Data Act FAQ updated Part Two – GDPR interplay and technical requirements for data sharing

The European Commission launched a new update of their FAQ on the Data Act on 12 September 2025 – also the date of entry into force of the Data Act. These most recent FAQ brings more elaborate explanations and clarity on several important topics. Our previous blog highlighted the broad scope of the unfairness control under Article 13 Data Act. In this blog, we focus on the interplay between the Data Act and the GDPR, as well as concrete guidance on technical and practical requirements for data holders when sharing data. 

1. The GDPR as a Data Act-shield? 

The FAQ emphasizes that whenever personal data are involved, GDPR applies in full and prevails in case of conflict (Recital 7 and Article 1(5) Data Act). The Data Act’s role is to enhance access and sharing by complementing GDPR portability (e.g., enabling real-time, continuous access for all data generated by a connected product, not only personal data under Art. 20 GDPR). Enforcement follows that split: Data Protection Authorities remain competent for personal-data issues arising in Data Act scenarios, so a data subject does not need to navigate two authorities if rights under both instruments are engaged. 

It is important to note that the Data Act does not provide a legal basis to collect and generate data – it is the data holder’s responsibility to ensure a valid legal basis under Article 6 GDPR and, where necessary, Article 9 GDPR. The Data Act introduces an obligation for data holders to provide requested access, including making personal data available to users or third parties upon a user’s request. There are multiple possible scenarios in this context: 

• Where the requesting user is the data subject, a request to access (under Article 4 Data Act) or to port to a third party (under Article 5 Data Act) maps closely onto Articles 15 and 20 GDPR, respectively. Such access can be provided, and the data holder can use Article 6 (1) c) GDPR as a legal basis to share the (personal) data.
• Where the requesting party is a third party on behalf of a user, the above also applies. Access to personal data can be provided if the data subject is that user, in which case the data holder can justify the data sharing under Article 6 (1) c) GDPR. 
• Where the user is not the data subject (typically in multi-user or B2B settings), the FAQ stresses that the Data Act is not in itself a legal basis under Article 6 GDPR for providing such personal data. The data holder must independently identify a valid legal basis – or provide anonymised data instead. 
• Where the requesting party is a third party on behalf of the user that is not the data subject, the data holder cannot simply provide access to the personal data. Either, anonymised data is provided instead, or the third party has a valid legal basis to process the data upon reception from the data holder. However, it seems that the data holder would not be obligated to share the not-anonymised version of the personal data if the third party has no valid legal basis under the GDPR. In such cases, the GDPR thus functions as a shield. 

The GDPR’s lawfulness, necessity and minimisation tests continue to govern, and can justify narrowing or declining a request if no appropriate basis exists. In this sense, the GDPR can be some sort of “shield” for Data Act requests, depending on the context and (personal) data at hand. However, the extent of such “GDPR shield” remains to be seen, as more practical applications of both regulations will come up in practice. In any case, some clear limitations have already been set: pseudonymisation, anonymisation and encryption do not transform in-scope “raw or pre-processed” device data into protected “derived” data outside Chapter II Data Act. Such privacy-enhancing techniques are encouraged to reconcile GDPR compliance with the Data Act’s access/porting duties – particularly in multi-user contexts – but cannot be used to circumvent sharing where data remain “readily available.” 

In concrete terms, the GDPR can legitimately constrain Data Act sharing where: (i) the request covers personal data and the user is not the data subject and lacks a valid legal basis under Article 6 GDPR; (ii) disclosure would breach core GDPR principles (e.g., purpose limitation, data minimisation, integrity, security) absent appropriate safeguards; or (iii) special-category data or children’s data raise heightened risks not mitigated by the requester (Article 9 Data Act). 

2. Technical and practical requirements for data holders sharing data 

The Commission’s FAQ (v1.3) turns the Data Act’s high-level requirements from Articles 3(1), 4(1) and 5(1) Data Act into a (more) concrete delivery standard for data holders. In short: by the application date, you must be able to supply the relevant data in scope: 

• in the right, interoperable format: a comprehensive, structured, commonly used and machine-readable format, that allows for interoperability, e.g. XML, JSON, CSV; 
• of high quality: meaning of the same quality as it would be shared with for example another subsidiary within the group; 
• in a timely manner: i.e. without undue delay – the Commission expects data holders to implement automated, streamlined and structured procedures, portals and policies that allow for timely response to Data Act requests. Delays are only justified for legal, security or technical reasons proportionate to the request. This can be important in certain sectors where the usefulness of the data can be hindered by even minor delays;
• through a convenient interface: access must be easy and simplified avoiding unnecessary complexities or barriers; 
• securely: protecting against unauthorised access to data, as well as misuse thereof (e.g. encrypted transfer channels and safe, multi-factor authentication; and 
• with potential latency kept to a minimum: this must be based on industry standards and best practices – a timely response with a limited latency can be very important in certain sectors (e.g. IoT systems, connected mobility, and industrial monitoring).

Conclusion 

• In short, the European Commission’s emphasizes that the Data Act (requests) should be considered as an additional layer on top of the GDPR (requests). Although the GDPR should still be complied with where necessary and can sometimes limit Data Act requirements because sharing personal data always requires a valid legal basis, it should not act as a default escape hatch to the Data Act requests. 
• Finally, data holders get more concrete guidance on how they can adhere to the technical and practical requirements concerning data sharing (e.g. sharing data of high-quality in a commonly-used format, in a secure and timely manner, with potential latency kept to a minimum and through a convenient interface). 

Also read our other blogpost on the recent update of the European Commission’s FAQ on the Data Act and, in particular, on the unfairness control under Article 13 here: Data Act FAQ updated - European Commission clarifies how the Data Act’s unfairness control applies to mixed contracts | Timelex. 

Should you need any assistance with the implementation of the Data Act in your organisation, do not hesitate to contact our Timelex team. Our specialized data lawyers are closely monitoring this matter and always aiming for a pragmatic approach.