EU Data Act

For companies, it breaks down into three practically relevant blocks: data access rights for connected products, limits on unfair contract terms and a new regime for switching between cloud providers.

Unlike the GDPR, the Data Act is not a data protection law. It treats personal and non-personal data alike and does not primarily ask whether processing is permissible, but to whom the economic value of the data belongs. This makes it a topic with a direct impact on product architecture, contracts and purchasing strategy for mechanical engineering companies, device manufacturers, software providers and cloud customers.

Application, deadlines and scope

The regulation was published in the Official Journal of the EU on 22 December 2023 and entered into force on 11 January 2024. Under Article 50, it has applied since 12 September 2025, with several staggered exceptions that are often overlooked in practice. Anyone who only knows the one date plans past the actual deadlines.

The key dates at a glance

Who is affected

The Data Act is cross-sectoral. It addresses manufacturers of connected products, providers of related services, data holders, data recipients, users and providers of data processing services, i.e. cloud and edge providers of every service depth. What matters is not the registered office but the market connection: anyone offering connected products or services in the EU falls under the regulation, even if based outside the Union.

Classic mid-sized company constellations are therefore affected: the mechanical engineering company whose machines write sensor data to its own platform; the retailer that wants to evaluate the telematics data of its fleet; the company that runs its ERP operations in a public cloud; and every provider selling software as a service, which expressly brings SaaS into the switching chapter, not just infrastructure or platform services.

Data access for connected products

Chapter II of the regulation gives users of connected products the right to access the data they co-generate through use. A user is anyone who owns, rents or leases a product, i.e. as a rule the company that operates the machine, not the manufacturer. Access must be free of charge, easy and, as a rule, directly possible.

Which data is covered

Covered are raw data and pre-processed data generated through the use of a connected product or a related service that are available to the data holder without disproportionate effort, including relevant metadata. This includes sensor values such as temperature, pressure, flow rate, fill level, position, acceleration or speed, regardless of whether they are personal.

Derived or heavily enriched data and content are not covered. The European Commission illustrates the boundary with an example: if someone watches a film on a connected television, the film itself does not fall within the scope, but the data on screen brightness does. Trade secrets also remain protected: the data holder can agree protective measures and, in extreme cases, refuse disclosure, but must then demonstrate to the competent authority that it would otherwise suffer serious economic damage.

Real-world example: maintenance of a production plant

A mid-sized supplier operates five CNC machining centres from a German manufacturer. The machines record spindle load, vibration, temperature curves and error codes and send them to the manufacturer's portal. Until now, predictive maintenance was therefore effectively tied to the manufacturer: only it could see the data, only it could build a service package on it, and it charged accordingly.

Under the Data Act, the operator can retrieve this operating data itself and make it available to an independent maintenance provider or a specialised analytics service provider. The manufacturer may no longer refuse this across the board and may not charge the user for providing it. The limit: the third party may not use the data to develop a competing connected product. Competition in the aftermarket (maintenance, repair, spare parts, data-based insurance), on the other hand, is expressly intended.

The lever is commercial, not legal: maintenance contracts become negotiable because the information monopoly falls away. Conversely, for manufacturers this means that a business model based exclusively on exclusive data access no longer has a viable basis.

B2B data sharing and contract terms

Chapter III governs the conditions under which data must be shared where there is a legal obligation to do so. The conditions must be fair, reasonable and non-discriminatory. Data holders may demand reasonable compensation for this, which can cover the costs of making the data available as well as technical costs for dissemination and storage. Towards micro-enterprises, SMEs and non-profit research organisations, however, at most the pure cost of making the data available may be charged.

Unfair terms become ineffective

Chapter IV draws a line in the freedom of contract between companies: unilaterally imposed terms on data access and data use (the classic take-it-or-leave-it conditions of a stronger market participant) are subject to an unfairness test. The regulation lists terms that are always considered unfair and those that are presumed to be unfair. An unfair term is not binding; the rest of the contract remains in force where possible.

In practice, this means: anyone negotiating supplier, platform or maintenance contracts today should no longer accept clauses on data sovereignty as a given. The regime already applies to newly concluded contracts, and to certain existing contracts from 12 September 2027.

Cloud switching: the turning point on 12 January 2027

The economically sharpest part of the Data Act is in Chapter VI. Providers of data processing services (IaaS, PaaS and SaaS) must remove obstacles that make it difficult to switch providers. These include open interfaces and export in a common, machine-readable format for platform and software services, and functional equivalence for infrastructure services: anyone switching to a service of the same type should obtain a materially comparable result with the same input.

The most common misconception: "There have been no switching fees since September 2025"

This statement has been circulating since the date of application and is wrong. 12 September 2025 was the starting point for the general obligations: notice and transition periods, contractual transparency, obligations to cooperate. The question of charges is regulated separately.

Article 29 names two stages. First: from 12 January 2027, providers of data processing services may no longer impose any switching charges, egress fees included. Second: in the transitional phase from 11 January 2024 to 12 January 2027, reduced switching charges are permitted, but at most in the amount of the costs incurred by the provider that are directly linked to the specific switching process. The European Commission puts it exactly the same way in its explanation: switching charges will be completely abolished from 12 January 2027, while during the three-year transitional phase the costs incurred may be passed on.

The difference is not a formality. A cost-recovery charge is negotiable and verifiable: a provider must be able to prove which costs are directly linked to the switch. Freely calculated market prices for egress are precisely no longer permitted in this phase. From January 2027, the item disappears without replacement. Unaffected by this, regular usage charges, agreed charges for early termination of the contract and separately commissioned support services remain permitted.

What cloud contracts must contain

Article 25 sets out specific requirements for the contract. The most important:

• a maximum notice period for initiating the switch of no more than two months;
• a mandatory transition period of a maximum of 30 calendar days, during which the contract continues and the provider must assist with the switch; if this is technically impossible, it must justify this within 14 working days and may extend the period to a maximum of seven months;
• an exhaustive list of all portable data and asset categories;
• a retrieval period of at least 30 calendar days after the end of the transition period;
• a guarantee of complete deletion of the exportable data after this period has expired;
• transparency about all charges that may still be imposed at all under Article 29.

This makes vendor lock-in a regulated state for the first time instead of a mere question of negotiation. However, the regulation does not enforce technical portability: anyone who has tied their application deeply to a hyperscaler's proprietary managed services can switch legally free of charge and still fail in a migration project. The architectural decision remains your own; how to make it properly is the subject of our decision guide to cloud migration and modern software architecture.

Relationship to the GDPR

The Data Act and the GDPR stand side by side, not against each other. The GDPR governs the lawfulness of processing personal data; the Data Act governs the availability of data in the single market, whether personal or not. Where they overlap, data protection law takes precedence.

Where there is friction in practice

The conflict is foreseeable: co-generated machine or vehicle data often contains both, and separating them is technically complex. If the user requesting access is not the data subject themselves, personal data may only be disclosed on a sound legal basis, for example with consent. A Data Act access claim does not replace this legal basis. Anyone implementing data sharing technically therefore needs a concept that identifies personal components and treats them separately, instead of opening up the data stream wholesale.

Supervision, sanctions and outlook

Enforcement lies with the Member States. They designate competent authorities and, where there are several, a data coordinator as the central point of contact. Under Article 40, each Member State sets the penalties itself; they must be effective, proportionate and dissuasive. For infringements of Chapters II, III and V, the data protection supervisory authorities can additionally impose fines under Article 83 GDPR within their remit, up to the framework of 20 million euros or four per cent of worldwide annual turnover set out in Article 83(5) GDPR.

Germany: the Federal Network Agency and the DADG

In Germany, responsibility has been clarified. With the entry into force of the Data Act Application and Enforcement Act (DADG), the Federal Network Agency (Bundesnetzagentur) has been the competent authority for the Data Act since 30 May 2026. It is the central point of contact, monitors compliance with the rules on switching providers, authorises dispute settlement bodies and cooperates with the Federal Commissioner for Data Protection and Freedom of Information on data protection matters.

It remains open whether the legal framework will remain in this form: as part of the Digital Omnibus, the European Commission has proposed amendments to the Data Act. So far, this is a proposal and not applicable law; the deadlines in Article 29 and Article 50 continue to apply unchanged until an amendment has actually been adopted and published.

What companies should check now in concrete terms

The Data Act is not a project for the legal department alone. Four checkpoints are enough for an initial assessment:

1. Product side: do your products generate usage data? If so, is there a documented, reasonable way for a customer to retrieve it or have it passed on to third parties? For everything placed on the market after 12 September 2026, this is a requirement for product design, not for the support team.
2. Purchasing side: which data do you generate on third-party devices and platforms without seeing it yourselves? That is exactly where there is a claim that nobody has noticed so far.
3. Cloud contracts: does the contract contain the notice period, transition period, retrieval period, export scope and charges in the form required by Article 25? Where egress costs are factored in, a renegotiation belongs in the planning by 2027 at the latest, and even before that the question of whether the charge demanded really only covers direct switching costs.
4. Data protection interface: is it defined how personal components in co-generated data sets are recognised and handled before data is released?

Anyone who can answer these four points has the Data Act under control operationally. The rest is detailed work on contract texts and interfaces, and that can be planned as long as 12 January 2027 does not appear in the calendar as a surprise.