DORA Article 56 — held text

This page is a held version, frozen at the capture below. It is a source for review. It is not advice, and it does not determine whether this provision applies to you.

Article 56 Data Protection 1. The ESAs and the competent authorities shall be allowed to process personal data only where necessary for the purpose of carrying out their respective obligations and duties pursuant to this Regulation, in particular for investigation, inspection, request for information, communication, publication, evaluation, verification, assessment and drafting of oversight plans. The personal data shall be processed in accordance with Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, whichever is applicable. 2. Except where otherwise provided in other sectoral acts, the personal data referred to in paragraph 1 shall be retained until the discharge of the applicable supervisory duties and in any case for a maximum period of 15 years, except in the event of pending court proceedings requiring further retention of such data. CHAPTER VIII Delegated acts

CELEX: 32022R2554 · provision: 56
Locator: Article 56; PDF page 73; derived-text line 1793
Held artifact: docs_evidence/eu-legislation/eurlex-full-text/20260823T093000Z/32022R2554.pdf
Artifact SHA-256: 85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c
Captured: 20260823T093000Z
Extracted with: pdftotext version 4.00
Official source: EUR-Lex
This version: /celex/32022R2554/ART_56/20260823-85307f9e/
Corpus Merkle root: 581628a5b36518981241d2b51f048aa46384f30a74bf648ef542c652028cdeff
Membership proof: 10 hashes — see corpus-proof.json
Modal verbs, counted verbatim (not a legal characterisation): 'shall not': 0 · 'shall': 3 · 'must': 0 · 'may not': 0 · 'may': 0 · 'should': 0

To verify independently: fetch the official source above, extract it with the named tool, and confirm the artifact SHA-256 matches. Then check this provision's leaf against the published Merkle root using the proof in corpus-proof.json.