Data Act

Home › IT law › Data Act

The EU Data Act (Regulation (EU) 2023/2854) governs who may use data from connected products, what data contracts between businesses may contain and how customers can switch cloud provider. We advise manufacturers, users and providers of data processing services on implementation and in disputes.

Data Act: key dates

The Regulation has applied directly in all Member States since 12 September 2025. Some obligations apply in stages:

Date	What applies
12.09.2025	General application: data access rights, information duties, Art. 13 for new contracts, Chapter VI (cloud switching)
12.09.2026	Design obligation under Art. 3(1) for connected products and related services placed on the market after this date
12.01.2027	Switching charges for cloud services abolished entirely (Art. 29(1))
12.09.2027	Art. 13 also for contracts concluded by 12.09.2025 that are open-ended or end no earlier than 11.01.2034

Access to data from connected products

Connected products are devices that generate and can transmit data about their use or environment: machinery, vehicles, smart home devices, medical and agricultural technology. Related services are digital services without which the product cannot perform one of its functions, such as a control app.

Users can require the data holder to make readily available product and service data, including metadata, available without undue delay, free of charge and in a common, machine-readable format (Art. 4). They can also require sharing with a third party, such as an independent maintenance provider (Art. 5). Gatekeepers under the Digital Markets Act are excluded as recipients. Users must be informed before contract conclusion about the type, volume and accessibility of the data (Art. 3(2) and (3)).

Obligations of data holders and manufacturers

For products placed on the market from 12 September 2026, Art. 3(1) requires access by design: users should be able to retrieve data directly from the device or via an interface where possible. Manufacturers need to adapt architecture, data model and documentation early.

The data holder may itself only use non-personal product data on the basis of a contract with the user (Art. 4(13)). If you analyse usage data for product development without an agreement, you need a data licence with your customer. Towards third parties, fair, reasonable and non-discriminatory terms apply (Art. 8); compensation from SMEs is limited to costs (Art. 9). Micro and small manufacturers are generally exempt from Chapter II (Art. 7).

Trade secrets

Trade secrets only have to be disclosed once protective measures have been agreed, such as confidentiality agreements, access logs or technical restrictions. Without agreement, or if the measures are breached, the data holder may withhold or suspend sharing. Refusal is only permitted exceptionally where serious economic damage is highly likely; it must be reasoned and notified to the competent authority (Art. 4(6) to (9)). Without documented confidentiality measures under the German Trade Secrets Act (GeschGehG), this position is hard to defend.

Unfair B2B contract terms (Art. 13)

Art. 13 introduces a fairness test for clauses on data access and use that one business imposes unilaterally on another. Exclusions of liability for intent and gross negligence are unfair, as are clauses giving one party the sole right to decide whether data conforms to the contract. Further clauses are presumed unfair. Supply, licence, maintenance and platform contracts are affected, as are purchasing terms. The Commission’s non-binding model terms can serve as a starting point.

Cloud switching (Chapter VI)

Providers of data processing services (IaaS, PaaS and SaaS) must enable customers to switch to another provider or to their own infrastructure. The contract must provide for a notice period of no more than two months, a transition period of usually 30 days, a description of exportable data and a retrieval period of at least 30 days (Art. 25). Until 11 January 2027 only reduced, cost-based switching charges are allowed, and none after that (Art. 29).

Enforcement in Germany: DADG and Bundesnetzagentur

The German Data Act Implementation Act (DADG) entered into force on 30 May 2026. The competent authority is the Federal Network Agency (Bundesnetzagentur), which handles complaints, supervises switching and certifies dispute settlement bodies under Art. 10. Where personal data is involved, the Federal Data Protection Commissioner is also competent. The DADG provides for tiered fines of up to EUR 500,000; for infringements involving personal data, Art. 83 GDPR also applies. Civil claims exist alongside.

Relationship with the GDPR

The GDPR prevails in case of conflict (Art. 1(5)), and the Data Act creates no legal basis for processing personal data. Where the user is not the data subject, for example with company cars, disclosure needs a legal basis under Art. 6 GDPR. Data access and data protection have to be set up together.

FAQs on the Data Act

Does it apply to products sold before September 2025?

The access rights under Arts. 4 and 5 do not depend on the date of sale. Only the design obligation in Art. 3(1) is limited to products placed on the market after 12 September 2026.

May the manufacturer charge for providing data?

Not to the user. Third parties may be charged a reasonable fee, limited to costs for SMEs.

Do existing cloud contracts need to be amended?

Yes. Chapter VI has in principle applied to existing contracts since 12 September 2025, and switching charges are prohibited from 12 January 2027.

Related topics

• Software, SaaS and cloud contracts
• Data protection
• IoT law (in German)
• Trade secrets (in German)