Article 10a

The following processing serves objectives of general interest recognised by the Union and may be privileged in accordance with this Article ('privileged processing'):

1. (a)

   processing necessary for internal administrative purposes within a group of undertakings, including the processing of personal data of clients and employees;

2. (b)

   processing by a micro, small or medium-sized enterprise within the meaning of the Annex to Recommendation 2003/361/EC, necessary for its ordinary commercial activities;

3. (c)

   processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), whether or not it constitutes further processing within the meaning of point (b) of Article 5(1).

Processing referred to in paragraph 1 shall be privileged where the controller or processor:

1. (a)

   has committed, by entry in the register referred to in [the Data Act/ Data Governance Act], to making data available for objectives of general interest; and (b) carries out the processing in demonstrable conformity with an approved code of conduct pursuant to Article 40, an approved certification mechanism pursuant to Article 42, binding corporate rules approved pursuant to Article 47, or a standard included in the list established by the Board pursuant to Article 70 point (o).

Privileged processing pursues legitimate interests within the meaning of point (f) of Article 6(1). Where it concerns special categories of personal data and is necessary for the objectives referred to in paragraph 1, this Article constitutes a substantial public interest of Article 9(2)(g), (j). Privileged processing shall be presumed to comply with the requirements of this Regulation to which the safeguards give effect, including point (f) of Article 6(1), points (g) (j) of Article 9(2) and, where the controller or processor has assessed and documented that the law and practice of the third country do not impair the effectiveness of the safeguards, Article 46(1). The presumption shall be rebutted by specific and substantiated indications of non-compliance; in that event, the controller or processor shall demonstrate compliance in accordance with Article 5(2).

The obligations under Articles 13 and 14 may be fulfilled by providing the standardised information laid down in the instrument referred to in point (b) of paragraph 2.

Data made available under the commitment shall not be provided to undertakings referred to in point (b) of paragraph

The commitment may be withdrawn with effect for the future; upon withdrawal, the processing ceases to be privileged. The Commission shall adopt delegated acts in accordance with Article 92 specifying the categories of data to be made available, the conditions and modalities of making them available, and the safeguards for the protection of personal data and trade secrets.

This Article shall not apply to:

1. (a)

   processing likely to result in a high risk within the meaning of Article 35, unless a data protection impact assessment has been carried out and its results have been implemented;

2. (b)

   processing by an undertaking designated pursuant to Article 3 of Regulation (EU) 2022/1925 or Article 33(4) of Regulation (EU) 2022/2065, or by an undertaking belonging to the same group of undertakings.