Recital 43

In accordance with Regulation (EU) 2016/679, the processor that stores or otherwise processes the data on behalf of the controller should inform the controller about the production of the data unless the issuing authority has requested the service provider to refrain from informing the controller, for as long as necessary and proportionate, in order not to obstruct the relevant criminal proceedings. In that case, the issuing authority should indicate in the case file the reasons for the delay in informing the controller and a short justification should also be added in the accompanying certificate transmitted to the addressee.