Recital 3

(3)The notification should contain data about the proposed acquirer, including the members of its management body, the indirect shareholders and the ultimate beneficial owner, and of the members of the management body of the target entity where the proposed acquirer intends to appoint any. That information would include personal data. In line with the principle of data minimisation enshrined in Article 5(1), point (c), of Regulation (EU) 2016/679 of the European Parliament and of the Council ² , only personal data that is necessary and sufficient to enable the competent authority to thoroughly assess the criteria laid down in Article 84(1), points (a) to (e) of Regulation (EU) 2023/1114 should be provided to the competent authority. When assessing the notification of the proposed acquisition and processing the personal data included therein, competent authorities should comply with Regulation (EU) 2016/679. Furthermore, in line with the principles relating to processing of personal data laid down in Article 5 of Regulation (EU) 2016/679, competent authorities should keep such personal data for no longer than it is necessary to the performance of their supervisory tasks.