Data Act FAQ updated Part One - European Commission clarifies how the Data Act’s unfairness control applies to mixed contracts

The European Commission launched a new update of their FAQ on the Data Act on 12 September 2025 – also the date of entry into force of the Data Act. These most recent FAQ brings more elaborate explanations and clarity on several important topics. In particular, an important clarification is provided on the scope of the unfairness control under Article 13 of the Data Act, more specifically when it comes to contracts that are not primarily about data but nevertheless include provisions on data access, use, or related obligations. 

When talking about the Data Act, it is quickly linked to concepts like connected products, related services and data processing services. However, it should be highlighted that Article 13 of the Data Act knows a broader applicability range independent of connected products, related services or data processing services. In this blog, we discuss the key takeaways from the Commission’s position on unfairness control in the FAQ. 

The recent EC guidance addresses a common real-world scenario: contracts are often of mixed nature covering a wide range of topics, from product sales to financial services, and possibly including some provisions about data sharing or use. The key question is: do the fairness rules under the Data Act apply to those data-related clauses even if the contract’s main subject is something else? 

The answer is yes, but only to those specific clauses that deal with data, as will be explained below. 

1. There is no requirement for data to be the main subject of the contract 

It is important to note that the Data Act does not require the entire contract to be about data for Article 13 to apply. Data does not need to be the main subject of the agreement. 

The FAQ lists examples: logistics, advertising, loans, investment consulting, management advice, the sale of connected products, and cloud services. It even spells out that a bank loan clause requiring business-client data sharing would be caught, although the loan’s financial terms would not. In short, even if data-sharing is just one element of a broader agreement (e.g., a loan contract, advertising services, or sale of connected devices), the unfairness rules still apply to the data-specific terms in mixed contracts. 

2. The focus is on data-related clauses 

As a natural consequence of the first point, it should be highlighted that in a single contract containing both data and non-data elements, the unfairness control only focuses on data-related terms. Moreover, many contracts have general clauses, for example, about remedies, liability, or contract duration, which apply across the entire agreement. Such boilerplate provisions are reviewable under Article 13 Data Act to the extent they also govern data-related obligations (e.g., liability rules and remedies for breach of data-sharing terms). If they concern non-data aspects (e.g., product warranty terms), they are not covered by Article 13 Data Act.

In short, the applicability of Article 13 Data Act is subject to four threshold conditions, regardless of the main subject of the agreement in question. 

• the contractual term must concern access to and use of data, or data-related liability and remedies. The remainder of the contract (e.g. product guarantees, insurance conditions, or the technical characteristic of a cloud service), covering issues unrelated to data, sits outside the scope of Chapter IV’s unfairness control. The FAQ expressly ties this reading to Recital 60 and confirms that the unfairness review is clause-specific within mixed agreements; 
• the clause must go beyond merely reflecting mandatory EU law that would apply anyway; 
• the contractual term must be unilaterally imposed; and 
• the contract is B2B and not addressed at consumers. 

Once Article 13 Data Act is applicable and the clause is in scope, the question is whether the term grossly deviates from good commercial practice in data access/use, contrary to good faith and fair dealing. 

We can consider the following practical examples: 

Loan contracts: If a business loan contract requires the borrower to share certain data with the bank, the clauses on data access and use are subject to unfairness control laid down in Article 13 Data Act. 

Cloud services contracts: In a cloud computing contract, terms about how data is accessed, used, or protected are covered; provisions on the technical specifications of the service are not. 

Sales contract for connected products: A sales contract for IoT devices may include terms about data generated by the device – these terms fall under Article 13 Data Act. 

In practice, for businesses this means that: 

• Data-related clauses in mixed contracts must be fair and balanced, or they risk being unenforceable against the party on whom they are unforced. The rest of the contract can stand if separable. 
• Companies should review standard contracts (especially boilerplate terms on liability, remedies, and data use) to ensure compliance with Article 13’s black- and grey-list architecture and the “good commercial practice” test. There should be no assumption that only standalone data-sharing contracts are covered by the Data Act.
• Timing matters for legacy deals. Article 13 Data Act applies to contracts concluded after 12 September 2025. However, from 12 September 2027, it also applies to pre-existing B2B contracts that are of indefinite duration or expire at least 10 years from 11 January 2024 – a window intended to allow renegotiation and cleansing of unfair data terms. 

The Commission’s position also ensures consistency by following the content of the clause, not the title or main purpose of the contract. 

Conclusion 

The European Commission’s interpretation on the prohibition of unfair contractual terms draws a clear line: 

• All clauses about data access, use, or breaches of data obligations, even in contracts mainly about something else, are subject to unfairness control laid down in Article 13 Data Act. 
• The rest of the contract remains outside the Data Act’s scope. 

In another blog, we focus on additional takeaways from the European Commission’s updated FAQ on the Data Act: Data Act FAQ updated – GDPR interplay and technical requirements for data sharing | Timelex. 

Should you need any assistance with the implementation of the Data Act in your organisation, do not hesitate to contact our Timelex team. Our specialized data lawyers are closely monitoring this matter and always aiming for a pragmatic approach.