EU Data Act

Rights to access and share data from connected products and related services, cloud switching rules, and B2G data sharing. Applies from 12 September 2025; access-by-design for new products from 12 September 2026; switching charges abolished from 12 January 2027.

Analysis

The EU Data Act (Regulation (EU) 2023/2854) is a horizontal EU regulation that harmonises access to and use of data, especially from connected/IoT products and related services, and imposes interoperability and switching rules for cloud and other data processing services.Data Act – European CommissionOfficial Journal – Regulation (EU) 2023/2854Data Act – European Parliament briefing775915_EN.pdf)

Key Requirements

• Applicability and scope

• The Data Act entered into force on 11 January 2024 and applies from 12 September 2025.Data Act – European CommissionCommission news: Data Act enters into forceRegulation (EU) 2023/2854, Art. 50
• It is a horizontal regulation covering all sectors and applies to manufacturers/providers of connected products, providers of related digital services, and data processing services (including cloud and edge) placed on the EU market, regardless of where they are established.Data Act – European CommissionData Act – European Parliament briefing775915_EN.pdf)Data Act – Wikipedia overview)

• User access rights to data generated by connected/IoT products

• Users (consumers and businesses) must be able to access data generated by the use of connected products and related services (including personal and non‑personal data).Data Act – European CommissionData Act – European Parliament briefing775915_EN.pdf)Skadden: EU Data Act overview
• Data holders must provide such data free of charge, in structured, commonly used, machine‑readable formats, and allow users (or designated third parties) to use and share that data.Regulation (EU) 2023/2854, Arts. 4–6Skadden: EU Data Act overviewBigID: Key Provisions Taking Effect
• From 12 September 2026, products placed on the EU market must be designed so that data is directly accessible to the user where technically feasible.Data Act – European Parliament briefing775915_EN.pdf)Data Act – Wikipedia timeline)Latham & Watkins – What Businesses Need to Know

• Cloud and data processing service switching & interoperability

• Providers of data processing services (including cloud, edge, SaaS, IaaS, PaaS) must enable customers to switch providers or move on‑premise without undue obstacles, within 30 days and in standard formats.Regulation (EU) 2023/2854, Arts. 23–26Data Act – European Parliament briefing775915_EN.pdf)Latham & Watkins – What Businesses Need to Know
• The Act prohibits contractual and technical lock‑ins, requires removal of exit fees, and mandates interoperability requirements (e.g., APIs, standards) for data processing services.Regulation (EU) 2023/2854, Arts. 23–29European Commission – Data Act policy pageBigID: Cloud switching & interoperability
• Removal of certain cloud switching fees applies from January 2027.Data Act – European Parliament briefing775915_EN.pdf)EU-Data-Act.com implementation timeline

• Fair contractual terms in B2B data sharing

• Data holders must not impose unfair terms on SMEs in data access and use contracts; the Act introduces a fair, reasonable and non‑discriminatory (FRAND) standard and empowers the Commission to issue model contractual terms.Regulation (EU) 2023/2854, Arts. 9–13Skadden: Fair Contractual TermsBigID: FRAND obligations
• The European Commission must prepare Model Contractual Terms (MCTs) on data access, use, and reasonable compensation.Regulation (EU) 2023/2854, Art. 34Skadden: Model Contractual Terms requirement

• Public sector access to private‑sector data (B2G data sharing)

• Public sector bodies and EU institutions may request access to data held by private entities in exceptional circumstances, e.g. public emergencies, or when necessary for tasks in the public interest (statistics, resilience, research).Regulation (EU) 2023/2854, Chapter VData Act – European Commission policy pageData Act – European Parliament briefing775915_EN.pdf)
• Requests must be proportionate, time‑limited, and subject to safeguards (including trade secret and security protections).Regulation (EU) 2023/2854, Arts. 19–22Skadden: Public sector access safeguards

• Protection against unlawful foreign access to non‑personal data

• The Act introduces measures to protect non‑personal data held in the EU from access by third‑country authorities where such access would conflict with EU or Member State law.Regulation (EU) 2023/2854, Art. 32Skadden: Foreign government access safeguardsBigID: Protection Against Foreign Access
• Data processing service providers must assess foreign access requests and only comply when conditions and safeguards set by EU law are met.Regulation (EU) 2023/2854, Art. 32Data Act – European Parliament briefing775915_EN.pdf)

• Standardisation and interoperability of data and cloud services

• The Act promotes common interoperability standards, including European data spaces, and mandates that the Commission and standardisation bodies develop technical specifications for data sharing and cloud/service interoperability.Data Act – European Commission policy pageRegulation (EU) 2023/2854, Arts. 28–31European Parliament briefing – interoperability775915_EN.pdf)

• Enforcement and penalties

• Member States must establish national enforcement frameworks and penalties and notify the Commission by 12 September 2025.Regulation (EU) 2023/2854, Art. 41Skadden: Enforcement and penaltiesEU-Data-Act.com – enforcement obligations
• Supervisory authorities will oversee compliance and can impose fines and corrective measures under national law implementing the Regulation’s enforcement provisions.Regulation (EU) 2023/2854, Chapter VIIIData Act – European Commission policy pageEuropean Parliament briefing – enforcement775915_EN.pdf)

Compliance Challenges

• Identifying all in‑scope products, services, and data flows

• Organizations struggle to map which connected products, related services, and data processing services fall within the Data Act’s broad scope.Latham & Watkins – What Businesses Need to KnowSkadden: Three Months To GoMorgan Lewis: EU Data Act Begins September 12
• This is particularly challenging for global technology firms with complex IoT ecosystems and multi‑cloud architectures.Data Act – European Parliament briefing775915_EN.pdf)BigID: Readiness challengesLatham & Watkins – extraterritorial scope

• Product redesign and data architecture changes for direct user access

• Companies must redesign IoT products and related services by September 2026 to enable direct, free, user access to data, which can require major firmware, software, and backend changes.Regulation (EU) 2023/2854, Arts. 3–4Data Act – European Parliament briefing775915_EN.pdf)Latham & Watkins – product design requirements
• Industry analyses note the technical complexity of exposing high‑volume machine data securely and in standardized formats without degrading performance.Skadden: Implementation challengesMorgan Lewis: Impact on connected productsBigID: Data architecture implications

• Managing overlap with GDPR and other data regulations

• Organizations must reconcile Data Act access rights with GDPR obligations, especially when connected product data contains personal data and when users exercise rights via different legal bases.Data Act – European Commission policy pageData Act – European Parliament briefing775915_EN.pdf)Morgan Lewis: Non‑personal vs personal data
• Legal commentaries highlight complex governance questions on consent, legal bases, and roles (controller vs data holder) when data is shared with third parties under Data Act rules.Skadden: Interplay with GDPRLatham & Watkins – parallel application with GDPRBigID: Governance challenges

• Cloud switching and interoperability implementation

• Cloud providers face challenges in enabling 30‑day switching, removing exit fees by 2027, and providing functional equivalence or compatible services after migration.Regulation (EU) 2023/2854, Arts. 23–26Data Act – European Parliament briefing775915_EN.pdf)Morgan Lewis: Cloud switching obligations
• Industry reports note the difficulty of re‑engineering proprietary cloud architectures, APIs, and billing models to meet Data Act interoperability rules.BigID: Cloud & SaaS impactsLatham & Watkins – interoperability requirementsEU-Data-Act.com – switching and interoperability guidance

• Trade secret and IP protection while sharing data

• Data holders worry that mandatory data sharing may expose trade secrets, security‑sensitive information, or IP‑protected data; the Act includes safeguards, but practical implementation (e.g., data minimisation, aggregation) is challenging.Regulation (EU) 2023/2854, Arts. 4(6), 20, 32Skadden: Trade secret protectionsData Act – European Parliament briefing775915_EN.pdf)
• Legal analyses emphasise the need for robust confidentiality and technical safeguards to avoid unlawful disclosure while meeting access obligations.Latham & Watkins – trade secret concernsBigID: Risk and security considerations

• Real‑world examples and emerging practice

• Commentaries describe industrial equipment manufacturers reassessing business models that relied on exclusive access to machine data, now needing to share this data with customers and third‑party service providers.Skadden: Impact on manufacturersEuropean Parliament briefing – industrial data sharing775915_EN.pdf)[Morgan Lewis: Industrial IoT implications](https://www.morganlewis.com/blogs/sourcingatmorganlewis/2025/09/eu-data-act-begins-september-12-impacting-cloud-services-connected-products

Recent developments

• 2026-06-15 — Analysis explains that the **majority of the EU Data Act’s provisions began to apply on 2025-09-12**, outlining staged implementation for core rules (2025), cloud interoperability (2026), and full data portability (2027), and detailing obligations on connected product data sharing and business-to-government access.[6] (source)
• 2026-06-01 — Law firm briefing highlights that businesses in the technology and IoT sectors face **significant compliance overhauls ahead of the 2025 and 2026 application dates**, including redesigning connected products “access by design”, revising cloud contracts for switching and data egress, and preparing for GDPR-level fines.[2] (source)
• 2026-05-20 — Client alert notes that with “three months to go” before the main rules apply on 2025-09-12, **technology manufacturers, cloud providers and IoT data holders are intensifying contract and product reviews**, focusing on new user data access rights, switching obligations, and forthcoming Commission model contractual terms due by September 2025.[4] (source)
• 2026-04-30 — European Commission “Data Act explained” page (updated post‑application) confirms the Act **applies since 2025-09-12** and details user rights to access and share data from connected products and related services, safeguards against third‑country access to non‑personal data, and timelines for removing switching and data egress charges by 2027.[3] (source)
• 2026-03-25 — European Commission policy page reiterates that the **Data Act entered into force on 2024-01-11 and is applicable from 2025-09-12**, positioning it as a cornerstone of the EU data strategy and stressing impacts on connected device design, cloud service switching, and fair data-sharing across the technology sector.[1] (source)
• 2026-02-28 — Legal analysis of the Commission’s **Digital Omnibus proposal** explains planned technical amendments to the Data Act, including changes to the business‑to‑government access regime (from “exceptional need” to “public emergencies”) and adjustments to trade secret protections, which could refine how public authorities access data from tech companies.[5] (source)
• 2025-11-19 — Commentary on the 2025-11-19 launch of the **Digital Omnibus** describes how it aims to simplify and harmonise EU digital legislation, with targeted amendments across data sharing and AI that interact with the Data Act and may further shape compliance expectations for technology providers.[7] (source)
• 2025-09-12 — On the day the core provisions started to apply, this article underscores that **users of smart home devices, connected vehicles and industrial IoT equipment now have enforceable rights to obtain data in machine‑readable format and share it with third parties**, while authorities gain clearer powers to request data in public emergencies.[6] (source)
• 2025-09-01 — Pre‑implementation guidance reports heightened **industry concern over the breadth of the Data Act**, noting technology firms must treat device and service data less as an exclusive asset and more as a shared resource, revisit monetisation models, and guard trade secrets within expanded data-sharing frameworks.[2] (source)
• 2025-06-15 — Skadden’s early‑stage alert highlights that **IoT and cloud businesses expect major operational impacts**, including redesigning products to enable “access by design”, setting up new internal data governance processes, and anticipating greater competition and innovation as exclusive control over connected‑device data is curtailed.[4] (source)

Related regulations

• Artificial Intelligence Liability Directive — European Union, Active
• EU AI Act - Annex III High-Risk System Requirements (2 Dec 2027) — European Union, Upcoming, effective 2027-12-02
• EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
• EU AI Act - GPAI Model Obligations (2 Aug 2025) and Enforcement (2 Aug 2026) — European Union, Active, effective 2025-08-02
• EU Digital Omnibus on AI (Regulation (EU) 2026/1744) — European Union, Active, effective 2026-07-27
• EU AI Act - Synthetic Media Transparency and New Prohibitions (2 Dec 2026) — European Union, Upcoming, effective 2026-12-02
• EU AI Act - Annex I High-Risk Systems (2 Aug 2028) — European Union, Upcoming, effective 2028-08-02
• EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11

Put it into practice

• Generate the policy: GDPR policy generator (generatepolicy.com)
• Buy the policy pack: GDPR Complete Bundle (cyberpolicy.shop)
• Build it yourself: GDPR & DPIA Compliance Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates