🇪🇺Data Act

← Back to laws in European Union

The Data Act gives users stronger control over connected-product data

The Data Act is an EU regulation on fair access to and use of data. Its practical focus is the data generated by connected products and related services: smart devices, industrial equipment, vehicles, health and lifestyle devices, agricultural machinery, connected home products and other Internet of Things systems. The law is designed to prevent valuable product-use data from remaining locked inside manufacturers' or service providers' systems when users need that data for repair, maintenance, analytics, switching, innovation or third-party services.

The Act is not a replacement for the GDPR. It applies to both personal and non-personal data, but where personal data is involved, EU data protection law continues to control the processing. The Data Act does not create a new legal basis for processing personal data. Instead, it creates access, sharing, contract and interoperability rules that must be implemented alongside privacy, security, trade secret and intellectual property controls.

What the Data Act is trying to fix

Connected products generate large volumes of operational data, but users often cannot easily access it or share it with service providers of their choice. This affects consumers, businesses, SMEs, repair providers, aftermarket service providers, researchers and public bodies. The Data Act responds by setting horizontal rules on who may access product data and related service data, how data holders must make it available, what conditions may be imposed, and when public bodies may request data in exceptional need situations.

The Act also addresses cloud and data processing service switching. It aims to reduce customer lock-in by requiring providers of data processing services to remove contractual, technical, organisational and commercial obstacles to switching or using more than one service in parallel.

Connected products and related services

The Act applies to connected products that obtain, generate or collect data about their performance, use or environment and can communicate that data through an electronic communications service, physical connection or on-device access. This includes many IoT products and industrial connected systems.

It also covers related services. These are digital services connected to the product in a way that affects the product's functions. A remote monitoring service, connected maintenance service or software-enabled control service may be relevant where it forms part of the product ecosystem. Purely auxiliary services such as unrelated consulting, analytics or finance services are not automatically treated as related services merely because they are supplied to the same customer.

User access to product data

The central rule is that users should be able to access the data generated by their use of a connected product or related service. The design expectation is important: connected products and related services should be designed and provided so that product data and related service data, including relevant metadata needed to interpret and use the data, are easily and securely accessible to the user, free of charge, in a comprehensive, structured, commonly used and machine-readable format.

Where data cannot be accessed directly by the user from the product or service, the data holder may have to make readily available data accessible to the user without undue delay, of the same quality available to the data holder, and where technically feasible, continuously and in real time. This shifts compliance from a privacy-notice exercise to a product architecture, interface and data governance exercise.

Sharing data with third parties

The Data Act allows users to ask that data be made available to a third party of their choice. This matters for repair, maintenance, insurance, fleet management, analytics, energy management, agriculture, mobility, industrial optimisation and aftermarket services. A third party receiving data must use it only for the purposes agreed with the user and must not make the exercise of the user's choices unduly difficult.

The Act also protects competition and innovation by limiting misuse. For example, third parties should not use the data to develop a competing connected product. At the same time, the Act is meant to enable new services built around the user's data, including aftermarket and ancillary services.

Trade secrets and confidential information

Some product data may contain or reveal trade secrets. The Act does not remove trade secret protection, but it also does not allow a data holder to defeat the data access regime merely by labelling everything confidential. Data holders should identify trade secrets before disclosure and may require proportionate technical and organisational measures to preserve confidentiality.

In exceptional circumstances, a data holder may refuse or suspend sharing of specific data where it can demonstrate that serious economic damage is highly likely despite the safeguards. That decision should be substantiated and is not meant to become a routine objection to data access.

Relationship with the GDPR

The Data Act expressly sits alongside the GDPR, Regulation (EU) 2018/1725 and the ePrivacy framework. It should not be applied in a way that diminishes privacy or data protection rights. Any processing of personal data under the Data Act still requires compliance with EU data protection law, including a valid legal basis where required.

This is especially important where the user of a connected product is not the same person as the data subject. For example, an employer, fleet operator, landlord, insurer, hospital, manufacturer or service provider may be the user of a connected product, but the data generated may relate to workers, drivers, patients, tenants or customers. In such cases, the Data Act access analysis and the GDPR lawful-basis analysis must both be done.

Pre-contract information duties

Before a contract for the purchase, rent or lease of a connected product is concluded, the user should receive clear and understandable information about the data the product is capable of generating, including the type, format and estimated volume of the data, and how the user can access, retrieve or erase it where applicable. Similar transparency is required before concluding a contract for a related service.

For practical compliance, this means product teams, legal teams and sales teams must align. The customer-facing information should match the technical reality of the product, the retention policy, the available interfaces, the API terms and the actual data-sharing workflow.

Fair terms for making data available

Where a data holder is obliged to make data available to a data recipient, the terms must be fair, reasonable, non-discriminatory and transparent. Compensation may be possible in business-to-business settings, but it must be reasonable and supported by sufficient information. For SMEs and not-for-profit research organisations, the Act gives additional protection against excessive compensation demands.

The Act also addresses unfair contractual terms in business-to-business data access and use. The concern is practical: a stronger contracting party should not use standard terms to capture data rights, block access, impose one-sided liability or prevent meaningful data use in a way that undermines the Regulation's objective.

Business-to-government access in exceptional need

The Data Act also allows public sector bodies, the Commission, the European Central Bank and Union bodies to request data from data holders where there is an exceptional need for data to perform a specific task carried out in the public interest. This is not a general public-sector right to take private-sector data. The request must fit within the Act's conditions and safeguards.

Exceptional need may be relevant in public emergencies and certain situations where the data is necessary for a public-interest task and cannot be obtained otherwise in time or under equivalent conditions. Organisations that hold operational, infrastructure, mobility, health, energy or supply-chain data should therefore have an internal process for assessing and responding to such requests.

Cloud switching and data processing services

A major part of the Data Act deals with data processing services, including cloud and edge services. Providers must take measures to allow customers to switch to another provider or to on-premises infrastructure, or to use several providers at the same time, without undue obstacles. The law targets contractual lock-in, technical lock-in, excessive data egress charges and lack of interoperability.

Providers must give customers information about switching and porting procedures, available formats, technical limitations and relevant standards or interoperability specifications. Parties involved in the switching process must cooperate in good faith so that the transfer is effective and continuity of service is maintained.

Switching charges

The Data Act phases out switching charges. From 11 January 2024 to 12 January 2027, providers of data processing services may impose reduced switching charges, but those charges must not exceed costs directly linked to the switching process. From 12 January 2027, providers must not impose switching charges on customers for the switching process.

This is particularly important for customers that rely on cloud storage, compute, analytics, application platforms or infrastructure services. It should become easier to move data, applications and digital assets without facing artificial economic barriers that keep the customer locked into one provider.

International governmental access to non-personal data

The Act requires providers of data processing services to publish and keep updated information about the jurisdiction of their ICT infrastructure and the technical, organisational and contractual measures they use to prevent unlawful international governmental access to or transfer of non-personal data held in the Union where such access or transfer would conflict with Union or Member State law.

This is separate from GDPR international transfer analysis. It is aimed at non-personal data, including commercially sensitive and industrial data. For organisations handling strategic operational data, the compliance question is not only where the data is hosted, but also which legal systems may compel access to it.

Interoperability and smart contracts

The Data Act also supports interoperability for data spaces, data sharing mechanisms, data processing services and smart contracts used for data sharing. The objective is to reduce technical fragmentation and make data sharing more reliable, portable and scalable across the Union.

For organisations building data spaces, industrial data exchanges or automated data-sharing arrangements, interoperability cannot be treated as an afterthought. Data formats, metadata, APIs, standards, semantic compatibility, security and smart contract reliability should be part of the compliance design.

Supervision, complaints and penalties

Member States must designate competent authorities to supervise and enforce the Act. Their tasks include promoting data literacy, handling complaints, conducting investigations and imposing effective, proportionate and dissuasive penalties. Where obligations involve personal data, GDPR supervisory authorities may also have a role within their competence.

The Act also gives the European Data Innovation Board a role in supporting consistent application, cooperation between competent authorities and the development of common standards and practices for the data economy.