Data Act: B2G Data Sharing under Exceptional Need

Short answer: The Data Act gives public authorities the power to compel businesses to share data, but only under exceptional need. That need exists in exactly two situations: a formally declared public emergency (Article 15(1)(a)), or a non-urgent statutory public interest task for which the authority has exhausted all other means of obtaining the data (Article 15(1)(b)). No obligation exists outside these two grounds.

What counts as exceptional need?

The Data Act (Regulation (EU) 2023/2854), applicable since 12 September 2025, establishes in Chapter V when public sector bodies, the European Commission, the ECB or Union bodies may request data from private holders. Article 15(1) defines when exceptional need exists.

Ground (a) — public emergency. A "public emergency" is defined in Article 2(29) as an exceptional, time-limited situation — such as a public health emergency, a natural disaster, or a man-made disaster such as a cyberattack — with serious negative consequences for the population, living conditions or economic stability, and declared as such under Union or national law procedures. Where this threshold is met and the authority cannot obtain the data through other means in time, personal data may also be requested. Data are provided free of charge by data holders that are not micro or small enterprises; SMEs may claim reasonable compensation (Article 20).

Ground (b) — statutory public interest task with no alternative data source. In non-emergency situations the bar is higher and only non-personal data may be requested. The requesting body must demonstrate that it is carrying out a specific task explicitly provided for by law — such as the production of official statistics or recovery from an emergency — and that it has exhausted all other means, including purchasing data on the market. Ground (b) does not apply to micro and small enterprises (Article 15(2)).

How does a request work?

A request must be made in writing and must specify: the precise data sought, the exceptional need justification, the intended purpose and duration, an erasure plan, and relevant data protection measures (Article 17). Once received, the data holder has five working days (public emergency) or thirty working days (other exceptional need) to reject or modify the request; otherwise the obligation to comply stands (Article 18). Data obtained under these provisions may not be reused under open data legislation and are strictly limited to the stated purpose.

Personal data

Only ground (a) — public emergency — permits requesting personal data. The data holder must anonymise the data unless anonymisation is insufficient; in that case pseudonymisation applies (Article 18(4)). Under ground (b), personal data are entirely excluded.

Compensation

In a public emergency, large and medium-sized data holders provide data free of charge; micro and small enterprises may request reasonable compensation. Under the non-emergency ground, all data holders receive fair compensation covering technical and organisational costs plus a reasonable margin (Article 20).