law
Data Act
A regulation on who may access and use data from connected products, how cloud customers can leave a provider, and which data clauses between businesses do not bind. It has applied since 12 September 2025.
at a glance
- what it is
- Regulation (EU) 2023/2854, directly applicable. It sets who may access and use data from connected products, how cloud customers can leave a provider, and which data clauses between businesses do not bind.
- who it covers
- Manufacturers of connected products and providers of related services, wherever they are established. Data holders, data recipients, users in the EU, and providers of data processing services to customers in the EU.
- the size line
- Micro and small enterprises are outside the user access and sharing duties for their own products, with conditions. A medium-sized enterprise gets one year. No size exemption was found in the switching rules.
- fine ceilings
- No EU figure. Member states set the penalties. For the user access, mandatory sharing and public-need chapters, data protection authorities may fine up to the GDPR's highest ceiling.
- dates
- 12 September 2025 most of it. 12 September 2026 the design duty, for products placed on the market after that date. 12 January 2027 no more switching charges. 12 September 2027 the unfair-terms rules reach older long contracts.
- status
- In force since 11 January 2024. A Commission proposal to amend it (Digital Omnibus) is in the legislative process.
basis Data Act art. 1(3), 3(1), 7(1), 29(1), 40(1), 40(4), 50
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleswhere product data goes, and who decides
- a simple request for the data
- the data and metadata, free of charge, without undue delay
- a contract before any use of non-personal data
- the same data, at the user's request
- fair terms, reasonable compensation, confidentiality for trade secrets
basis Data Act Art. 4(1), 4(12), 4(13), 5(1), 5(3), 5(7), 5(9), 7(1), 8(1), 9(1)
five dates that set the duties
- 111 January 2024 the regulation enters into force
- 212 September 2025 the regulation applies, including switching and unfair terms in new contracts
- 312 September 2026 design duty for products and services placed on the market after this date
- 412 January 2027 no more switching charges
- 512 September 2027 unfair-terms rules reach older long contracts
basis Data Act Art. 29(1), 40(1), 50
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- find your roles
Find out which parts of the regulation reach you, and for which products, services and contracts.
- give users their data
Make the data your products and related services generate reachable by the user and, at the user's request, by a third party.
- protect trade secrets while sharing
Keep trade secrets confidential without using them as a blanket refusal.
- let cloud customers leave
If you provide data processing services, make switching to another provider or back on premises work as the regulation sets it.
- check the data clauses you sign
Make sure the data clauses you impose are fair, and use the rights you have as a buyer.
the dates
What applies when. The reference sits under each date.
- 12 September 2025the Data Act applies, including switching and the unfair-terms rules for new contractsData Act Art. 50applies now
- 12 September 2026design duty for user access applies to connected products and related services placed on the market after this dateData Act Art. 50applies now
- 12 January 2027providers may no longer charge for switchingData Act Art. 29(1)coming
- 12 September 2027unfair-terms rules reach contracts concluded on or before 12 September 2025 that run indefinitely or expire at least ten years after 11 January 2024Data Act Art. 50coming
the fine ceilings
The ceilings each text sets. The reference sits under each.
- Data Actno EU figure; member states set the penaltiesData Act Art. 40(1)
For the user access, mandatory sharing and public-need chapters, data protection authorities may fine up to the GDPR's highest ceiling: Data Act Art. 40(4).
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.