THE EU DATA ACT: WHAT ITS APPLICATION MEANS FOR ORGANISATIONS

REBALANCING DATA RIGHTS IN THE EU 

The EU Data Act entered into force on 11 January 2024 and is applicable since 12 September 2025. It introduces a broad framework that affects any organisation that (i) places physical products on the EU market that collect or generate data and can communicate it (connected products), (ii) provides digital services linked to those products (related services), or (iii) offers cloud or other data processing services used within the EU. The Act gives users meaningful rights to the data generated through their use of connected products or related services, whether that data is personal or non-personal, and addresses gaps where such data was previously unregulated. Its objective is to ensure that the benefits of product and service data are shared more fairly and that users have clarity and control over how this data can be accessed and used. 

Beyond this, the Act places obligations on cloud and edge service providers to support switching, improve interoperability and remove barriers that lock customers into a single service. Public sector bodies can request access to certain privately held data in exceptional situations, subject to strict safeguards and compensation rules. The Act also requires that commercially sensitive information, including trade secrets, is protected when data is shared, and that personal data continues to benefit from the full protection of the GDPR. While most obligations apply from 12 September 2025, some elements will take effect in stages. Product design and direct access requirements apply from 12 September 2026 for new products placed on the market, and certain contractual restrictions apply from 12 September 2027 for B2B contracts that are of indefinite duration or that continue beyond 11 January 2034. 

WHO DOES THE DATA ACT APPLY TO? 

The Data Act applies broadly across industries and value chains. Your organisation may fall within its scope if it: 

• Designs, manufactures or sells connected products, such as industrial machinery, smart vehicles, medical devices or consumer appliances that collect data through embedded sensors or software 
• Provides related (digital) services capable of influencing a product’s operation, including remote diagnostics, usage tracking or analytics platforms 
• Receives or seeks access to such data as a third party designated by the user (for example after-market service operators, component manufacturers, repair firms or research institutions) 
• Offers cloud, edge or other data processing services (including hybrid or on-premise infrastructure) 

The Act also applies to users, i.e., natural or legal persons who own a connected product, to whom temporary rights to use such product have been contractually transferred (for example by rental or lease), or who receive related services. It also includes organisations acting as data holders, meaning entities that have obtained and control data generated through the use of a connected product or related service in a lawful way, such as by supplying the product, providing the related service or storing or processing the data as part of their role. Importantly, the Act applies across B2B, B2C and B2G contexts and applies extraterritorially to non-EU companies that place connected products or related services on the EU market, or that become data holders or data recipients in relation to products or services used in the EU. 

WHAT KIND OF DATA IS COVERED? 

The Act governs data that is generated during the use of connected products or related services. This includes: 

• Sensor-based data, telemetry, usage logs and environmental inputs; 
• Data resulting from interactions with digital services tied to the connected product; 
• Both personal and non-personal data, with the caveat that where personal data is involved, obligations must be interpreted alongside the GDPR and ePrivacy rules. 

The Act draws an important distinction between data “provided by the user” (e.g., uploaded files or inputs) and data “generated through the use” of a connected product or related service such as performance data from an automated packaging machine, usage logs from a connected insulin injector, or cycling patterns from a smart home trainer. Only the latter is in scope, provided it is “readily available” to the data holder without disproportionate effort. 

The Act does not require data holders to provide access to data that the user can already access directly through the product or its interface. The rights under the Data Act arise only where the user does not otherwise have access to the data and the data holder has exclusive control over it. 

The Act applies only to product and related service data that is in digital form and does not cover analogue data. The scope also hinges on a key distinction between “connected products” and “related services”. A connected product refers to any tangible item that collects or generates data about its use or environment and can communicate that data, (e.g. a smart household appliance, a robotic welding arm or a piece of industrial equipment fitted with sensors). A related service is a digital service that is bidirectionally linked to the product, meaning it sends and receives data and directly affects how the product functions (e.g., an app that adjusts temperature levels in a smart thermostat, or software that remotely modifies dosage parameters on a medical device). Services that only analyse data without affecting how the product operates, such as standalone analytics tools, fall outside scope. 

Additionally, data that does not constitute product data or related service data also falls outside the Act’s scope. This includes data that is derived, inferred or created through significant processing, enrichment or analysis, such as predictive scores, behavioural insights or analytics dashboards, unless these outputs form part of the raw data that the data holder already obtains without disproportionate effort. Trade secrets and intellectual property are also out of scope unless appropriate safeguards are in place to protect them when access is required. Where datasets contain both personal and non-personal data, organisations must ensure layered compliance and rely on a valid legal basis under the GDPR for any sharing of personal data. 

WHAT ARE THE KEY OBLIGATIONS? 

(a) Data Access Rights for Users 

Users, whether individuals or organisations, must be granted access to the data generated through their use of a connected product or related service. This access must be provided free of charge and in a structured, commonly used, machine readable format. The right applies only where the data is not already directly accessible through the product or service interface. Data holders must implement simple and secure processes for enabling access, and products must be designed with the technical features needed to support this, for example user accounts or APIs. Access must be provided without undue delay and in real time where technically feasible. 

(b) Data Sharing with Data Recipients 

Where a user requests it, the data holder must make the data available to a data recipient designated by the user. This obligation applies even where the recipient is a competitor of the data holder or an independent service provider. Examples include an industrial operator choosing to share machine performance data with a predictive maintenance provider, or an individual sharing data from a connected medical device with a digital health service. The data holder must enable this sharing, subject to appropriate confidentiality and security safeguards. 

Data must be provided under fair, reasonable and non-discriminatory (FRAND) terms. In B2B contexts, a data holder may charge only the actual and reasonable costs of making the data available. SMEs and non-profits may only be charged at cost. Users must be able to authorise third party access without additional approval steps, and data holders cannot make the use of a product or service conditional on broader data use permissions. 

A written contract is required between the data holder and the data recipient, setting out the permitted uses, safeguards and limits on onward sharing. Data recipients are prohibited from using the data to develop competing products or from sharing it with gatekeepers unless expressly permitted. Where a data recipient breaches these obligations, enforcement measures may include notifying the user, requiring deletion or, in serious cases, deactivating functions, but access cannot be completely denied. 

To support organisations in meeting these contractual requirements, the European Commission published a Recommendation on 19 November 2025 containing non-binding Model Contractual Terms for data access and use. Their use is voluntary and are intended to help organisations, especially SMEs, implement the Data Act’s data sharing obligations in a consistent and legally robust way. 

(c) Prohibition of Unfair Contract Terms 

In B2B contracts where there is a significant imbalance in bargaining power, the Act prohibits contract terms that restrict data access or impose one sided liability. Any such term will be considered non-binding. These rules apply to any B2B contract where data is the subject matter, not only to agreements involving product or related service data. This means the unfair contract term provisions may also affect wider data arrangements, such as NDAs, data sharing agreements, licensing terms or analytics contracts, wherever they concern the use or availability of data. For example, a smaller supplier that integrates components into a larger OEM’s smart product cannot be forced to waive its right to access product usage data that it helped generate. Existing contract templates will need to be reviewed to reflect this principle. A black-list and grey-list of terms presumed to be unfair are included in the Act, covering clauses that unilaterally limit access to data, impose unfair liabilities or restrict dispute resolution rights. 

(d) Switching and Interoperability 

Obligations for Data Processing Services Providers of data processing services, including cloud and edge services, must take steps to eliminate barriers that prevent customers from switching to alternative providers, to on premises systems or to multi provider arrangements. They must ensure service continuity and functional equivalence after switching, remove unjustified technical or contractual restrictions and meet detailed requirements relating to portability and interoperability. These obligations are intended to reduce vendor lock in and support greater competition in digital infrastructure markets. 

The Commission has published non-binding Standard Contractual Clauses for cloud computing contracts to support implementation of the cloud switching framework. These clauses contain contract-ready provisions on switching and exit, termination and security and business continuity during the switching process, together with additional clauses that promote transparent and balanced contractual terms. Although voluntary, they offer a practical tool for organisations seeking to align their cloud contracts with the requirements of the Data Act. 

(e) B2G Data Sharing 

In limited and clearly defined exceptional situations, such as public health emergencies, natural disasters or risks to critical infrastructure, public sector bodies may request access to certain data held by private companies. Any such request must be strictly necessary, proportionate and limited to circumstances where the required data cannot reasonably be obtained by other means. Where providing access imposes costs, the organisation must be compensated. Safeguards apply to protect confidentiality and commercially sensitive information, and public authorities must avoid making repeated requests for the same data when it is already available. Public disclosure of the data is allowed only where strictly required. 

ENFORCEMENT AND PENALTIES 

Organisations should also be aware that the Data Act introduces an enforcement system that allows national authorities to take action when its rules are breached. Depending on the nature and severity of the infringement, authorities may issue corrective measures such as formal warnings, binding instructions or restrictions on certain processing activities. Financial penalties are also possible. These are calculated with reference to the organisation’s turnover and will be set by each Member State within the limits established by the Act. As a result, the level of sanctions may differ across the EU, but the overall aim is to ensure that non-compliance carries a meaningful and proportionate consequence. 

WHAT LEGAL AND OPERATIONAL STEPS SHOULD COMPANIES TAKE NOW? 

The Data Act is a major step in rebalancing control over data within the EU and in fostering a more competitive, interoperable and fair data driven economy. For many organisations, this already means adapting long standing practices around how data is collected, governed and shared, particularly where that data is generated by users but held by manufacturers or service providers. 

The Act introduces a broad set of responsibilities that require careful legal interpretation, alignment between technical and commercial teams and sustained investment in governance and infrastructure. 

With the Data Act now being applicable, organisations should be actively progressing their compliance programmes. Those still at an early stage will need to accelerate preparation to reduce the risk of non-compliance and operational disruption, especially as users are now entitled to submit data access requests under the Act. It is also important to remember that certain obligations, such as product design requirements and some contractual restrictions, will apply in phases through 2026 and 2027. 

Key steps include: 

• Data and services mapping: Identify all connected products, related services and business operations that generate, collect or use in scope data. This should include mapping data flows to determine where product or service data falls within the Act’s scope and how it can be accessed or retrieved. 
• Clarify internal responsibilities: Determine whether your organisation acts as a manufacturer of a connected product, provider of a related service, data holder, user, data recipient or provider of a data processing service and allocate responsibilities accordingly.
• Contractual and transparency review: Examine existing contracts, particularly in B2B relationships, to identify potentially unfair terms and ensure they comply with the Act’s requirements on fairness, transparency and data access. Update customer facing materials such as terms and conditions, product descriptions and service information to explain the type of data generated, how it can be accessed, where it is stored, how long it is retained and who acts as the data holder. Organisations may also wish to consider the non-binding Model Contractual Terms for data access and use and the non-binding Standard Contractual Clauses for cloud computing contracts published by the European Commission on 19 November 2025, which offer optional templates to support compliant drafting. 
• Technical readiness: Build or refine technical systems, for example APIs, dashboards and authentication processes, that enable seamless access to data for users and their authorised third parties. Manufacturers and service providers should ensure that new products placed on the market from September 2026 support direct, real time access in commonly used, machine readable formats with appropriate metadata. 
• Safeguard sensitive data: Implement measures to protect trade secrets, proprietary information and personal data, particularly where data sharing obligations may expose business critical information. Any exceptions for safety, cybersecurity or intellectual property must be contractually justified and, in some cases, notified to the competent authority. 

Compliance with the Data Act will not operate in isolation. Its provisions must be interpreted alongside other digital laws and sector specific frameworks. Coordinated legal oversight will be essential for: 

• addressing datasets that contain both personal and non-personal data; 
• drafting balanced, enforceable agreements across complex data value chains; 
•  protecting intellectual property and trade secrets during mandatory data sharing; 
• ensuring that transparency and fairness obligations are met in both B2C and B2B relationships; and 
• developing consistent governance across business units. 

Those that take a structured, legally informed approach will be better positioned to manage risk and to take advantage of the commercial opportunities created by the new data landscape. 

LOOKING AHEAD: POSSIBLE UPDATES TO THE DATA ACT 

Looking ahead, organisations should also be aware that on 19 November 2025 the European Commission published the Proposal for the Digital Omnibus Regulation. The proposal was introduced to streamline and consolidate elements of the EU’s digital regulatory framework, remove inconsistencies between existing instruments and improve legal certainty for businesses and public authorities. The proposal, amongst other things, includes targeted amendments to the Data Act, such as clarifying when data holders may refuse access where there is a substantial risk to trade secrets, narrowing the current business to government access framework so that mandatory sharing applies only in defined public emergency situations, deleting the existing smart contract requirements and introducing a lighter switching regime for certain custom-made or SME provided data processing services. It also proposes merging the Free Flow of Non Personal Data Regulation, the Data Governance Act and the Open Data Directive into the Data Act. These amendments are only proposals at this stage and will be subject to the full EU legislative process, so the content may change. Accordingly, organisations should monitor developments, as the final Digital Omnibus Regulation, once adopted, may modify or refine some of the obligations described here.