EU Data Act
REGULATION ON FAIR ACCESS TO AND USE OF DATA
The EU's horizontal framework for who can access and use data generated by connected products and related services. Applicable from 12 September 2025, the Data Act establishes user data access rights, B2B data sharing obligations on FRAND terms, cloud switching rules, smart contract requirements, and safeguards against unlawful third-country government data access.
Every time you use a smart thermostat, drive a connected car, or operate an industrial machine, that device generates data. Until now, the manufacturer who built the device typically kept that data for themselves -- even though your use of the product created it. The EU Data Act changes who gets to access and use that data.
Starting 12 September 2025, users of connected products have the right to access the data their devices generate, free of charge and in real time where technically feasible. Users can also request that the manufacturer share that data with a third party of their choice -- for example, an independent repair shop or a competing service provider. The manufacturer must comply, on fair and reasonable terms, and cannot charge more than the cost of making the data available.
The law also tackles cloud lock-in. Cloud and edge service providers must support customers who want to switch providers or run multi-cloud setups. Switching must be completed within 45 days, and from January 2027, providers cannot charge any switching fees at all. Smart contracts used for automated data sharing must include safety mechanisms like kill switches and audit trails.
For businesses, the practical impact depends on your role. If you manufacture connected products, you need to redesign them for data access by default. If you are a cloud provider, you must update contracts and eliminate switching barriers. If you are a smaller company that depends on data from a larger partner, you gain new leverage: unfair terms in data-sharing contracts can be challenged and voided. The Data Act does not replace the GDPR -- where personal data is involved, both sets of rules apply in parallel.
The Data Act creates a structured flow for accessing data generated by connected products. Each step has specific legal requirements and timeframes.
IoT device, smart appliance, or industrial machine generates data through normal use. Data includes both raw sensor data and data derived by the related service.
Product must be designed so the user can access data directly, free of charge, continuously, and in real time where technically feasible. Pre-contractual information about data types and access methods must be provided.
User requests the data holder to share data with a named third party. Request may be made electronically. Data holder must comply without undue delay, at the same quality as available to the data holder.
Data holder shares data with the third party on FRAND terms. Compensation limited to cost of making data available (plus reasonable margin). Trade secret protections may apply.
Recipient may only use data for the agreed purpose. Must not develop a competing connected product. Must not sub-license to a DMA gatekeeper. Must delete data when no longer needed.
The Data Act is organised into eleven chapters covering data access, sharing, fairness, public sector access, cloud switching, smart contracts, and enforcement.
The Data Act creates an interconnected web of rights and obligations across five stakeholder categories. Select a stakeholder to see their full position.
The Data Act imposes strict timelines on cloud service switching. From January 2027, all switching charges must be zero.
Customer notifies current cloud provider of intent to switch or use multi-cloud. Written notice triggers the switching process.
Provider acknowledges and begins transition planning. Provider must share all relevant technical information including data formats, schemas, APIs, and migration tooling.
Full data export in a commonly used, machine-readable format. Provider must assist with migration and ensure functional equivalence at the destination service. No degradation of service during transition.
Customer verifies data integrity and service functionality at the new provider. Original provider maintains service access during verification. Both environments run in parallel.
Customer confirms successful migration and terminates original contract. From 12 January 2027, no switching charges may be applied. Before that date, charges must be reduced progressively.
Smart contracts used for automated data sharing under the Data Act must meet essential requirements in Annex I. Vendors must self-certify conformity.
The Data Act introduces a fairness test for data-sharing contracts between businesses. Certain terms are blacklisted or grey-listed when unilaterally imposed on SMEs.
The Data Act uses a phased application model, with different provisions taking effect at different times between 2025 and 2028.