data act

The Data Act is a data law with a cybersecurity edge. Most of it is about who gets data, on what terms, and how to leave a provider. A company of 50 to 1000 people usually meets it in one or more of five roles.

• Manufacturer of a connected product. A connected product is an item that gathers data about its use or environment and can pass that data on, over a network, a cable or on the device itself. Its main job is not storing or processing data for someone other than the user.
• Provider of a related service. A digital service, often an app or software, that the product needs to perform a function, or that is added later to update or change what the product does.
• Data holder. Whoever has the right or the duty to use and make available the data. Often the manufacturer, sometimes the provider of the related service.
• Provider of a data processing service. Cloud and similar on-demand computing services sold to customers in the EU, wherever the provider sits.
• User or customer. Whoever owns, rents or leases a connected product, receives a related service or buys a data processing service. Here the Data Act gives you rights.

The regulation also lets public bodies ask for data in an exceptional need, such as a public emergency. That chapter is not covered here.

From 12 September 2026, connected products and related services placed on the market have to be designed so that the user can reach the data they generate. By default the data and the metadata needed to read it must be easy to get, secure, free of charge, in a structured, commonly used and machine-readable format, and directly accessible where relevant and technically feasible.

Where the user cannot reach the data directly, the data holder has to make readily available data accessible on a simple request, without undue delay, in the same quality the data holder gets, and continuously and in real time where relevant and technically feasible. The data holder may not make this hard through the design of its interface, may not ask for more proof of identity than needed, and may not keep logs of the user’s access longer than needed for the request and for security.

Before the sale, rent or lease, the seller tells the user what data the product can generate, in what format and volume, where it is stored and for how long, and how to get it. A provider of a related service has a longer list, including who the data holder is, whether it will use the data itself, and how the user can complain.

Micro and small enterprises are outside these duties for their own products, unless they are subcontracted to make or design them or have a partner or linked enterprise that is larger. A newly medium-sized enterprise gets one year, and so does each product for one year after a medium-sized enterprise places it on the market. A contract term that cuts the user’s rights here does not bind the user.

At the user’s request, the data holder has to make readily available data available to a third party the user chooses, free of charge to the user and in the same quality and format. Companies designated as gatekeepers under Regulation (EU) 2022/1925 cannot be that third party.

Between businesses, the data holder agrees the terms with the recipient. They have to be fair, reasonable and non-discriminatory. Any compensation must be reasonable and non-discriminatory and may include a margin. Where the recipient is an SME or a non-profit research organisation, compensation may not go above the cost of making the data available. The data holder explains how it calculated the price.

The data holder may use non-personal data from the product only on the basis of a contract with the user, and may not use it to learn about the user’s economic situation, assets or production methods in a way that could harm the user’s market position. It may not pass non-personal product data to others except to fulfil its contract with the user. The user, in turn, may not use the data to develop a competing product.

Trade secrets are not a general reason to refuse. The data holder, or the trade secret holder if that is someone else, has to identify which data are trade secrets, including in the metadata, and agree with the user or third party the measures that keep them confidential: model contract terms, confidentiality agreements, strict access protocols, technical standards or codes of conduct.

If no agreement on the measures is reached, or the other side breaks them, the data holder may withhold or suspend sharing of the data marked as trade secrets. In exceptional cases it may refuse a specific request, but only if it can show it is highly likely to suffer serious economic damage despite the measures. Either decision has to be reasoned, given in writing without undue delay, and notified to the competent authority. The user or third party can complain to that authority or go to a dispute settlement body.

A data holder may also apply technical protection measures, encryption among them, to prevent unauthorised access. They may not discriminate between recipients or block the user’s rights.

Providers have to remove the commercial, technical, contractual and organisational obstacles that stop a customer from leaving: ending the contract, signing with another provider, taking its exportable data and digital assets elsewhere or back on premises, and, for infrastructure services, getting functional equivalence.

The written contract must set out the switching terms, among them:

• a notice period to start switching of no more than two months
• a transitional period of at most 30 calendar days, during which the provider keeps the service running, assists, flags known continuity risks and keeps the data secure; if that is technically unfeasible, the provider says so within 14 working days and proposes a period of up to seven months
• an exhaustive list of the data and digital assets that can be ported, at least all exportable data
• at least 30 calendar days to retrieve the data afterwards, then full erasure
• support for the customer’s exit strategy

From 12 January 2027 no switching charges may be imposed. Until then, reduced charges may not exceed the provider’s direct costs of the switch. Providers also publish which jurisdiction their infrastructure is subject to, and what they do to prevent unlawful access by foreign governments to non-personal data held in the EU. Services built mostly for one customer and not offered at broad scale are exempt from some of these rules, and test versions for a limited time from all of them.

A term on access to and use of data, or on liability and remedies for data obligations, does not bind a business if the other side imposed it unilaterally and it is unfair. A term counts as imposed when one party supplied it and the other could not influence it despite trying to negotiate. The party that supplied the term carries the burden of proof.

Some terms are always unfair, for example excluding liability for intent or gross negligence. Others are presumed unfair, for example stopping the other side from getting a copy of the data it provided or generated, or letting the stronger side use the other’s data in a way that seriously harms it. The price and the main subject matter of the contract are not tested this way.

These rules apply to contracts concluded after 12 September 2025. From 12 September 2027 they also reach older contracts of indefinite duration or that expire at least ten years after 11 January 2024.

GDPR. The Data Act covers personal and non-personal data, and it does not change data protection law. Where the two conflict, data protection law prevails. When the user is the data subject, the Data Act’s access rights add to the GDPR’s rights of access and portability. When the user is a business asking for data about other people, such as staff driving a company vehicle, the data holder may hand over personal data only if there is a valid legal basis under the GDPR. The recitals treat such a business user as a controller. Data protection authorities supervise the Data Act where personal data is concerned. In practice, run each data request past whoever owns GDPR in your company.

CRA. Both laws reach connected products. The CRA sets security requirements for the product. The Data Act sets who can get the data out of it. A reasonable reading: the access route you build for users is part of the product, so from 11 December 2027, when the CRA’s product requirements apply, it has to meet them as well.

• 11 January 2024. The regulation entered into force.
• 12 September 2025. Most of it applies, including the switching rules and the unfair-terms rules for new contracts.
• 12 September 2026. The design duty applies to products and related services placed on the market after this date.
• 12 January 2027. Switching charges end.
• 12 September 2027. The unfair-terms rules reach older long contracts.

Each member state designates one or more competent authorities and sets its own penalties, which must be effective, proportionate and dissuasive. The regulation sets no fine ceiling of its own. For breaches of the user access and sharing chapter, the mandatory sharing chapter and the public-need chapter, data protection authorities may impose fines under the GDPR up to its highest ceiling. Check your national law for the authority and the penalty rules. The Commission also offers guidance, a FAQ and a draft recommendation on non-binding model contract terms.