the whole job

Data Act: the whole job, in order

The Data Act decides who may get data out of connected products, how a cloud customer leaves a provider and which data clauses between businesses do not bind. Here is the job as a plan: five phases, in the order that holds up, with who carries each step, what it produces and the proof it leaves.

last checked 2 November 2026

how to read this plan

Each step has an owner, a kind of work and two outputs. The kinds of work are different jobs: choices that someone with authority signs, things the team builds, and checks that someone keeps running. Not every phase is yours. The product phases are for makers of connected products and providers of related services, the switching phase is for providers of cloud and other data processing services, and the last phase is for every business that signs data clauses or buys these products and services. Most of the regulation has applied since 12 September 2025. The design duty reaches products placed on the market after 12 September 2026, switching charges end on 12 January 2027, and the unfair-terms rules reach older long contracts on 12 September 2027. Under each step a small note names the legal basis, or says practice where no text sets it.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

find your roles

Find out which parts of the regulation reach you, and for which products, services and contracts.

  1. list your connected products and related services

    List every item you make that gathers data about its use or environment and can pass it on, and every app or digital service the product needs or that changes its functions. Mark the date each was placed on the market.

    • owner legal or DPO
    • decide and document
    what it produces
    a product and service register with the reason each one is in or out
    the proof it leaves
    the register, dated and approved by management

    the work pagethe control: asset-inventory

    basis Data Act Art. 1(3); Data Act Art. 2(5), 2(6)

  2. check whether the small-company exemption covers you

    Check whether you are a micro or small enterprise with no larger partner or linked enterprise, and whether you make or design the product under a subcontract. A company that has been medium-sized for less than a year, and a medium-sized company's product in its first year on the market, are also exempt from the user access duties.

    • owner legal or DPO
    • decide and document
    what it produces
    a written size assessment with the group structure behind it
    the proof it leaves
    the assessment, rechecked when the group or the headcount changes

    basis Data Act Art. 7(1)

  3. list the data processing services you provide

    List the cloud and other on-demand computing services you sell to customers in the EU. Mark the ones built mostly for a single customer and not offered at broad scale, and the time-limited test versions, because some or all of the switching rules do not apply to them.

    • owner head of IT
    • decide and document
    what it produces
    a service list with the switching rules that apply to each
    the proof it leaves
    the list and the reasoning for every exemption claimed

    basis Data Act Art. 2(8); Data Act Art. 31(1), 31(2)

  4. name owners and note the dates

    Name one owner for data requests from users and third parties, and one for switching and data contracts. Write down the dates that apply to you and find your national competent authority and its penalty rules.

    • owner board
    • decide and document
    what it produces
    named owners and a date sheet
    the proof it leaves
    a board decision naming the owners, and the date sheet with its sources

    basis Data Act Art. 50; Data Act Art. 37(1); Data Act Art. 40(1)

you are done with this phase when you can show a register of products, services and data contracts, with a role, an owner and the date that applies to each.
02

give users their data

Make the data your products and related services generate reachable by the user and, at the user's request, by a third party.

  1. design new products for direct access

    For products and related services placed on the market after 12 September 2026, design them so that the user can reach the data and the metadata by default: easily, securely, free of charge, in a structured, commonly used and machine-readable format, and directly where relevant and technically feasible.

    • owner head of IT
    • build and configure
    what it produces
    a design requirement for data access in the product specification
    the proof it leaves
    the specification and the test that shows the access works

    the control: secure-development

    basis Data Act Art. 3(1); Data Act Art. 50

  2. write the information given before the contract

    Prepare the information the seller gives before a sale, rent or lease, and the longer list a provider of a related service gives: what data, in what format and volume, where it is stored and for how long, who the data holder is, and how the user gets the data or shares it.

    • owner legal or DPO
    • build and configure
    what it produces
    a pre-contract information sheet per product and service
    the proof it leaves
    the sheets and proof they reach buyers before signing

    basis Data Act Art. 3(2), 3(3)

  3. build a request route for users

    Where the user cannot reach the data directly, build a simple electronic request that delivers readily available data without undue delay and in the same quality you get. Ask for no more identity proof than needed, and keep access logs only as long as the request and security need them.

    • owner head of IT
    • build and configure
    what it produces
    a request route and a short procedure behind it
    the proof it leaves
    a log of requests with dates of answer, kept no longer than needed

    basis Data Act Art. 4(1), 4(4), 4(5)

  4. set terms for third parties

    Prepare fair, reasonable and non-discriminatory terms for passing data to a third party the user names, free of charge to the user. Set a compensation method you can explain, capped at cost for SMEs and non-profit research organisations, and refuse designated gatekeepers.

    • owner legal or DPO
    • decide and document
    what it produces
    standard third-party data terms and a compensation method
    the proof it leaves
    the terms, the calculation basis shared with recipients and a record of requests

    basis Data Act Art. 5(1), 5(3); Data Act Art. 8(1), 8(3); Data Act Art. 9(1), 9(4), 9(7)

  5. put your own use of the data on a contract

    Use non-personal product data only under a contract with the user, and stop any use that reveals the user's economic situation, assets or production methods to their harm. Share non-personal product data with others only to fulfil that contract, and bind them not to pass it on.

    • owner legal or DPO
    • build and configure
    what it produces
    contract clauses on your use of the data
    the proof it leaves
    signed contracts and a list of who receives the data and why

    basis Data Act Art. 4(13), 4(14)

  6. check the legal basis before personal data leaves

    When the user or a third party asks for personal data about someone else, release it only if there is a valid legal basis under the GDPR. Route these requests to whoever owns GDPR in the company.

    • owner legal or DPO
    • decide and document
    what it produces
    a rule for requests that include personal data
    the proof it leaves
    the decision recorded with each such request

    the work page

    basis Data Act Art. 1(5); Data Act Art. 4(12), 5(7)

you are done with this phase when you can show a working access route for each product, the pre-contract information, and a record of requests handled.
03

protect trade secrets while sharing

Keep trade secrets confidential without using them as a blanket refusal.

  1. mark the data that are trade secrets

    Identify which data and metadata are trade secrets, yours or a supplier's, and mark them in the metadata. Know who the trade secret holder is when it is not you.

    • owner legal or DPO
    • decide and document
    what it produces
    a trade secret register for product data
    the proof it leaves
    the register and the marking in the metadata

    basis Data Act Art. 4(6), 5(9)

  2. agree confidentiality measures before sharing

    Agree proportionate technical and organisational measures with the user or third party before trade secrets go out: model contract terms, confidentiality agreements, strict access protocols, technical standards or codes of conduct.

    • owner legal or DPO
    • build and configure
    what it produces
    a standard confidentiality package for data sharing
    the proof it leaves
    the signed agreements per recipient

    basis Data Act Art. 4(6), 5(9)

  3. apply technical protection

    Use technical protection measures such as encryption to prevent unauthorised access, without discriminating between recipients or blocking the user's own rights.

    • owner head of IT
    • build and configure
    what it produces
    the protection measures described per data flow
    the proof it leaves
    configuration records and a check that users still get their data

    the control: encryption-keys

    basis Data Act Art. 11(1)

  4. handle a withholding or refusal in writing

    When measures are not agreed or are broken, or when disclosure is highly likely to cause serious economic damage, give a reasoned decision in writing without undue delay and notify the competent authority.

    • owner legal or DPO
    • prove and operate
    what it produces
    a template decision and a notification route
    the proof it leaves
    each decision, its reasons and the notification sent

    basis Data Act Art. 4(7), 4(8); Data Act Art. 5(10), 5(11)

you are done with this phase when you can show which data are trade secrets, the measures agreed with each recipient, and the record of any refusal.
04

let cloud customers leave

If you provide data processing services, make switching to another provider or back on premises work as the regulation sets it.

  1. write the switching terms into the contract

    Put the switching terms in a written contract the customer can store before signing: a notice period of at most two months, a transitional period of at most 30 calendar days with continuity and assistance, an exhaustive list of exportable data and assets, at least 30 days to retrieve data, then full erasure.

    • owner legal or DPO
    • build and configure
    what it produces
    updated contract templates for every service
    the proof it leaves
    the templates and a list of contracts moved to them

    basis Data Act Art. 25(1), 25(2), 25(3)

  2. publish switching methods and data formats

    Tell customers how switching and porting work, with methods, formats and known limits, and keep an online register of data structures and formats. Offer open interfaces free of charge where your service is above the infrastructure layer.

    • owner head of IT
    • build and configure
    what it produces
    a switching page and a format register
    the proof it leaves
    the published pages with their update history

    basis Data Act Art. 26; Data Act Art. 30(2), 30(5)

  3. remove switching charges

    Until 12 January 2027, charge no more than the direct cost of a switch, and tell prospective customers about fees and penalties before signing. From that date, charge nothing for switching.

    • owner board
    • decide and document
    what it produces
    a pricing decision on switching
    the proof it leaves
    the price list and the pre-contract information

    basis Data Act Art. 29(1), 29(2), 29(3), 29(4)

  4. publish jurisdiction and access safeguards

    Publish the jurisdiction your infrastructure is subject to and the measures you take against unlawful access by foreign governments to non-personal data held in the EU, and list that page in your contracts.

    • owner legal or DPO
    • build and configure
    what it produces
    a public page on jurisdiction and safeguards
    the proof it leaves
    the page and the contract clause that points to it

    basis Data Act Art. 28(1), 28(2); Data Act Art. 32(1)

  5. rehearse a switch end to end

    Run a test export of a customer's exportable data within the transitional period. If the period is technically unfeasible, the regulation asks you to say so within 14 working days and propose a period of up to seven months, so know before a customer asks.

    • owner head of IT
    • prove and operate
    what it produces
    a switching runbook
    the proof it leaves
    the test record with timings and the gaps fixed

    the control: backup-recovery

    basis Data Act Art. 25(2), 25(4)

you are done with this phase when you can show contracts with the switching terms, published switching information, no switching charges from 12 January 2027, and a tested exit.
05

check the data clauses you sign

Make sure the data clauses you impose are fair, and use the rights you have as a buyer.

  1. review the data clauses you impose

    Check your standard terms on data access, data use and liability for data obligations against the terms that are always unfair or presumed unfair. Keep a record of negotiations, because the party that supplied a term has to prove it was not imposed.

    • owner legal or DPO
    • decide and document
    what it produces
    revised templates and a negotiation record
    the proof it leaves
    the templates with the review date and the record per contract

    basis Data Act Art. 13(1), 13(4), 13(5), 13(6)

  2. find older long contracts before the 2027 date

    List contracts concluded on or before 12 September 2025 that run indefinitely or expire at least ten years after 11 January 2024. The unfair-terms rules reach them from 12 September 2027.

    • owner legal or DPO
    • decide and document
    what it produces
    a list of affected contracts with a plan for each
    the proof it leaves
    the list and the amendments signed

    basis Data Act Art. 50; Data Act Art. 13(1)

  3. ask your cloud providers for switching terms

    As a customer, check that each cloud contract states the notice and transitional periods, the exportable data, the retrieval period and the erasure. Use these terms in your own exit plans.

    • owner procurement
    • build and configure
    what it produces
    a check of each cloud contract against the switching terms
    the proof it leaves
    the checked contracts and the exit plan per critical service

    the work pagethe control: supplier-management

    basis Data Act Art. 25(1), 25(2); Data Act Art. 29(1)

  4. claim the data from the products you use

    As a user of connected products, ask for the pre-contract information when buying, and request the data your machines, vehicles or devices generate where it helps maintenance or a change of supplier.

    • owner procurement
    • build and configure
    what it produces
    a buying checklist and a first data request
    the proof it leaves
    the information received and the data delivered

    basis Data Act Art. 3(2); Data Act Art. 4(1)

  5. review the whole picture each year

    Once a year, check the register of products, services and contracts, the requests handled, the refusals and the switching tests, and watch for guidance, model contract terms and amendments.

    • owner everyone
    • prove and operate
    what it produces
    a yearly review note
    the proof it leaves
    the note with actions and owners

    basis working practice. No legal text sets this.

you are done with this phase when you can show reviewed templates, a list of older long contracts checked, and your rights written into what you buy.

who carries what

The same steps, grouped by the person who has to act.

legal or DPO

head of IT

board

procurement

everyone

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    List the connected products you sell and the cloud services you provide or buy, and mark your role for each one.

    see the dates