S.L. 460.41 Art. 25Database of domain name registration data. 43

(1) For the purpose of contributing to the security, stability and resilience of the DNS, the CIP Department shall require

TLD name registries and entities providing domain name registration services to collect and maintain accurate and complete domain name registration data in a dedicated database with due diligence in accordance with European Union law in relation to information which constitutes personal data.

(2) For the purposes of sub-article (1), the database of domain name registration data shall contain the necessary information to identify and contact the holders of the domain names and the points of contact administering the domain names under the TLDs. Such information shall include:

(a) the domain name;

(b) the date of registration;

(c) the registrant’s name, contact email address and telephone number;

(d) the contact email address and telephone number of the point of contact administering the domain name in the event that they are different from those of the registrant.

(3) The TLD name registries and the entities providing domain name registration services shall have in place policies and procedures, including verification procedures, to ensure that the databases in sub-article (1) include accurate and complete information. Such policies and procedures shall be made publicly available.

(4) The TLD name registries and the entities providing domain name registration services shall make publicly available, without undue delay after the registration of a domain name, the domain name registration data which are not personal data.

(5) The TLD name registries and the entities providing domain name registration services shall provide access to specific domain name registration data upon lawful and duly substantiated requests by legitimate access seekers, in accordance with national data protection legislation and Union data protection law. The TLD name registries and the entities providing domain name registration services shall reply without undue delay and in any event within seventy-two

(72) hours of receipt of any requests for access. Policies and procedures with regard to the disclosure of such data shall be made publicly available:

Provided that domain name registration data shall be free of charge to legitimate access seekers upon lawful and duly substantiated requests.

(6) Compliance with the obligations established in sub-articles (1) to (5) shall not result in a duplication of collecting domain name registration data. To that end, TLD name registries and entities providing domain name registration services shall cooperate with each other.