Article 56Data Protection
1. The ESAs and the competent authorities shall be allowed to process personal data only where necessary for the purpose of carrying out their respective obligations and duties pursuant to this Regulation, in particular for investigation, inspection, request for information, communication, publication, evaluation, verification, assessment and drafting of oversight plans. The personal data shall be processed in accordance with Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, whichever is applicable.
2. Except where otherwise provided in other sectoral acts, the personal data referred to in paragraph 1 shall be retained until the discharge of the applicable supervisory duties and in any case for a maximum period of 15 years, except in the event of pending court proceedings requiring further retention of such data.
DORA, the European Union regulation on digital operational resilience, Article 56
Data protection. The ESAs and competent authorities may process personal data only where necessary to carry out their duties under the Regulation, in particular for investigation, inspection, requests for information, communication, publication, evaluation, verification, assessment and drafting oversight plans. They must do so in line with the GDPR or Regulation (EU) 2018/1725, whichever applies.
Unless another sectoral act provides otherwise, that personal data is kept until the supervisory duties it serves have been discharged and in any case for a maximum of 15 years. Pending court proceedings that require continued retention are an exception.
The rule applies to personal data held by the ESAs and competent authorities, not to an entity’s own records. The 15 years is a ceiling, not a standard retention period.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.