Article 37Request for information
1. The Lead Overseer may, by simple request or by decision, require critical ICT third-party service providers to provide all information that is necessary for the Lead Overseer to carry out its duties under this Regulation, including all relevant business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incident reports, as well as any information relating to parties to whom the critical ICT third-party service provider has outsourced operational functions or activities.
2. When sending a simple request for information under paragraph 1, the Lead Overseer shall:
(a) refer to this Article as the legal basis of the request;
(b) state the purpose of the request;
(c) specify what information is required;
(d) set a time limit within which the information is to be provided;
(e) inform the representative of the critical ICT third-party service provider from whom the information is requested that he or she is not obliged to provide the information, but in the event of a voluntary reply to the request the information provided must not be incorrect or misleading.
3. When requiring by decision to supply information under paragraph 1, the Lead Overseer shall:
(a) refer to this Article as the legal basis of the request;
(b) state the purpose of the request;
(c) specify what information is required;
(d) set a time limit within which the information is to be provided;
(e) indicate the periodic penalty payments provided for in Article 35(6) where the production of the required information is incomplete or when such information is not provided within the time limit referred to in point (d) of this paragraph;
(f) indicate the right to appeal the decision to ESA’s Board of Appeal and to have the decision reviewed by the Court of Justice of the European Union (Court of Justice) in accordance with Articles 60 and 61 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.
4. The representatives of the critical ICT third-party service providers shall supply the information requested. Lawyers duly authorised to act may supply the information on behalf of their clients. The critical ICT third-party service provider shall remain fully responsible if the information supplied is incomplete, incorrect or misleading.
5. The Lead Overseer shall, without delay, transmit a copy of the decision to supply information to the competent authorities of the financial entities using the services of the relevant critical ICT third-party service providers and to the JON.
DORA, the European Union regulation on digital operational resilience, Article 37
Requests for information addressed to critical providers, by simple request or by decision. The Lead Overseer may require all information necessary for its duties, including business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incident reports, and information about parties to whom the provider has outsourced operational functions or activities.
A simple request must cite this article as its legal basis, state the purpose, specify the information, set a time limit, and tell the recipient there is no obligation to answer but that a voluntary reply must not be incorrect or misleading. A request by decision must also indicate the periodic penalty payments under Article 35(6) for incomplete or late information, and the right to appeal to the ESAs’ Board of Appeal and to have the decision reviewed by the Court of Justice. The provider remains fully responsible if what it supplies is incomplete, incorrect or misleading. A copy of any decision goes to the competent authorities of the entities using the provider and to the Joint Oversight Network.
The article gives these rights to the Lead Overseer. It gives a financial entity no right to the same documents. An entity’s own contractual rights of access, inspection and audit over its provider come from Article 30(3), point (e)(i), for services supporting critical or important functions.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.