The EU Data Act

The legal framework

The Data Act is Regulation (EU) 2023/2854. It entered into force on 11 January 2024 and applies generally from 12 September 2025. It regulates who may access and use data generated by connected products and related services, and it sets rules for data contracts, cloud switching and public-sector access.

Who is covered

The Act uses defined roles. A user owns, rents or leases a connected product, or receives a related service. A data holder is the party that has the right or ability to make product data available, often the manufacturer or service provider. A data recipient receives data at the user's request. The Act applies to products and services placed on the EU market regardless of where the provider is established. Personal data remains governed by the GDPR, which prevails in case of conflict (Article 1(5)).

The main building blocks

• Access for users (Chapter II, Articles 3 to 7). Users must be told before purchase what data the product generates and how to access it (Article 3(2) and (3)). Users can obtain readily available data from the data holder (Article 4) and can instruct the holder to share it with a third party (Article 5). Third parties may not use it to build a competing product (Article 6). The design obligation in Article 3(1), to make data accessible by default, applies to products placed on the market after 12 September 2026. Micro and small enterprises that manufacture products are largely exempt (Article 7).
• Data holders to recipients (Chapter III, Articles 8 to 12). Where a holder must make data available, it must do so on fair, reasonable and non-discriminatory terms. Compensation must be reasonable and may include a margin, but is limited to costs for micro, small and medium-sized recipients (Article 9). Gatekeepers under the Digital Markets Act cannot be recipients (Article 5(3)).
• Unfair terms (Chapter IV, Article 13). A clause on access to and use of data, or on liability and remedies, is not binding if it is unilaterally imposed on another business and is unfair. Certain terms are always unfair, such as excluding liability for intentional acts. Chapter IV applies to contracts concluded after 12 September 2025, and from 12 September 2027 also to older contracts that are of indefinite duration or run for at least ten years from 11 January 2024.
• Public sector (Chapter V, Articles 14 to 22). Public bodies may request data in cases of exceptional need, such as a public emergency.
• Cloud and edge switching (Chapter VI, Articles 23 to 31). Customers can switch provider with a maximum notice period and a transition period, and switching charges are phased out entirely from 12 January 2027 (Article 29).
• International access (Article 32). Providers must take measures against unlawful third-country government access to non-personal data.

Trade secrets and the database right

The Act does not remove protection. A data holder can require measures to preserve confidentiality before disclosing trade secrets, and in exceptional circumstances can refuse disclosure where serious damage is likely and the trade secret cannot be protected otherwise (Article 4(6) to (8) and Article 5(9)). The sui generis database right under Directive 96/9/EC does not apply to databases containing data obtained from or generated by a connected product or related service (Article 43). We discuss both in database rights and trade secrets.

Enforcement

Each Member State designates competent authorities, with the data protection authority responsible for personal-data aspects. Member States set penalties. Check the designated authority in the country where you operate.

In practice

A manufacturer sells industrial pumps with built-in sensors and a monitoring subscription. A customer asks for the pump's operating data, so that it can give it to an independent maintenance firm. After the relevant dates, the manufacturer must make that data available on request, and the maintenance firm may not use it to build a rival pump. The manufacturer can protect its design know-how, but it must agree confidentiality measures first and cannot simply refuse.

A software company supplies analytics to a retailer under a standard form that lets the supplier change the data terms at any time, excludes any liability for data errors, and keeps all rights in derived data. If the retailer did not have a real opportunity to negotiate, these clauses risk being unenforceable under Article 13.

An SME uses a cloud service on a contract signed in 2023 with a two-year minimum term. From 12 January 2027 it can switch without being charged switching fees, and the provider must support the transition.

Frequently asked questions

Does the Data Act apply to us if we do not make connected products?

Possibly. Chapter IV applies to any business contracting about data, and the cloud-switching and international-access rules apply to providers of data processing services. Users of connected products also gain rights.

Does it replace the GDPR?

No. Where personal data are involved the GDPR still applies and prevails. Sharing under the Data Act needs a lawful basis under the GDPR.

Can we still refuse to share data that is a trade secret?

Only in limited cases. The general approach is to share with safeguards agreed in advance. Refusal is for exceptional situations with demonstrable serious damage and must be notified to the competent authority.

What should we do now?

Inventory the data your products generate, update user-facing information, review data clauses in your contracts against Article 13, and check your cloud contracts for switching terms.

How this connects

The Act affects how you protect and license data. See our service data and database rights protection and data licensing and sharing. Our contract review tests existing contracts for these points, the Document Studio prepares compliant terms, and the rights and obligations register follows the duties after signature. Related reading: international data transfers.