My bookmarksSign up free

Source

Commission Delegated Regulation (EU) 2018/573 of 15 December 2017 on key elements of data storage contracts to be concluded as part of a traceability system for tobacco products (Text with EEA relevance. )

Commission Delegated Regulation (EU) 2018/573 of 15 December 2017 on key elements of data storage contracts to be concluded as part of a traceability system for tobacco products (Text with EEA relevance. )

Delegated Regulation (EU) 2018/573 · Regulation · 21 articles

Data as of 2026-07-04 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗

Subject matter

Article 1

This Regulation sets out key elements to be included in the data storage contracts referred to in Article 15(8) of Directive 2014/40/EU.

Definitions

Article 2

For the purpose of this Regulation, in addition to the definitions laid down in Directive 2014/40/EU and Implementing Regulation (EU) 2018/574, the following definitions shall apply: (1) ‘contract’ means a contractual agreement between a manufacturer or importer of tobacco products and a provider of data storage systems in accordance with Article 15(8) of Directive 2014/40/EU and Implementing Regulation (EU) 2018/574; (2) ‘provider’ means any legal person contracted by a manufacturer or importer of tobacco products for the purpose of establishing and operating its primary repository and the related services; (3) ‘data portability’ means the ability to move data among different repositories, by the use of technology that is readily available on the market and commonly used in the sector.

Key responsibilities under the contract

Article 3

1. The contract shall specify the key services to be rendered by the provider, which shall include: (1) the establishment and operation of a primary repository in accordance with Article 26 of Implementing Regulation (EU) 2018/574; (2) in the case the operator of the primary repository is appointed as provider of the secondary repository, the establishment and operation of the secondary repository and the router, in accordance with Articles 27, 28 and 29 of Implementing Regulation (EU) 2018/574; (3) the provision, upon request, of other ancillary technical services connected with the operation of the primary repository that contribute to the proper functioning of the repositories system. 2. In defining the key services referred to in points (1) and (2) of paragraph 1, the contract shall contain specifications relating to the operability, availability and performance of the services meeting the minimum requirements specified in this Regulation and laid down in Chapter V of Implementing Regulation (EU) 2018/574.

Technical expertise

Article 4

The contract shall require providers to issue to the manufacturer or importer a written declaration that they hold, or have at their disposal, the technical and operational expertise necessary to carry out the services referred to in Article 3 and to comply with the requirements laid down in Chapter V of Implementing Regulation (EU) 2018/574.

Availability of the primary repository

Article 5

1. The contract shall specify a guaranteed monthly uptime and availability of 99,5 % for the primary repository. 2. The contract shall require that appropriate back-up mechanisms are put in place by the provider to prevent any loss of data that is stored, received or transferred at the time the primary repository becomes unavailable.

Access rights

Article 6

The contract shall specify the requirements for physical and virtual access to be granted, at server and database level, to national administrators of Member States, the Commission, and appointed external auditors to the primary repository, in accordance with Article 25 of Implementing Regulation (EU) 2018/574.

Sub-contracting

Article 7

1. Where the contract specifies that the provider may subcontract certain obligations under the contract, it shall contain a provision clarifying that the subcontract does not affect the primary responsibility of the provider for the performance of the contract. 2. The contract shall further require the provider: (a) to ensure that the proposed subcontractor has the necessary technical expertise and meets the requirements of independence laid down in Article 35 of Implementing Regulation (EU) 2018/574. (b) to submit to the Commission a copy of the declaration referred to in Article 8 of this Regulation signed by the respective sub-contractor(s).

Legal and financial independence

Article 8

The contract shall require providers and, where applicable, their sub-contractors, to issue to the manufacturer or importer, together with the data storage contract, a written declaration that they comply with the requirements for legal and financial independence as laid down in Article 35 of Implementing Regulation (EU) 2018/574.

Data protection and confidentiality

Article 9

1. The contract shall specify that the provider shall put in place all appropriate measures necessary to ensure the confidentiality, integrity and availability of all data stored in the performance of the contract. Such measures shall include administrative, technical and physical safety and security controls. 2. The contract shall require that personal data handled under the contract are processed in accordance with Directive 95/46/EC of the European Parliament and of the Council ( 3 ) .

Information security management

Article 10

The contract shall require providers to declare that the primary repository and, where applicable, the second repository, is managed in accordance with internationally recognised information security management standards. Providers certified to ISO/IEC 27001:2013 shall be presumed to meet those standards.

Costs

Article 11

The contract shall require the costs charged by providers to manufacturers or importers in accordance with Article 30 of Implementing Regulation (EU) 2018/574 to be fair, reasonable, and proportionate to: (a) the services rendered; and (b) the number of unique identifiers requested over a given period of time by the manufacturer or importer concerned.

Participation in secondary repository system

Article 12

1. The contract shall require the provider to participate in the establishment of the secondary repository system (where the secondary system has not yet been established at the date of the conclusion of the contract) as may be required in accordance with the rules provided for in Chapter V of Implementing Regulation (EU) 2018/574. 2. The contract shall contain a provision that allows for providers to recover from manufacturers and importers of tobacco products the costs arising in connection with the establishment, operation and maintenance of the secondary repository and the router referred to in Chapter V of Implementing Regulation (EU) 2018/574.

Duration

Article 13

The duration of the contract shall be fixed for a minimum of five years with a possibility of renewal subject to agreement of the Parties and the continuing compliance of the provider with the requirements of Directive 2014/40/EU and Implementing Regulation (EU) 2018/574.

Communication with other parties

Article 14

The contract shall require providers to cooperate with one another, as well as with the competent authorities of Member States, to the extent necessary to ensure the effective organisation of the day-to-day functioning of the repositories system.

Audits

Article 15

1. The contract shall lay down terms enabling external auditors approved by the Commission, in accordance with Article 15(8) of Directive 2014/40/EU, to carry out announced and unannounced audits in relation to the primary repository, and, where applicable, the secondary repository, including an assessment of whether the provider and, if applicable, its sub-contractors comply with the relevant legislative requirements. 2. The contract shall specify that external auditors are granted unrestricted physical and virtual access to the primary repository and, where applicable, the secondary repository, and its related services for the duration of the audit.

Liability

Article 16

The contract shall lay down terms detailing the liability of the parties including with respect to direct and indirect damages that may arise under the contract, in accordance with the applicable law. Without prejudice to the applicable law, the contract shall further specify that no limitation of liability exists in case of breach of confidentiality or breach of data protection rules.

Termination of contract

Article 17

1. The contract shall lay down terms regarding the termination of the contract, in accordance with the applicable law. In the case of termination, the contract shall require the terminating Party to notify the Commission, in accordance with the procedural requirements laid down in Annex I to Implementing Regulation (EU) 2018/574. 2. The contract shall require parties to provide a minimum notice period of five months for the termination of the contract. By derogation to the first subparagraph, the contract shall require manufacturers and importers to terminate the contract immediately: (a) in the event of a serious breach by the provider of its obligations under the contract, (b) where the provider becomes, or is in imminent risk of becoming, insolvent under the applicable law. 3. For the purposes of paragraph 2(a) a serious breach shall include: (a) the failure by the provider to carry out obligations or to perform services provided for under the contract that are critical to the effective functioning of the traceability system, including in particular, the failure to comply with requirements laid down in Chapter V of Implementing Regulation (EU) 2018/574, (b) where a provider ceases to comply with the requirements for legal and financial independence laid down in Article 35(2) of Implementing Regulation (EU) 2018/574 and where, by the expiry of the time-period referred to in Article 35(6) of Implementing Regulation (EU) 2018/574, compliance with the requirements could not be established.

Suspension of services

Article 18

The contract shall specify that suspension of services in case of late payments by a manufacturer or importer to the provider shall be prohibited, unless the delay exceeds the final payment deadline by thirty days or more.

Data portability

Article 19

1. The contract shall require providers to ensure full data portability in cases where a manufacturer or importer contracts a new provider to operate its primary repository. The current provider shall deliver to the new provider, prior to the date of termination of the contract, an up-to-date copy of all data stored in the primary repository. Any updates to the data after that delivery shall be migrated to the new provider without undue delay. 2. In order to ensure business continuity, the contract shall include an applicable exit plan laying down the procedure to be followed in case of the termination of the contract and a new provider is contracted by the manufacturer or importer. The plan shall include a requirement for the current provider to continue providing its services until the new provider becomes operational. 3. The contract shall contain provisions ensuring that the current provider has no right of retention with respect to any data, information or other necessary material related to the primary repository after they have been delivered to the new provider.

Applicable law and jurisdiction

Article 20

1. The contract shall be governed by the laws of one of the Member States of the European Union, as agreed by the parties to the contract. 2. The contract shall be subject to the jurisdiction of one of the Member States of the European Union, as agreed by the parties to the contract.

Entry into force

Article 21

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .

Other acts of the same type

Commission Implementing Regulation (EU) 2022/2105 of 29 July 2022 laying down rules on conformity checks of marketing standards for olive oil and methods of analysis of the characteristics of olive oil Commission Regulation (EU) 2022/1324 of 28 July 2022 amending Annexes II and III to Regulation (EC) No 396/2005 of the European Parliament and of the Council as regards maximum residue levels for benzovindiflupyr, boscalid, fenazaquin, fluazifop-P, flupyradifurone, fluxapyroxad, fosetyl-Al, isofetamid, metaflumizone, pyraclostrobin, spirotetramat, thiabendazole and tolclofos-methyl in or on certain products (Text with EEA relevance)Council Regulation (EU) 2022/1329 of 28 July 2022 amending Regulation (EU) No 377/2012 concerning restrictive measures directed against certain persons, entities and bodies threatening the peace, security or stability of the Republic of Guinea-Bissau Council Implementing Regulation (EU) 2022/1330 of 28 July 2022 implementing Article 11(1) of Regulation (EU) No 377/2012 concerning restrictive measures directed against certain persons, entities and bodies threatening the peace, security or stability of the Republic of Guinea-Bissau Council Implementing Regulation (EU) 2022/1331 of 28 July 2022 implementing Regulation (EU) 2017/1509 concerning restrictive measures against the Democratic People’s Republic of Korea Commission Implementing Regulation (EU) 2022/1360 of 28 July 2022 amending Regulation (EU) No 1321/2014 as regards the implementation of more proportionate requirements for aircraft used for sport and recreational aviation Commission Implementing Regulation (EU) 2022/1361 of 28 July 2022 amending Regulation (EU) No 748/2012 as regards the certification, oversight and enforcement tasks of the competent authorities in the implementation of the rules concerning the organisations involved in the design and production of aircraft used for sport and recreational aviation Commission Implementing Regulation (EU) 2022/1317 of 27 July 2022 providing for derogations from Regulation (EU) 2021/2115 of the European Parliament and of the Council as regards the application of the standards for good agricultural and environmental conditions of land (GAEC standards) 7 and 8 for claim year 2023 Commission Implementing Regulation (EU) 2022/1323 of 27 July 2022 amending Regulation (EC) No 1484/95 as regards fixing representative prices in the poultrymeat and egg sectors and for egg albumin Commission Implementing Regulation (EU) 2022/1359 of 27 July 2022 amending Council Regulation (EC) No 2368/2002 implementing the Kimberley Process certification scheme for the international trade in rough diamonds Commission Implementing Regulation (EU) 2022/938 of 26 July 2022 amending Implementing Regulation (EU) 2017/373 as regards the requirements for aeronautical data catalogue and aeronautical information publication Council Implementing Regulation (EU) 2022/1308 of 26 July 2022 implementing Regulation (EU) 2016/44 concerning restrictive measures in view of the situation in Libya

Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.

What to look at next

Browse all EU Legal ActsEvery instrument by type and year, full text free to read section by sectionEuropean Union legislation EU Legal Acts by type and yearGrouped by instrument type and year of enactment, so you can find others of the same kindBrowse by type and year European Union: what this database coversWhich datasets are here, which official source they come from, and how current they areEuropean Union overview