EU regulatory register · DORA
Article 56Data Protection
CELEX 32022R2554 · Read on 2026-08-18
Short answer
1. The ESAs and the competent authorities shall be allowed to process personal data only where necessary for the purpose of carrying out their respective obligations and duties pursuant to this Regulation, in particular for investigation, inspection, request for information, communication, publication, evaluation, verification, assessment and drafting of …
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-56 · Short answer as data · Official text
DORA, digital operational resilience in short
Financial entities must manage ICT risk, report major ICT incidents, test resilience and govern ICT providers by contract.
- Who is covered by DORA?
- What does Article 30 require in ICT contracts?
- How fast must an ICT incident be reported?
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. The ESAs and the competent authorities shall be allowed to process personal data only where necessary for the purpose of carrying out their respective obligations and duties pursuant to this Regulation, in particular for investigation, inspection, request for information, communication, publication, evaluation, verification, assessment and drafting of oversight plans. The personal data shall be processed in accordance with Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, whichever is applicable.
2. Except where otherwise provided in other sectoral acts, the personal data referred to in paragraph 1 shall be retained until the discharge of the applicable supervisory duties and in any case for a maximum period of 15 years, except in the event of pending court proceedings requiring further retention of such data.
Follow-up questions
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit