EU Data Act: Actions for Employers.

8 min read

Last updated October 19, 2026

The EU Data Act has applied across the European Union since September 12, 2025, with some provisions taking effect later in 2027. The Act establishes rules on access to data from connected products, data sharing and switching between covered cloud and other data processing services.

Learn how it strengthens access to connected product data, facilitates switching between cloud providers and permits public authorities to request privately held data in defined situations of exceptional need.

This article is for management, HR, IT and procurement teams responsible for workplace technology and supplier contracts. It sets out a practical sequence. The Data Act does not require every employer to rewrite every policy or give employees access to all company data. The starting point is the product, service and organisation’s role.

AT A GLANCE

What Is the EU Data Act?

The EU Data Act (Regulation (EU) 2023/2854) creates a legal framework that ensures fair access to, and use of data generated by connected devices and related services.

The Act gives qualifying users, including individuals and organisations that own, rent or lease connected products, rights to access and share certain data generated by those products and related services. These rights are subject to safeguards concerning personal data, trade secrets and security.

The EU Data Act has applied across the European Union since September 12, 2025, with some provisions taking effect later in 2027.

Why the EU Data Act Matters

1. User Control and Data Sharing Rights

Users gain the right to access and share data from their IoT-enabled products (e.g., connected vehicles, smart home devices) with third parties, such as service centres or analytics providers

2. Emergency Data Access for Public Authorities

In emergencies, like natural disasters or cyberattacks, public authorities may access privately held data to ensure public safety and crisis response

3. Facilitating Switching of Cloud Services that Drives Competition

Providers of covered cloud and other data processing services must remove obstacles to switching providers or using several services simultaneously. Until 12 January 12, 2027, switching charges must not exceed the costs directly associated with switching. From that date, switching charges, including relevant data egress charges, are prohibited. This does not automatically eliminate ordinary service charges or early termination penalties

4. Promoting Clear Contractual Terms

The regulation protects businesses against certain unfair contractual terms concerning data access and use, liability and remedies where those terms are unilaterally imposed by another business. It also introduces contractual transparency requirements for covered data processing services.

Legal & Business Implications for EU Members States

Under the EU Data Act, depending on their role and the products or services concerned, businesses operating in EU must:

Review and revise contracts involving IoT and cloud data to comply with access, portability, and interoperability obligations.
Implement secure and efficient data-sharing frameworks for users and third parties.
Ensure compliance with GDPR and related national laws on data protection.
Prepare for potential regulatory enforcement and penalties for non-compliance.

Who Should Take the Initiative

Management should assign responsibility for the review. IT and procurement can identify products, service contracts and data access arrangements. HR should examine employee implications, with privacy or legal specialists assessing personal data and applicable duties.

Employees can raise questions and exercise applicable personal data rights, but they do not need to initiate the organisation’s Data Act review. The employer remains responsible for its own processing and workplace decisions.

The EU Data Act marks a significant shift toward user-centric data governance, promoting fairness, transparency, and market dynamism in the data economy. Most provisions apply from September 12, 2025, with some provisions taking effect later in 2027. Preparing early ensures that the business:

Is compliant with new data access and sharing obligations.
Avoids contractual pitfalls with suppliers and cloud providers.
Handles employee data responsibly and transparently.
Has procedures for assessing and responding to legally valid data requests.

Actions for Employers, HR and IT

Step 1. Data Mapping & Audit

It is key to identify all devices, products, and services used in the organisation in the Netherlands that generate data (e.g., company vehicles, machinery, IoT devices, smart office tools).
Map the data generated, its storage locations, the parties holding it and the applicable access and use rights. Distinguish personal data from non-personal data.

Step 2. Contractual Agreements Review

Review all contracts with cloud service providers to:

Ensure they allow data portability and interoperability.
Confirm timelines and costs for switching providers.

Update terms with IoT device suppliers and service providers to reflect the new data access and sharing framework.

Step 3. Confirm the Organisation Role

Determine whether the company is a product user, customer of a data processing service, data holder, recipient or provider. A business using a connected machine has different responsibilities from one manufacturing it. Selling services to a regulated company does not automatically make the supplier a data holder under the Data Act.

For an international group, identify the contracting entity and the local operation using the equipment. A headquarters contract may govern access or switching, while the Dutch employer retains its own employee privacy and representation obligations. Central procurement approval does not settle every local requirement.

Step 4. Review Data Access

Procurement and IT should ask suppliers which covered data are available, how to request them and how third party sharing works. Check formats, access controls, metadata and the information provided before contracting. Privacy specialists should examine whether the proposed data include information identifying employees.

Review any limitations on access or sharing against the applicable rules. Record trade secret protections and the intended use of the data. Obtain clarification when a supplier refers generally to proprietary data without distinguishing product data from derived analyses.

Step 5. Assess Employee Data Before New Uses

HR and the privacy function should identify the purpose, legal basis, recipients and retention for any personal data involved. Examine whether access creates new monitoring or assessment capabilities. Consider a data protection impact assessment where the proposed processing is likely to create a high risk under GDPR.

For example, vehicle operating data used for maintenance may be linked to a named driver. Assess that personal information before sharing it with a maintenance supplier or using it in performance assessment. Data Act access and permission for the proposed employee use are separate questions.

Maintain a clear route for employee GDPR requests. Do not describe every request about a laptop, phone or company vehicle as a Data Act request. Identify the right being exercised and respond through the appropriate process.

Step 6. Check the Cloud Exit Process

For covered services, review the switching notice, assistance, exportable data and digital assets, retrieval arrangements and deletion process. Ask for the applicable charges to be identified separately. From January 12, 2027, switching charges are prohibited under Article 29 of the EU Data Act; the migration budget should still distinguish internal work, new provider fees and other contractual charges.

Step 7. Identify Relevant Products and Services

IT and procurement should list connected vehicles, machinery, energy systems and other relevant equipment, alongside cloud and software services. Record who owns or leases the product, who contracts for the service, the supplier and the data generated. Separate product data access from cloud switching requirements.

Prioritise arrangements where data are difficult to obtain or changing supplier would disrupt operations. Do not begin by classifying every device or application as covered. Check each definition and relevant exception.

Step 8. Policy Development or Update

Review HR and IT policies where employer-provided connected products generate data covered by the Act, for example connected company vehicles. Identify who qualifies as the user and explain the applicable access and sharing procedures.

Employees do not automatically acquire Data Act rights merely because they use an employer-provided device. The Act does not provide a general right to access files, messages or other content stored on laptops or phones. Employee rights concerning personal data remain governed by the GDPR.

Draft or update internal policies on:

Handling data access requests from qualifying users and authorised third parties, while assessing any separate employee rights under the GDPR.
Processes for government authority requests in emergencies.

Step 9. Works Council Consultation

Engage with the Works Council, for example in the Netherlands, as early as possible where implementation affects employee-related arrangements.

The employer should assess the proposed workplace arrangement before implementation. Article 27 WOR can require prior consent for establishing, changing or withdrawing arrangements concerning employee personal data or systems directed at or suitable for monitoring attendance, behaviour or performance. Review the statutory conditions and exceptions.

An important technology or organisational decision may separately require advice under Article 25. The Data Act does not itself create a general Works Council Netherlands consent requirement. The actual decision and arrangement determine the procedure.

Management should explain the purpose, employee data, permitted uses, recipients and safeguards in understandable terms. The Works Council could request relevant information and raise concerns about monitoring or access. Its consent does not replace GDPR compliance.

Frequently Asked Questions

Does the Employer Need a Separate Data Act Programme?

Not necessarily. A proportionate review can be integrated into procurement, IT governance and privacy processes. Providers and manufacturers may need a more extensive compliance programme.

Should HR Lead Every Part of the Review?

No. HR should lead employee implications, while IT and procurement handle technical and supplier matters. Management should ensure responsibilities connect and specialist assessments are obtained where needed.