Short answer
EU law gives broad electronic access to a defined core of public company-register information. For covered company types, this includes constitutional documents, authorised representatives, subscribed capital, published accounts and status events such as winding-up. Those records can be searched across Member States through interconnected registers.
That is not a general right for a creditor or shareholder to inspect internal emails, contracts, board papers, customer files or forecasts. Additional access needs another legal basis: shareholder meeting or inspection rights, a contract, insolvency rules, a regulator's power, or a national court's disclosure procedure.
Privacy and trade-secret rules are not automatic vetoes. The GDPR requires a lawful basis, necessity, proportionality, data minimisation and safeguards for personal data. Trade-secret protection applies only to information meeting its definition and expressly yields where EU or national law requires disclosure. For listed issuers, the Market Abuse Regulation (MAR) adds a further constraint: inside information may have to be disclosed to the whole market, while selective disclosure to one shareholder or creditor can trigger simultaneous public disclosure unless the recipient owes confidentiality.
Public registers are the first cross-border route
Directive (EU) 2017/1132 requires Member States to maintain a company file in a central, commercial or companies register for the company types listed in Annex II. Article 14's minimum disclosure set includes:
- the instrument of constitution and current statutes;
- appointment, departure and authority of representatives and members of administrative, supervisory or control bodies;
- subscribed capital information;
- required annual accounting documents;
- registered-office changes; and
- winding-up, nullity, liquidator and striking-off information.
The access rule is not limited to existing creditors or shareholders:
“Member States shall ensure that copies of all or any part of the documents and information, referred to in Article 14, may be obtained from the register on application.” —
Electronic copies must be available through the interconnected registers, commonly accessed through the European e-Justice portal. Company name, legal form, registered office, Member State and registration number are available free under the current baseline; other documents may carry an administrative-cost fee.
A company generally may rely against third parties on required particulars only after proper disclosure, subject to timing and knowledge rules. Preserve the dated home-register extract.
Directive (EU) 2025/25 will expand the information and cross-border digital tools, but its principal national application is future-facing from 31 July 2028. Those additions should not be treated as universally operational in 2026. National registers may already disclose more than the EU minimum.
Share ownership adds governance rights, not unlimited inspection
Company law remains substantially national. The registered-office Member State and legal form determine most rights to inspect shareholder registers, minutes or board materials. Articles and shareholder agreements may add rights but cannot displace mandatory law.
EU law provides a clearer minimum for companies whose shares are admitted to trading on an EU regulated market. Under Directive 2007/36/EC, shareholders may put items on the general-meeting agenda and table draft resolutions, subject to national thresholds and deadlines. At the meeting:
“Every shareholder shall have the right to ask questions related to items on the agenda of the general meeting.” —
The right is bounded by permitted measures for shareholder identification, meeting order, confidentiality and business interests. An unrelated or competitor-sensitive demand may therefore differ from a focused question needed for voting.
These rights do not automatically extend to private companies, and one share creates no general EU discovery right. National law supplies the remedy for refusal.
Creditors need a separate entitlement for non-public records
A prospective or existing creditor can use public accounts, representation records and insolvency notices without proving a special interest. Access beyond that public set normally comes from one of four places:
- contract: reporting covenants, audit certificates, borrowing-base reports or information undertakings;
- national company law: specific bondholder, secured-creditor or creditor-protection rights;
- insolvency and restructuring law: notice, claim, creditors' committee, voting and file-access rights; or
- procedure and supervision: a court disclosure order, enforcement measure or regulator's statutory information power.
The cross-border element does not enlarge the entitlement. It raises questions about court competence, procedure, service, translation, confidentiality and recognition. “Due diligence” is not a power to compel production.
The requester should identify the document, purpose and legal basis rather than demand all company data.
The GDPR regulates personal data; it does not seal the company file
Names, home addresses, signatures, identification numbers and information about natural-person directors, shareholders, employees or customers are personal data even when embedded in corporate documents. Their processing requires an Article 6 basis and compliance with Article 5 principles.
Consent is not always required. Disclosure may rest on legal obligation, public task, contract or a non-overridden legitimate interest. The controller must still limit data to what is necessary and respect accuracy, security, retention and transparency requirements.
The GDPR gives no creditor access to another person's records. Article 15 gives a data subject access to that person's data, subject to others' rights and freedoms. It is not shareholder or litigation discovery.
Conversely, saying “GDPR” is not enough to refuse a disclosure that company law or a court requires. The legal obligation supplies a possible processing basis, while the disclosing body must apply redaction, access controls or other safeguards where appropriate.
In , the Court held that a register authority was a GDPR controller and could not categorically refuse erasure of personal data that neither EU nor national law required merely because no redacted copy was supplied. A handwritten signature is personal data. The judgment concerns surplus data, not mandatory register fields.
Trade-secret protection requires a real secret and a real balance
Information is a trade secret under Directive 2016/943 only if it is not readily accessible, has commercial value because it is secret, and was reasonably protected. A “confidential” label cannot turn public filings into secrets.
The Directive also preserves mandatory transparency:
It does not affect rules requiring trade-secret holders, for public-interest reasons, to disclose information “to the public or to administrative or judicial authorities”. —
Acquisition, use or disclosure is lawful where EU or national law requires or allows it. A valid statutory or judicial demand may still use restricted evidence access, confidentiality obligations or redacted decisions. Clean teams and secure data rooms may also protect the information.
MAR can prohibit selective disclosure
For issuers within MAR, precise, non-public information likely to have a significant price effect may be inside information. The issuer generally discloses it as soon as possible. Since 5 June 2026, excludes intermediate steps in a protracted process from Article 17(1) disclosure; only the final circumstances or event must be disclosed, while confidentiality must be maintained. Other disclosure may be delayed only on the statutory conditions.
This affects individual information requests. If an issuer or someone acting for it intentionally gives inside information to a shareholder, lender or potential investor in the normal course of duties, Article 17(8) generally requires simultaneous complete and effective public disclosure. An accidental disclosure requires prompt public disclosure. The rule does not apply where the recipient owes a duty of confidentiality.
A confidentiality agreement is not a complete answer. The disclosure must still occur in the normal exercise of employment, profession or duties, and recipients with inside information face trading and onward-disclosure restrictions.
MAR also means a listed company cannot use “commercial sensitivity” as an indefinite reason to withhold price-sensitive information from the market. Equally, MAR does not require publication of every confidential fact; the statutory inside-information test and any lawful delay must be assessed carefully.
A practical request-and-response checklist
For the requester:
- identify the company type, registered office, register number and listing status;
- obtain the current home-register documents and preserve the retrieval date;
- state whether the additional right comes from share ownership, contract, insolvency status, court procedure or another statute;
- narrow the requested categories, period and purpose; and
- offer proportionate confidentiality arrangements without assuming they create an entitlement.
For the company:
- map each item to mandatory public disclosure, a qualified right or no compulsory access right;
- separate company information from personal data and genuine trade secrets;
- document the GDPR basis and necessary redactions or safeguards;
- test whether any requested or proposed disclosure concerns inside information;
- apply confidentiality measures rather than blanket refusal where lawful access exists; and
- give reasons and identify the national review route when refusing or limiting access.
Conclusion
EU company law makes a defined core of company information electronically available across borders, and listed shareholders receive specific meeting-related information rights. It does not create a universal right for shareholders or creditors to inspect internal company records.
Additional access depends on national company and procedural law, contract, insolvency status or regulatory authority. The GDPR and trade-secret rules shape how qualifying information is disclosed; they do not automatically defeat a valid entitlement. For listed issuers, MAR adds the decisive question whether giving confidential information to one requester would amount to selective disclosure of inside information.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.