Article 28Database of domain name registration data
1. For the purpose of contributing to the security, stability and resilience of the DNS, Member States shall require TLD name registries and entities providing domain name registration services to collect and maintain accurate and complete domain name registration data in a dedicated database with due diligence in accordance with Union data protection law as regards data which are personal data.
2. For the purposes of paragraph 1, Member States shall require the database of domain name registration data to contain the necessary information to identify and contact the holders of the domain names and the points of contact administering the domain names under the TLDs. Such information shall include:
(a) the domain name;
(b) the date of registration;
(c) the registrant’s name, contact email address and telephone number;
(d) the contact email address and telephone number of the point of contact administering the domain name in the event that they are different from those of the registrant.
3. Member States shall require the TLD name registries and the entities providing domain name registration services to have policies and procedures, including verification procedures, in place to ensure that the databases referred to in paragraph 1 include accurate and complete information. Member States shall require such policies and procedures to be made publicly available.
4. Member States shall require the TLD name registries and the entities providing domain name registration services to make publicly available, without undue delay after the registration of a domain name, the domain name registration data which are not personal data.
5. Member States shall require the TLD name registries and the entities providing domain name registration services to provide access to specific domain name registration data upon lawful and duly substantiated requests by legitimate access seekers, in accordance with Union data protection law. Member States shall require the TLD name registries and the entities providing domain name registration services to reply without undue delay and in any event within 72 hours of receipt of any requests for access. Member States shall require policies and procedures with regard to the disclosure of such data to be made publicly available.
6. Compliance with the obligations laid down in paragraphs 1 to 5 shall not result in a duplication of collecting domain name registration data. To that end, Member States shall require TLD name registries and entities providing domain name registration services to cooperate with each other.
NIS2, the European Union directive on network and information security, Article 28
Member States must require TLD name registries and entities providing domain name registration services to collect and maintain accurate and complete domain name registration data in a dedicated database, with due diligence and, for personal data, in accordance with Union data protection law. The aim is the security, stability and resilience of the DNS.
The database must hold what is needed to identify and contact domain holders and the points of contact administering the domains, including the domain name, registration date, the registrant’s name, email address and telephone number, and the point of contact’s email address and telephone number where these differ from the registrant’s.
Member States must also require these entities to: have policies and procedures, including verification procedures, to keep the data accurate and complete, and publish them; make the registration data that are not personal data publicly available without undue delay after registration; and reply to lawful, duly substantiated requests for access from legitimate access seekers without undue delay and in any event within 72 hours of receipt, publishing their disclosure policies and procedures.
The article works within data protection law, not around it. Compliance must not lead to collecting the same data twice, so Member States must require registries and registration service providers to cooperate with each other.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.