Key data
| Regulation | Decision (EU) 2026/1447 of the Commission, of 30 June 2026 |
|---|---|
| Publication | 3 July 2026 |
| Entry into force | 30 June 2026 |
| Affected parties | Companies investigated for receiving subsidies from third countries and natural persons linked to those proceedings |
| Category | Data Protection |
| Base Regulation | Regulation (EU) 2022/2560 on foreign subsidies distorting the internal market |
| Year | 2026 |
Companies operating in the European internal market with financing from third countries face a new regulatory scenario. Decision (EU) 2026/1447, adopted by the European Commission on 30 June 2026, establishes the internal rules governing the processing of personal data during investigations, enforcement and supervision provided for in Regulation (EU) 2022/2560 on foreign subsidies distorting the internal market.
In practice, this means that the Commission can restrict fundamental data protection rights of natural persons linked to an active file, provided that such restriction is necessary to protect the effectiveness of the investigation.
What does this regulation establish?
The Decision regulates three major areas within the framework of the Foreign Subsidies Regulation:
| Area | Content |
|---|---|
| Restriction of data subjects' rights | The Commission may limit the rights of access, rectification and deletion of personal data during active investigations to avoid compromising their effectiveness. |
| Information obligations | The conditions and manner in which the Commission must inform those affected about the processing of their data and the restrictions applied are defined. |
| Safeguards when applying limitations | Restrictions are temporary: they must be lifted as soon as the risk that justifies them disappears. Safeguards are established that must be respected at all times. |
The basis for this Decision is Regulation (EU) 2022/2560, which grants the Commission investigative powers over companies that have received subsidies from third country governments when such aid may distort competition in the European internal market. Decision 2026/1447 does not expand those investigative powers, but rather regulates how personal data is managed within those proceedings.
Economic and operational impact
The direct impact of this Decision is not economic in terms of fees or sanctions, but rather operational and compliance-related. Affected companies must incorporate this regulatory layer into their data protection protocols:
- Temporary restriction of GDPR rights: During an active investigation, compliance officers will not be able to normally exercise rights of access, rectification or deletion of data before the Commission. This affects the timelines and internal procedures for responding to data subject requests.
- Additional compliance layer: Companies under investigation must document and manage the fact that certain rights are temporarily suspended, which involves updating records of processing activities and internal privacy policies.
- Multidisciplinary legal coordination: Legal teams must simultaneously coordinate the defense in the foreign subsidies proceeding and the management of data protection rights of natural persons linked to the file (executives, legal representatives, key employees).
- Reputational risk: Being under investigation under Regulation (EU) 2022/2560 already implies significant public exposure. Improper management of personal data in this context can add an additional front of regulatory risk.
Who does it affect?
- Companies investigated for having received subsidies from third country governments (outside the EU) that may distort the European internal market.
- Natural persons linked to those files: executives, administrators, legal representatives, key employees or any person whose personal data is processed in the context of the investigation.
- Compliance and data protection departments of business groups with financing or shareholding from third countries.
- Legal advisors and DPOs (Data Protection Officers) managing proceedings before the European Commission under Regulation (EU) 2022/2560.
- Companies participating in concentrations or public procurement in the EU that have received foreign subsidies and are subject to mandatory notification.
Practical example
Imagine a Spanish infrastructure company that has received financing from a sovereign fund from a non-EU country to participate in a European public procurement tender. The Commission opens a formal investigation under Regulation (EU) 2022/2560.
During that investigation, the company's chief financial officer—whose personal information is part of the file—requests access from the Commission to the data in its possession and to rectify certain information. With Decision (EU) 2026/1447 in force, the Commission can temporarily deny that request if it considers that granting it would compromise the effectiveness of the ongoing investigation.
The company and its legal advisor must know that this restriction is not indefinite: as soon as the risk that justifies it disappears—for example, when the evidence-gathering phase concludes—the data subject's rights must be restored. The company's DPO must document this situation in the record of processing activities and update the internal privacy policy to reflect this scenario.
What should companies do now?
- Identify exposure to Regulation (EU) 2022/2560: Review whether the company has received subsidies from third countries that exceed notification thresholds or that may be considered distortive of the internal market.
- Update the record of processing activities: Incorporate the foreign subsidy investigation scenario as a specific case in which data subjects' rights may be temporarily restricted.
- Inform the DPO and legal team: Ensure that the Data Protection Officer is aware of Decision (EU) 2026/1447 and can coordinate the response to GDPR rights requests during an active investigation.
- Review internal privacy policies: Include a clause that contemplates the possibility of temporary restriction of rights in the context of European Commission investigations.
- Prepare response protocols: Define internally how to act if an executive or key employee requests the exercise of GDPR rights while the company is under investigation, including timelines for reviewing the restriction.
- Consult with specialized advisors: If the company is already under investigation or anticipates being so, involve lawyers with experience in European competition law and data protection in a coordinated manner.
Frequently asked questions
What data protection rights can the Commission restrict during a foreign subsidy investigation?
According to Decision (EU) 2026/1447, the Commission can limit the rights of access, rectification and deletion of personal data of data subjects linked to an active file. These restrictions are temporary and only apply when necessary to protect the effectiveness of the investigation. They must be lifted as soon as the risk that justifies them disappears.
When does Decision (EU) 2026/1447 on personal data in foreign subsidy investigations enter into force?
The Decision entered into force on 30 June 2026, the date of its adoption by the European Commission. It was published in the EU Official Journal on 3 July 2026.
Which companies does Regulation (EU) 2022/2560 on foreign subsidies affect?
It affects companies operating in the European internal market that have received subsidies from third country governments (outside the EU) that may distort competition. This includes companies participating in major concentrations or public procurement in the EU that exceed the notification thresholds established in the Regulation.
What should the DPO of a company investigated under the Foreign Subsidies Regulation do?
The DPO should: update the record of processing activities to reflect the investigation scenario, coordinate with the legal team the management of GDPR rights requests during the proceeding, and document the restrictions applied and their lifting once the risk disappears. Decision (EU) 2026/1447 establishes that specific safeguards must be respected when applying such limitations.
Are restrictions on GDPR rights during a foreign subsidy investigation permanent?
No. Decision (EU) 2026/1447 expressly establishes that restrictions are temporary. They must be lifted as soon as the risk that justifies them disappears, for example, when the evidence-gathering phase concludes or when the investigation is closed.
Official source
Consult the complete regulation in the official source
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601447