Source: OJ L 265, 12.10.2022, pp. 1–66Consolidated text

Current language: EN

Article 21 Requests for information


Summary What does Article 21 of the DMA regulation say?

This article establishes the Commission's power to gather information from undertakings and associations of undertakings as part of carrying out its duties under the regulation.

It sets out two distinct mechanisms for doing so — a simple request or a formal decision — and covers not just documentary information but also access to data, algorithms, and testing information.

The article also addresses who bears responsibility for the accuracy of information supplied, and extends information-gathering obligations to Member State competent authorities.

Important points:

  • Undertakings and associations of undertakings must supply information requested by the Commission, whether by simple request or formal decision, within a fixed time limit, and remain fully responsible for ensuring that information is not incomplete, incorrect, or misleading.
  • The Commission's formal decision route carries stronger consequences, linking non-compliance to fines under Article 30 and periodic penalty payments under Article 31, and grants undertakings the right to have the decision reviewed by the Court of Justice.
  • Competent authorities of the Member States are required to provide the Commission with all necessary information in their possession upon request.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

    1. In order to carry out its duties under this Regulation, the Commission may, by simple request or by decision, require from undertakings and associations of undertakings to provide all necessary information. The Commission may also, by simple request or by decision, require access to any data and algorithms of undertakings and information about testing, as well as requesting explanations of them.

    1. When sending a simple request for information to an undertaking or association of undertakings, the Commission shall state the legal basis and purpose of the request, specify what information is required and fix the time limit within which the information is to be provided, as well as the fines provided for in Article 30 applicable for supplying incomplete, incorrect or misleading information or explanations.

    1. Where the Commission requires undertakings and associations of undertakings to supply information by decision, it shall state the legal basis and purpose of the request, specify what information is required and fix the time limit within which the information is to be provided. Where the Commission requires undertakings to provide access to any data, algorithms and information about testing, it shall state the purpose of the request and fix the time -limit within which it is to be provided. It shall also indicate the fines provided for in Article 30 and indicate or impose the periodic penalty payments provided for in Article 31. It shall further indicate the right to have the decision reviewed by the Court of Justice.

    1. The undertakings or associations of undertakings or their representatives shall supply the information requested on behalf of the undertaking or the association of undertakings concerned. Lawyers duly authorised to act may supply the information on behalf of their clients. The latter shall remain fully responsible if the information supplied is incomplete, incorrect or misleading.

    1. At the request of the Commission, the competent authorities of the Member States shall provide the Commission with all necessary information in their possession to carry out the duties assigned to it by this Regulation.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod