Recital (56)

For the sake of legal certainty, it is appropriate to clarify that the Authority, the European Parliament, the European political parties and European political foundations, the national authorities competent to exercise control over aspects related to the financing of European political parties and European political foundations, and other relevant third parties referred to or provided for in this Regulation are data controllers within the meaning of Regulation (EU) 2018/1725 or Regulation (EU) 2016/679. It is also necessary to specify the maximum period for which they may retain personal data collected for the purposes of ensuring the legality, regularity and transparency of the funding of European political parties and European political foundations and the membership of European political parties. In their capacity as data controllers, the Authority, the European Parliament, the European political parties and European political foundations, the competent national authorities and the relevant third parties must take all appropriate measures to comply with the obligations imposed by Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, in particular those relating to the lawfulness of the processing, the security of the processing activities, the provision of information, and the rights of data subjects to have access to their personal data and to procure the correction and erasure of their personal data.