Article 28
Data protection
With regard to the processing of personal data within the framework of this Regulation, competent authorities shall carry out their tasks for the purposes of this Regulation in accordance with the national laws, regulations or administrative provisions transposing Directive 95/46/EC. With regard to the processing of personal data by ESMA within the framework of this Regulation, ESMA shall comply with the provisions of Regulation (EC) No 45/2001.
Personal data shall be retained for a maximum period of five years.