Data Act: your product generates data. Whose is it? 📦
There is a moment in every connected-object demo when the vendor smiles, opens the dashboard and shows “how much data we have already collected from our customers”. The Data Act is the polite but firm answer to that smile: most of that data is not yours. It belongs to the user, and now the law says so unmistakably.
Want the full picture? Who is a user and who is a data holder, the access and sharing rights, cloud portability, public-sector access and the deadlines are all in the practical guide: Data Act — A practical guide.
Yet another regulation that changes priorities 🧭
Regulation (EU) 2023/2854 entered into force on 11 January 2024 and applies from 12 September 2025. It is a regulation: no national transposition, identical obligations in Madrid, Milan or Munich. It completes the European Data Strategy, turning the vision of “a healthier data economy” into concrete rules a company cannot ignore.
The premise is almost philosophical: who creates the value? A manufacturer will say “I do — without me the object would not exist”. A user will say “I do — without my usage there is no data”. The EU chose the user, with an explicit corollary: the data generated by a connected product’s use is accessible to the person using the object, in a machine-readable format, by default.
The first leap: designing for access 🔧
The point that hits developers first is Art. 3.1: connected products and related services must be designed and manufactured so that product data, with the metadata needed to interpret it, is accessible to the user in an easy, secure, free, complete, structured, commonly used and machine-readable format.
Translation for people who write code: exporting data is no longer a consolation-prize feature. If your product generates data and keeps it, it will have to expose it — via API, USB or cloud — in a standard format, with the same quality you use internally. And if direct access is not possible, a simple request from the user must suffice: the data holder responds without undue delay and free of charge.
This is not only a design obligation: it is a seed for the multi-product ecosystem. If access is standard, anyone can build services on top of your data — and that “anyone” can be a competitor. That is why the same article protects the maker: whoever receives the data cannot develop a competing product to the one it comes from, and trade secrets remain protected with concrete measures.
The second leap: stop being the gatekeeper 🤝
The heart of the Data Act is Chapter II: the user’s data no longer belongs to them “de facto but not de jure”. The user can share their data with third parties (Art. 5), and the data holder must make it available with the same quality it holds itself, free of charge for the user.
The rules for recipients are clear (Art. 6): agreed purposes only, no surprise profiling, no onward sharing, no DMA gatekeepers as recipients, and the anti-clone rule already mentioned. Recipients delete the data when it is no longer needed.
And one detail that pleases small businesses: micro and small enterprises are exempt from the Chapter II sharing obligations for their products’ data. A craft sensor maker does not need to open a public API. A multinational does — and SMEs still must make sure contract clauses do not hollow out user rights.
The third leap: cloud portability written into law ☁️
The chapter that makes the most noise among infrastructure players is Chapter VI: the right to switch data processing service providers without obstacles.
Beyond the mandatory contract clauses (maximum 2 months notice, 30-day transition period, full deletion after recovery), there is the sharpest arrow: switching fees are reduced until 11 January 2024 and abolished from 12 January 2027. Data egress stops being a revenue model and becomes a duty.
Anyone running a cloud should read that twice: from 2027 you will not be able to monetise friction. Value moves to service quality, interoperability and open interfaces. Not a technical novelty: a change of economics.
There is also the often-forgotten Chapter V on public-sector access to data in exceptional needs: free in public emergencies (health, disasters, cybersecurity incidents), with fair compensation when the State asks for data for a public-interest task. As written, it avoids the “requisition” drift: demonstrated need, specific purpose, limited use, deletion.
The fourth leap: fair contracts, smarter contracts 🤖
The Data Act also brings order to business-to-business clauses (Chapter IV): a clause imposed unilaterally that deviates from good commercial practices is abusive and non-binding, with a list of presumptions of abuse — liability for intent excluded, unreasonable termination notice, price increases without reason.
And a concrete glimpse of the future: smart contracts used to execute data-sharing agreements must meet essential requirements (robustness, safe interruption mechanisms, archiving of data and logic, consistency with the agreement) and obtain an EU declaration of conformity. Not science fiction: just the same safety walls you demand from the rest of your stack.
Conclusion: data changes owner, and that is fine 🔑
The Data Act does not ban anything you did with data: it changes the starting point. That telemetry dossier sold to third parties without a clear clause? No longer “someone’s business model”: it is a possible entry ticket for competitors. API access at the bare minimum threshold? Will be the floor.
For people who write code and manage products, the lesson is one: design today for data access and portability, before someone asks you with a contract in hand. The Data Act is not an incoming fine: it is a market alternative where those who make data easy to use start ahead.
Want the operational details — who is bound, the four chapters, the exemptions and the deadlines? They are in the practical guide: Data Act — A practical guide.