7 min read
Last updated
The EU Data Act has applied across the European Union since September 12, 2025, with some provisions taking effect later in 2027. It establishes rules on access to data from connected products, data sharing and switching between covered cloud and other data processing services.
From January 12, 2027, switching charges for covered cloud and other data processing services are prohibited. From September 12, 2027, rules against unfair business-to-business data contract terms also apply to certain older agreements.
This article explains the framework, its limits and its relationship with GDPR.
AT A GLANCE
What Is the EU Data Act 2025?
The EU Data Act (Regulation (EU) 2023/2854) creates a legal framework that ensures fair access to, and use of data generated by connected devices and related services.
It gives qualifying users, including individuals and organisations that own, rent or lease connected products, rights to access and share certain data generated by those products and related services. These rights are subject to safeguards concerning personal data, trade secrets and security.
Scope EU Data Act
The Act can affect manufacturers placing connected products on the EU market, providers of related services, users of those products, data holders and recipients, and providers of covered data processing services.
Some duties apply to providers established outside the EU when they serve the EU market. Each chapter has its own scope and exceptions.
A user can be an individual or an organisation that owns a connected product, holds contractual rights to use it, or receives a related service. Data holders are entities with the relevant right or obligation to use and make data available.
A company can have different roles across its activities. Specific exemptions and qualifications for smaller businesses must be assessed; small size is not a general exemption from the entire Act.
Why the EU Data Act?
The EU Data Act supports individuals and businesses obtain data from connected products and reduces barriers to changing cloud providers. It also establishes safeguards for data contracts and public authority requests.
1. User Control and Data Sharing Rights
Individuals and businesses that own, rent or lease connected products can access covered data generated through their use. They can also request that the data be shared with an eligible third party.
2. Emergency Data Access for Public Authorities
In emergencies, like natural disasters or cyberattacks, public authorities may access privately held data to ensure public safety and crisis response. These requests must meet strict legal conditions. An emergency does not give authorities unrestricted access to company records or employee information.
3. Easier Switching between Cloud Services
Providers of covered cloud and other data processing services must remove obstacles to switching providers or using several services simultaneously.
Until January 12, 2027, switching charges must not exceed the costs directly associated with switching. From that date, switching charges, including relevant data egress charges, are prohibited.
4. Promoting Clearer Contractual Terms
The Data Act protects businesses against certain unfair data-related terms imposed by another business without meaningful negotiation.
The regulation protects businesses against certain unfair contractual terms concerning data access and use, liability and remedies where those terms are unilaterally imposed by another business. It also introduces contractual transparency requirements for covered data processing services.
Data Access from Connected Products
Connected products collect data about their use or surroundings and can communicate those data. Examples include connected vehicles, industrial machinery and smart energy equipment.
Which Data Can Users Access?
Covered data can include measurements such as temperature, energy consumption, operating hours, speed or equipment faults. It can also include information needed to understand those measurements, such as timestamps and units.
The rules concern relevant raw and pre-processed data. They do not generally require suppliers to disclose every analysis, prediction or commercially developed insight.
User Access and Third Party Sharing
Users must receive access to covered data free of charge. If they cannot access the data directly, they can request the relevant readily available data from the data holder, usually the manufacturer or related service provider.
Users can also request sharing with an eligible third party. Separate rules may allow the data holder to charge that business recipient reasonable compensation.
Cloud Switching and Interoperability
The Data Act supports customers transfer covered data and digital assets when changing cloud or other data processing providers. It can apply to qualifying software services, including software accessed through an online subscription.
Providers must offer the support required for their type of service. This can include export facilities and interfaces that allow systems to exchange data.
Switching Charges
Before January 12, 2027, switching charges must not exceed costs directly linked to the switching process. From January 12, 2027, providers may no longer impose switching charges, including covered data egress charges. Data egress means transferring data out of the provider’s service.
The prohibition does not automatically remove ordinary subscription fees or early termination penalties. Customers should ask suppliers to identify each charge and explain its contractual and legal basis.
Fairness in Business Data Contracts
The Data Act addresses certain unfair terms that one business imposes on another concerning data access and use, or related liability and remedies.
These rules apply to contracts concluded after September 12, 2025. From September 12, 2027, they also apply to contracts concluded on or before September 12, 2025, if they have no fixed end date or are due to expire on or after January 11, 2034.
EU Data Act and GDPR
The Data Act applies alongside GDPR and does not create a general permission to process employee or customer personal data. Where the user requesting data is not the individual concerned, a valid GDPR legal basis is required for disclosure of personal data.
An employee’s GDPR right of access is separate from a product user’s Data Act rights. A company owning a connected vehicle may be the Data Act user, while the driver is a data subject in relation to identifiable journey information. The company’s access rights do not automatically permit employee monitoring.
Legal Development Dates
- January 11, 2024: Entry into force at EU level.
- September 12, 2025: General application of the Regulation, subject to its specific phased rules.
- After September 12, 2026: Design obligations apply to connected products and related services placed on the market after this date.
- January 12, 2027: Prohibition of switching charges under Article 29: Providers of covered cloud and other data processing services may no longer charge customers for the switching process, including covered data transfer charges.
- September 12, 2027 : Rules against unfair, unilaterally imposed business-to-business data contract terms will apply to contracts concluded on or before September 12, 2025.
EU Data Act: Enforcement in the Netherlands
The Dutch Data Regulation Implementing Act took effect on November 21, 2025. The Netherlands Authority for Consumers and Markets (ACM) supervises relevant connected product and cloud provider obligations.
The Dutch Data Protection Authority, AP, oversees provisions connected with GDPR and exceptional government data requests under the Dutch allocation of responsibilities. Businesses and users can raise complaints with the relevant authority.
Frequently Asked Questions
Does the Data Act Give Businesses Ownership of All Data?
No. It establishes specified access, use and sharing rights and duties. It does not create a general ownership right over all data.
Are All Cloud Exit Costs Prohibited?
No. The prohibition from January 12, 2027 concerns switching charges under the EU Data Act. Other fees and early termination terms must be assessed separately.
Does Every Employee Gain Access to Company Device Data?
No. Assess the covered product and who qualifies as its user. Employees may separately have GDPR rights concerning their personal data.
Is the EU Data Act the Same as the Data Governance Act?
No. The Data Act addresses access and use, among other matters. The Data Governance Act provides a different framework supporting specified data sharing arrangements.
