EU Data Act: what it means for your company
The EU Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. It decides who can use the data generated by connected products, how businesses share data and how customers switch cloud provider. So if you make IoT devices, provide services linked to them or buy cloud services, the EU Data Act means specific obligations for your company, phased in until 2027.
In 30 seconds: users of connected products can access their data and share it with third parties. In addition, unfair data terms imposed between businesses are not binding, and public bodies can request data in emergencies. Switching cloud provider also becomes free of charge from 12 January 2027. Finally, the rules shield non-personal data from unlawful access by non-EU governments. As an EU regulation, the Data Act applies directly in every Member State, with no national transposition needed.
EU Data Act implementation timeline
The regulation has been in force since 11 January 2024, but its obligations take effect in phases under Article 50. The full text is on EUR-Lex.
| Date | What starts to apply | Who is affected |
|---|---|---|
| 12/09/2025 | General application: data access and sharing (Arts. 4 to 6), pre-contractual information, unfair terms in new contracts, public-sector requests, cloud switching with charges capped at cost | Manufacturers, related services, cloud providers and their customers |
| 12/09/2026 | Data access by design (Art. 3(1)) for connected products and related services placed on the market after that date | Manufacturers and related service providers |
| 12/01/2027 | All switching charges abolished, including data egress (Art. 29) | Cloud and edge providers |
| 12/09/2027 | Unfair terms rules (Chapter IV) also cover contracts concluded on or before 12/09/2025 if open-ended or expiring at least 10 years after 11/01/2024 | Businesses with long-term data contracts |
The Article 3(1) date applies unit by unit. So the rule does not catch a product that reached the market earlier just because it is still on sale.
EU Data Act roles: who is who
- User: a person or business that owns, rents or leases a connected product, or receives a related service.
- Data holder: whoever has the right or obligation to use and make the data available. This is usually the manufacturer or the related service provider.
- Data recipient: a business other than the user that receives the data, for example the repair shop or insurer the user chooses.
- Provider of data processing services: a cloud or edge provider (IaaS, PaaS, SaaS) that the switching rules cover.
For example, a machinery manufacturer can be a data holder towards its customers and, at the same time, a customer of a cloud provider. Therefore, it is worth checking your EU Data Act role relationship by relationship.
EU Data Act obligations by type of company
Connected product manufacturers
You must give users, on request and free of charge, the readily available product data with its metadata. Where technically feasible, you must also provide it continuously and in real time (Art. 4). In addition, you must share it with a third party of the user’s choice (Art. 5). Before sale or rental, you must tell users what data the product generates. You may only use non-personal product data under a contract with the user. Furthermore, refusing to share on trade secret grounds requires showing that serious economic damage is highly likely. We cover practical cases on our page for connected product manufacturers.
Related service providers
If you offer an app or service that controls a connected product, such as a thermostat app, you are the data holder for that data. Therefore, you have the same information, access and sharing duties.
Cloud customers and providers
Cloud contracts must set out in writing a maximum notice period of two months to start switching. They must also set a maximum transition period of 30 calendar days (up to seven months if technical unfeasibility is justified). In addition, they must allow at least 30 days to retrieve data and provide for full erasure at the end (Art. 25). Until 12 January 2027, providers may only charge the direct costs of switching; after that, nothing. Providers must also publish their safeguards against unlawful access by non-EU governments (Arts. 28 and 32). So if you sell SaaS to businesses, these EU Data Act duties are yours.
SMEs and microenterprises: EU Data Act exemptions
The EU Data Act’s product data access duties do not apply to micro and small enterprises. However, they do apply when such an enterprise has larger partner or linked enterprises or manufactures under subcontract for another company (Art. 7). Medium-sized enterprises get one year’s grace after becoming medium-sized and also for the first year of each product on the market. By contrast, the cloud rules have no size exemption. Finally, a data holder can only charge an SME data recipient the cost of making data available (Art. 9).
Unfair terms, model clauses and public-sector access
Chapter IV of the EU Data Act protects any business against data-related terms imposed unilaterally. Some are always unfair, such as excluding liability for intentional acts or gross negligence, while others are presumed unfair (Art. 13). As a result, an unfair term does not bind the party it was imposed on. In November 2025, the European Commission also published its recommendation with model contractual terms for data and standard contractual clauses for cloud contracts (Art. 41), initially in English only. They are voluntary and you can adapt them.
Chapter V lets public sector bodies, the Commission and the European Central Bank request data on the basis of exceptional need. That means a public emergency or, outside one, a public-interest task provided by law that they cannot fulfil otherwise (non-personal data only). In emergencies, the EU Data Act requires medium and large businesses to provide data free of charge, while micro and small ones can claim compensation. Outside emergencies, however, micro and small enterprises are exempt.
Penalties and the link with GDPR, the CRA and the Digital Omnibus
Penalties and the competent authority in Spain
Each Member State sets effective, proportionate and dissuasive penalties and also designates competent authorities (Arts. 37 and 40). Where personal data is at stake, data protection authorities supervise. In Spain that is the AEPD (Agencia Española de Protección de Datos), which can fine under the GDPR regime up to €20 million or 4% of worldwide annual turnover. However, as of 14 October 2026 there is no public record of Spain designating its general competent authority or adopting its penalty regime. That does not suspend the EU Data Act obligations, because they apply directly.
GDPR and CRA
Where they conflict, the GDPR prevails. In addition, the EU Data Act is not a legal basis for processing personal data. For example, the person requesting data may not be the data subject, as with a fleet operator whose employees drive its vehicles. In that case, you need an Article 6 GDPR legal basis. Meanwhile, the Cyber Resilience Act, Regulation (EU) 2024/2847, requires reporting of actively exploited vulnerabilities and severe incidents from 11 September 2026. It then applies in full from 11 December 2027. In short, the Data Act asks for secure access and the CRA defines how to protect it. See Cyber Resilience Act obligations.
What the Digital Omnibus would change
On 19 November 2025 the Commission tabled the Digital Omnibus proposal (COM(2025) 837). Specifically, it would fold the Data Governance Act into the Data Act and widen the trade secret refusal grounds. It would also limit Chapter V to emergencies, delete Article 36 (smart contracts) and ease switching for certain cloud contracts concluded before 12 September 2025. However, as of 14 October 2026 it is still under negotiation: the Council is discussing Presidency compromise texts without an agreed position, and there is no deal with the European Parliament. Until the EU institutions adopt it, the Data Act applies as it stands.
What to do now: a five-step EU Data Act plan
- Inventory products, services and data first: what is readily available, what is personal and which trade secrets it contains.
- Assign roles in each relationship and also check whether the micro and small enterprise exemption applies.
- Set up the access channel: form or API, identity checks, pre-contractual information and access by design for new products.
- Review contracts: data clauses against Article 13 and cloud contracts against Article 25.
- Finally, coordinate the Data Act, GDPR and CRA in a single control map for multiple regulations.
Frequently asked questions
When did the EU Data Act become mandatory?
On 12 September 2025 for almost everything. However, access by design applies to products placed on the market after 12 September 2026, and cloud switching charges disappear on 12 January 2027.
Does the EU Data Act apply to SMEs?
Partly. Independent micro and small enterprises are outside the product data access duties, but not the cloud rules. They also benefit from the protection against unfair terms.
What is the difference between the Data Act and the GDPR?
The GDPR protects personal data. The Data Act, by contrast, governs who can access and use data, personal or not, generated by products and services. Both apply at once and, in a conflict, the GDPR prevails.
Can my cloud provider charge me for switching?
Until 12 January 2027, only the costs directly linked to switching. From that date, however, it cannot charge any fee for switching or for the related data egress.
Who enforces the EU Data Act in Spain?
For personal data, the AEPD, Spain’s data protection authority. For everything else, the authority Spain designates, although as of October 2026 there is no public record of that designation.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC manages the Data Act in the same system as your other regulations: one control, many regulations. You inventory products, data and roles, assign obligations service by service and then link each control to the GDPR and the CRA. In addition, you keep evidence of contracts and data requests, and the third-party register holds your cloud providers. The regulatory clock also alerts you to the 2027 deadlines. See the Data Act guide or request a demo.
