable restrictions.
2/7 ELI: http://data.europa.eu/eli/dec/2026/1447/ojEN
OJ L, 3.7.2026
(13) Article 25(6) of Regulation (EU) 2018/1725 requires the controller to inform data subjects of the principal reasons
on which the application of the restriction is based and of their right to submit a complaint to the European Data
Protection Supervisor.
(14) Pursuant to Article 25(8) of Regulation (EU) 2018/1725, the Commission may defer, omit, or deny informing the
data subject about the principal reasons for the application of a restriction if providing that information would in
any way cancel the effect of the restriction. The Commission should assess on a case-by-case basis whether the
communication of the restriction and its reasons would cancel its effect.
(15) The Commission should lift the restriction as soon as the conditions that justify the restriction no longer apply and
assess those conditions on a regular basis.
(16) In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all
data subjects of its activities involving the processing of their personal data and of their rights, in a transparent and
coherent manner, by means of a data protection notice published on the Commission’s website. The Commission
should individually inform, by appropriate means, legal representatives and staff members of undertakings under
investigation, informants and other natural persons providing information to the Commission about the processing
of their personal data.
(17) Article 16(5) of Regulation (EU) 2018/1725 provides for exceptions to data subjects’ right to information where
personal data is not obtained from the data subjects. If those exceptions apply, the Commission does not need to
apply a restriction to the right to information under this Decision. Exceptions under Article 16(5), point (b), of
Regulation (EU) 2018/1725 are to be applicable where the provision of information referred to in Article 16(1)
to (4) of that Regulation would prove impossible, would involve a disproportionate effort or would be likely to
render impossible or seriously impair the achievement of the objectives of that processing, such as in cases of data
subjects not relevant to the investigation, whose personal information is contained in documents collected as part of
the investigation, enforcement and monitoring pursuant to Regulation (EU) 2022/2560.
(18) In accordance with the principles of transparency, fairness and accountability, the Commission should handle all
exceptions and restrictions in a transparent manner and keep a record of its application of those exceptions and
restrictions.
(19) In order to guarantee the protection of the rights and freedoms of data subjects and in accordance with Article 44(1)
of Regulation (EU) 2018/1725, the Commission should involve the Data Protection Coordinator of the Directorate-
General responsible for Competition or of the Directorate-General responsible for Internal Market, Industry,
Entrepreneurship and SMEs throughout the process of applying restrictions and document that consultation. In
particular, the responsible Data Protection Coordinator should be consulted in due time on any restrictions that may
be applied and verify their compliance with this Decision.
(20) The Data Protection Officer of the Commission should carry out an independent review of the application of
restrictions, with a view to ensuring compliance with this Decision.
(21) The European Data Protection Supervisor was consulted in accordance with Article 41(2) of
Regulation (EU) 2018/1725 and delivered an opinion on 16 April 2026,
HAS ADOPTED THIS DECISION:
Article 1
Subject-matter
1. This Decision lays down the internal rules to be followed by the Commission to inform data subjects of the
processing of their personal data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725 when carrying
out its investigation, enforcement and monitoring tasks under Regulation (EU) 2022/2560.
ELI: http://data.europa.eu/eli/dec/2026/1447/oj 3/7EN
OJ L, 3.7.2026
2. This Decision also lays down the conditions under which the Commission may restrict the application of Article 4,
Articles 14 to 20 and Article 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1), points (c), (g) and (h),
thereof.
Article 2
Scope
1. This Decision applies to the processing of personal data of the following categories of data subjects:
(a) informants;
(b) legal representatives and staff of the undertakings under investigation;
(c) natural persons whose personal data is contained in the documents or other media collected as part of investigation,
enforcement and monitoring activities in accordance with Regulation (EU) 2022/2560.
2. This Decision applies to the processing of personal data belonging to the following categories of personal data:
(a) identification data;
(b) contact details;
(c) other case-related data, including personal data referred to in Article 10(1) and Article 11 of
Regulation (EU) 2018/1725.
Article 3
Provision of information to data subjects
1. The Commission shall publish on its relevant website a data protection notice that informs all data subjects of the
Commission’s activities involving the processing of their personal data for the purpose of the investigation, enforcement
and monitoring tasks pursuant to Regulation (EU) 2022/2560.
2. The data protection notice shall provide information on the potential restrictions of data subjects’ rights as set out in
Article 4. The information shall specify which rights may be restricted, the grounds on which the restrictions may be
applied and the potential duration of the restrictions and contain information on the right of data subjects to submit a
complaint to the European Data Protection Supervisor.
3. The Commission shall individually inform, by appropriate means, legal representatives and staff members of
undertakings under investigation and informants about the processing of their personal data.
Article 4
Restrictions
1. The Commission may restrict the application of Articles 14 to 20 and Article 35 of Regulation (EU) 2018/1725, as
well as the application of the principle of transparency referred to in Article 4(1), point (a), of that Regulation insofar as
the provisions concerning the restrictions correspond to the rights and obligations provided for in Articles 14 to 20 of
Regulation (EU) 2018/1725 where:
(a) the exercise of those rights and obligations would jeopardise the purpose of the Commission’s investigative,
enforcement and monitoring tasks to ensure the effective application of Regulation (EU) 2022/2560, in accordance
with Article 25(1), point (g), in conjunction with point (c), of Regulation (EU) 2018/1725;
(b) the exercise of those rights and obligations would adversely affect the protection of the data subject or the rights and
freedoms of others in accordance with Article 25(1), point (h), of Regulation (EU) 2018/1725;
4/7 ELI: http://data.europa.eu/eli/dec/2026/1447/ojEN
OJ L, 3.7.2026
(c) the exercise of those rights and obligations would jeopardise the Commission's cooperation with the competent
authorities of the Member States when exercising its tasks to ensure the effective application of
Regulation (EU) 2022/2560, in accordance with Article 25(1), point (g), in conjunction with point (c), of
Regulation (EU) 2018/1725.
2. Before applying restrictions in the circumstances referred to in paragraph 1, point (c), the Commission shall consult
the competent authorities of the relevant Member States on potential grounds for imposing restrictions and the necessity
and proportionality of those restrictions, unless such consultation would jeopardise the activities of the Commission.
3. Any restriction shall respect the essence of fundamental rights and freedoms and be necessary and proportionate in a
democratic society.
4. Before the restrictions referred to in paragraph 1 are applied, the Commission shall carry out and document a case-
by-case assessment of their necessity and proportionality. Those restrictions shall be limited to what is strictly necessary to
achieve their objective.
Article 5
Right of access by data subject, right to rectification, right of erasure and right to restriction of processing
1. Where the Commission restricts pursuant to Article 4, wholly or partly, the right of access to data subjects, the right
to rectification, the right of erasure, or the right to restriction of processing as referred to in Articles 17 to 20, respectively,
of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, rectification,
erasure or restriction of processing of the following aspects:
(a) the restriction applied and of the principal reasons thereof;
(b) the possibility of submitting a complaint to the European Data Protection Supervisor.
2. The Commission may defer, omit or deny the provision of information concerning the reasons for a restriction and
the right to submit a complaint to the European Data Protection Supervisor for as long as it would cancel the effect of the
restriction. The Commission shall assess whether that is justified on a case-by-case basis. As soon as it no longer cancels
the effect of the restriction, the Commission shall provide the information to the data subject.
Article 6
Communication of personal data breaches to data subjects
1. Where the Commission is under an obligation to communicate a personal data breach under Article 35(1) of
Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly in
accordance with Article 4 of this Decision. The Commission shall record and register the reasons for the restriction, the
legal grounds for it under Article 4 and an assessment of its necessity and proportionality.
2. Where the reasons for the restriction no longer apply, the Commission shall communicate the personal data breach
to the data subject concerned and inform them of the principal reasons for the restriction and of their right to submit a
complaint to the European Data Protection Supervisor.
3. Where the Commission notifies the personal data breach to the European Data Protection Supervisor pursuant to
Article 34(1) of Regulation (EU) 2018/1725, the Commission shall accompany the notification with the record it made
pursuant to Article 7 of this Decision.
ELI: http://data.europa.eu/eli/dec/2026/1447/oj 5/7EN
OJ L, 3.7.2026
Article 7
Recording and registering of restrictions
1. The Commission shall record the reasons for any restriction applied pursuant to this Decision, the legal grounds laid
down in Article 4 for it, the details of the period of application of that restriction, an assessment of the risks to the rights
and freedoms of data subjects of imposing a restriction and an assessment of the necessity and proportionality of the
restriction.
2. The record shall state how the exercise of the right by the relevant data subject would undermine one or more of the
applicable objectives set out in Article 25(1), points (c), (g) and (h), of Regulation (EU) 2018/1725.
3. The record and, where applicable, the documents containing the underlying factual and legal elements shall be
registered. They shall be made available to the European Data Protection Supervisor on request.
Article 8
Duration of restrictions
1. Restrictions referred to in Articles 4 and 6 shall be applied as long as the reasons justifying them remain applicable.
2. Where the reasons for a restriction no longer apply, the Commission shall lift the restriction.
3. When a restriction is lifted, the Commission shall provide the reasons for having applied that restriction to the data
subject and inform them of the possibility of lodging a complaint with the European Data Protection Supervisor or of
seeking a judicial remedy in the Court of Justice of the European Union.
4. The Commission shall review the application of the restrictions referred to in Articles 4 and 6 every six months. The
review shall include an assessment of the necessity and proportionality of the restriction.
Article 9
Safeguards and storage periods
1. The Commission shall implement safeguards to prevent abuse and unlawful access to or transfer of personal data in
respect of which restrictions or exceptions apply or could be applied. Such safeguards shall include the following technical
and organisational measures:
(a) a clear definition of roles, responsibilities, procedural steps and access rights;
(b) a secure electronic environment which prevents unlawful or accidental access to or transfer of electronic data to
unauthorised persons;
(c) a secure storage and processing of paper documents limited to what is strictly necessary to achieve the purpose of
processing;
(d) due monitoring of restrictions.
2. The personal data shall be stored in accordance with the applicable Commission storage rules to be defined in the
records of processing kept under Article 31 of Regulation (EU) 2018/1725. At the end of the storage period, the personal
data shall be deleted, anonymised or transferred to the archives in accordance with Article 13 of
Regulation (EU) 2018/1725.
6/7 ELI: http://data.europa.eu/eli/dec/2026/1447/ojEN
OJ L, 3.7.2026
Article 10
Involvement of the Data Protection Coordinators and the Data Protection Officer of the Commission
1. The Data Protection Coordinator of the Directorate-General responsible for Competition shall be consulted before
any restrictions are applied with regard to notified concentrations and ex officio investigations and shall verify their
compliance with this Decision.
2. The Data Protection Coordinator of the Directorate-General responsible for Internal Market, Industry,
Entrepreneurship and SMEs shall be consulted before any restrictions are applied with regard to notified public
procurement procedures and public procurement related ex officio investigations and shall verify their compliance with
this Decision.
3. The Data Protection Officer of the Commission shall be informed, without unnecessary delay, whenever data subjects’
rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer of the Commission shall be
given access to the record and any documents containing the underlying factual and legal elements.
4. The Data Protection Officer of the Commission may request a review of the application of a restriction and shall be
informed in writing of the outcome of such review.
5. The Commission shall document the involvement of the Data Protection Officer and the respective Data Protection
Coordinator, including what information is shared with them, in each case where the restrictions referred to in Article 4(1)
are applied.
Article 11
Entry into force
This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European
Union.
Done at Brussels, 30 June 2026.
For the Commission
The President
Ursula VON DER LEYEN
ELI: http://data.europa.eu/eli/dec/2026/1447/oj 7/7