Docs

Regulations

Data Act

Data Act — A practical guide for developers and businesses 🛠️

The Data Act starts from an uncomfortable but practical question: the data your product generates — who owns it? The EU’s answer is that whoever generates it (the user) must be able to use, share and carry it. Everything else is monetisation, not ownership.

What it is and why it matters 🔍

Regulation (EU) 2023/2854 — commonly called the Data Act — is the pillar of the European data economy. It completes the European Data Strategy alongside the Data Governance Act (Regulation 2022/868, on data intermediation services) and the Open Data Directive (2019/1024).

Adopted on 13 December 2023 in Strasbourg, published in the Official Journal on 22 December 2023 (OJ L 2023/2854). It is a regulation: directly applicable with no transposition. In force since 11 January 2024 (20 days after publication), it applies from 12 September 2025 — with transition rules for products, contracts and cloud (see Timeline and deadlines).

The political idea is simple: the data produced by using a connected object belongs to whoever uses that object, not (only) to whoever makes it. That strips manufacturers of their “gatekeeper” role and creates a market of services built on that data.

The Data Act does not regulate “data in the abstract”: it regulates who can access it, on what terms, in what circumstances. User access, third-party sharing, cloud switching, public-sector requests in emergencies: four rights with four different engines.

Who it applies to 🎯

What is a “connected product” 📦

Definition (Art. 2.5): a good that obtains, generates or collects data concerning its use or environment and is able to communicate product data through an electronic communication service, a physical connection or on-device access — and whose primary function is not the storage, processing or transmission of data on behalf of third parties.

In practice: a car, a smart appliance, an IoT device, a production machine, a sensor. Related services (the app or cloud that manages the object) and virtual assistants (Art. 1.4) are in scope on the same footing when they interact with the product or service. Purely cloud services stay out (“infrastructure on behalf of third parties” is precisely their primary function).

The people involved 👤

User (Art. 2.12): whoever owns a connected product, has contractual temporary-use rights, or receives a related service — may be a natural person (including a consumer) or a legal person;
Data holder (Art. 2.13): whoever has the right or obligation to use and make available the data — typically the manufacturer, but it may be a third party;
Data recipient (Art. 2.14): whoever receives the data, at the user’s request or under a legal obligation;
Data processing service provider: the cloud/IaaS/PaaS providers;
Public bodies, the Commission, the ECB and EU bodies: when acting on exceptional needs.

Scope and applicable law ⚖️

The Data Act covers personal and non-personal data. In case of conflict with the GDPR or the ePrivacy rules, the GDPR prevails (Art. 1.5): the Data Act complements the GDPR access and portability rights (Arts. 15 and 20), it does not replace them.

Practical rule: if the data is personal, the GDPR legal bases remain the entry point. The Data Act does not authorise processing personal data without a legal basis: it sets the conditions for sharing and its limits.

Main exclusions and safeguards ⛔

Voluntary data-sharing agreements (Art. 1.6): remain free;
National security, defence, prevention and prosecution of crime, customs and tax administration (Arts. 1.6 and 16.2);
Connected products of micro and small companies (Art. 7.1): the B2B/B2C sharing obligations of Chapter II do not apply to data generated by micro/small enterprise products (except for associated/linked non-micro companies);
DMA gatekeepers (Art. 5.3): cannot be third-party recipients at the user’s request, nor solicit incentives to obtain the data;
The sui generis right on databases (Directive 96/9/EC, Art. 43): does not extend to data generated by connected products.

Chapter II — The data your product generates is yours 🔓

This is the core: the user’s right to product data and related-service data.

Access and sharing with third parties (Arts. 3-6) 🚪

Design: connected products and related services must be designed and manufactured so that data (and the metadata to interpret it) is accessible to the user by default, in an easy, secure, free, complete, structured, commonly used and machine-readable format (Art. 3.1);
Direct access or on request (Art. 4): if direct access is not possible, the data holder makes the data available upon simple request (preferably by electronic means), with the same quality it holds itself, without undue delay and free of charge;
Sharing with third parties (Art. 5): at the user’s request, the data holder makes readily available data available to third parties, with the same quality, free of charge for the user;
Third-party obligations (Art. 6): process data only for agreed purposes and conditions, no profiling (with exceptions), no onward sharing, no development of competing products to the one the data comes from, no transfer to gatekeepers;
Security limits (Art. 4.2): access and use may be contractually limited if the processing would compromise the product’s safety requirements (e.g. risk to people’s health);
Trade secrets (Arts. 4.6-4.8 and 5.9-5.11): trade secrets are protected — the data holder can agree technical/organisational measures, block or suspend sharing, or refuse it in exceptional cases by demonstrating serious economic harm. Not a convenience exception: the request must be justified in writing.

Key point: the third party receiving the data cannot build a clone of the product it comes from. The Data Act opens the data, not the product market. Using the data to copy the product breaches the rule (Art. 6.2(e)).

Micro and small enterprise exemption (Art. 7) 🛡️

The Chapter II sharing obligations do not apply to data from micro and small enterprise products (except for associated/linked larger companies). This holds only when the micro/small firm is not a subcontractor manufacturing/designing the product. Consumer protection is unchanged: contract clauses waiving user rights are not binding (Art. 7.2).

Chapter IV — Fair contracts, no abusive clauses ⚖️

Chapter IV governs abusive contract clauses between businesses for data access and use (Art. 13).

A clause imposed unilaterally that deviates considerably from good commercial practices is abusive and non-binding;
Clauses presumed abusive: excluding liability for intent/gross negligence, preventing the other party from using its own data, allowing termination with unreasonably short notice, or allowing price increases without a valid reason;
The burden of proving a clause was not unilaterally imposed lies on the party that inserted it;
If the abusive clause is severable, the rest of the contract remains valid.

Practice: if you are a vendor whose enterprise contract is a take-it-or-leave-it boilerplate, here is your biggest problem. The Data Act assumes a non-negotiated clause is imposed.

Chapter V — Data for the State, only in emergencies 🚨

Chapter V regulates making data available to public bodies, the Commission, the ECB and EU bodies on grounds of exceptional needs (Arts. 14-22).

Two cases:

Public emergency (Art. 15.1(a)): needed to respond to emergencies (public health, natural disasters, serious cybersecurity incidents). Data is provided free of charge (Art. 20.1) by holders that are not micro/small businesses;
Specific task in the public interest (Art. 15.1(b)): non-personal data only, when an alternative basis is missing (market purchase, other legal duties). A fair compensation applies (costs + reasonable margin, Art. 20.2). Micro and small companies are exempt.

The resulting duties (Art. 19): use limited to the stated purpose, deletion once no longer needed, confidentiality measures, no development of competing products to the data holder’s, accountability for data security. The request must be written, specific, proportionate and published online by the data coordinator. Refusals and disputes go through the competent authorities.

Chapter V is the most criticised: companies fear “data requisitions”. The regulation is built as an exception: demonstrated need, specific purpose, free only in emergencies (with public recognition), compensation otherwise. Not an all-you-can-eat menu.

Chapter VI — Cloud portability, the end of lock-in ☁️

For anyone running cloud infrastructure, this chapter bites hardest. Goals: remove the obstacles to switching between providers and to on-premises, with contractual transparency.

Provider obligations (Arts. 23-31) 🧱

No obstacles: pre-commercial, contractual, technical or organisational hurdles preventing customers from terminating the contract, switching to a competitor, transferring exportable data and digital assets (Art. 23);
Mandatory written contract with switching clauses: maximum 2 months notice, maximum 30-day transition period (extensible up to 7 months in case of technical impossibility), disclosure of data categories, minimum 30-day data recovery period, full deletion at the end (Art. 25);
Assistance and good faith during the switching process, without operational disruption (Arts. 25.2, 27);
Transparency on service, early-termination and switching fees (Art. 29.4-29.6);
Functional equivalence: the new provider must allow restoring a minimum level of functionality (Art. 30);
Online register of data structures and formats (Art. 26).

The end of egress fees 💸

The piece with the strongest commercial impact (Art. 29):

Until 11 January 2024: full switching fees;
From 11 January 2024 to 12 January 2027: reduced switching fees (only directly connected costs);
From 12 January 2027: switching fees abolished, period.

“Egress-free cloud” is no longer a commercial choice: from 12 January 2027 it is the law. Anyone running cloud infrastructure must redesign the revenue model that lived on exits.

Safeguards against international government access (Chapter VII, Art. 32) 🛂

Cloud providers must take measures to prevent international government access to non-personal data held in the EU when it would conflict with EU law. Third-country government requests are recognised only if based on international agreements (e.g. mutual legal assistance treaties) or if they meet strict proportionality and review conditions. Providers must inform the customer about access requests (Art. 32.5).

Chapter VIII — Interoperability and smart contracts 🔗

European common data spaces (Art. 33): essential interoperability requirements — describe content, use restrictions, collection methodology and data quality in machine-readable format; accessible data structures/formats/vocabularies; APIs and usage conditions; interoperability for the automated execution of data-sharing agreements;
Multi-vendor cloud (Arts. 34-35): interoperability for parallel use and open interoperability specifications (transport, syntactic, semantic, behavioural);
Smart contracts (Art. 36): whoever sells or implements smart-contract applications for data-sharing agreements must ensure: robustness and access control, safe termination and interruption mechanisms, data archiving and continuity (verifiability), protection through strict access control and consistency with the agreement’s clauses. A conformity assessment with an EU declaration of conformity is mandatory.

Impact for businesses 🏢

If you make connected products, handle IoT data or offer cloud services, the path is:

Data inventory: what data each product/related service generates, in what format and quality;
Design for access: make data accessible by default in machine-readable format (API, export);
Request-response process: user access, third-party sharing, public requests (timing, quality, refusal cases);
Review contracts: remove abusive clauses, add FRAND conditions (trade secrets, limits, liability);
Cloud: remove switching obstacles, contracts with transition clauses (30 days, extension up to 7 months), abolish egress fees by 2027;
Procedures for public access: exceptional-need criteria, compensation, deletion;
Smart contracts: conformity assessment for applications executing data-sharing agreements;
Legal representative in the EU for out-of-EU players (Art. 37.11).

Penalties (Art. 40): for Chapters II, III and V the GDPR supervisory authorities may impose fines under Art. 83 GDPR (up to €20M or 4% of worldwide turnover). For the rest, member states set effective, proportionate and dissuasive penalties — notified to the Commission by 12 September 2025. The Data Act sets no EU amounts: the teeth are left to member states.

Timeline and deadlines 📆

Date	What applies
11 January 2024	Entry into force (20 days after publication on 22.12.2023)
11 January 2024	Start of the reduced switching-fee period
12 September 2025	Full application of the regulation
After 12 September 2025	Chapter III: only for data-sharing obligations under EU law that enter into force after that date
12 September 2025	Chapter IV: applies to new contracts; for pre-existing contracts from 12 September 2027 (if open-ended or expiring ≥10 years after 11/1/2024)
12 September 2026	Art. 3.1 (default accessibility of product data): applies to products placed on the market after that date
12 January 2027	Abolition of cloud switching fees
12 September 2025	National penalties notified to the Commission
12 September 2028	First review of the regulation by the Commission

Compliance checklist ✅

A pragmatic checklist for developers and businesses.

Connected product

Product and related-service data accessible by default, free, machine-readable
Pre-contract information: type/estimated volume of data, access means, retention
Response process for access requests (simple electronic request)
GDPR compliance if personal data is involved
Trade-secret protection for shared data (agreed measures, refusal cases)

Third-party sharing

Procedures for user-requested sharing
Third-party duties: agreed purposes, no profiling/onward sharing, no product clones
No sharing with DMA gatekeepers
Micro/small exemption verified (if applicable)

Cloud and switching

Written contract with switching clauses (notice ≤2 months, transition ≤30 days)
Assistance, operational continuity and good faith during switching
Egress fee: reduced until 12/1/2027, abolished after
Jurisdiction disclosure and anti-government-access measures (Art. 28)

Public-sector access

Procedures for emergency requests (free) and public-interest tasks (compensation)
Data deletion when no longer needed; no competing use

Contracts and interoperability

No abusive clauses (unilaterally imposed = presumed abusive)
Smart contracts compliant (robustness, safe termination, archiving, consistency) + EU declaration of conformity
APIs and metadata for data-space interoperability

Useful links 🔗

Data Act text (EUR-Lex) — Regulation (EU) 2023/2854
European Commission — European Data Strategy — The policy context
Data Governance Act — The twin regulation on data intermediation
EDIB — European Data Innovation Board — The Data Act advisory body
CSIRT / Italian national cybersecurity agency — Authorities and points of contact in Italy