Data Act: what it requires and how to comply
The Data Act gives users access to the data their connected products generate, and removes the obstacles to switching cloud provider. So if you make connected products or run cloud services, it applies to you —and the calendar already has fixed dates: access by design from September 2026 and no switching charges from January 2027—. Atalaya GRC also helps you reach Data Act compliance on time.
No commitment. We’ll walk you through the platform with a real case.
- Reference
- Reg. (EU) 2023/2854
- Applies from
- 12 Sep 2025
- Who
- Connected products and cloud services
- If you don’t comply
- National penalties (DPA for personal data)
What is the Data Act?
The Data Act is Regulation (EU) 2023/2854, in force since 11 January 2024 and applicable since 12 September 2025. It governs who can access the data that connected products generate, and on what terms. It also requires data processing service providers to remove the barriers to switching. Unlike the GDPR, it covers non-personal data as well, so Data Act compliance goes beyond privacy.
Who needs Data Act compliance?
Manufacturers of connected products and providers of related services, and providers of data processing services (cloud and edge) operating in the EU. It does not apply by sector but by what you do: if your product generates usage data or you run cloud services, Data Act compliance concerns you. However, Chapter II exempts micro and small enterprises under conditions. In addition, we explain what the Data Act means for your business in detail.
Key Data Act compliance dates (staggered timeline)
The Data Act arrives in phases, so plan your Data Act compliance around these dates:
11 Jan 2024
Firstly, the regulation enters into force.
12 Sep 2025
Then comes general application: data access, switching provider and unfair contract terms in new contracts.
12 Sep 2026
However, access by design (Art. 3(1)) only binds connected products placed on the market from this date.
12 Jan 2027
Finally, switching charges become unlawful. Until then, only reduced charges not exceeding the costs directly linked to the switch.
What does Data Act compliance require?
Data Act compliance starts with user access to product data easily, securely and in a machine-readable format. It also requires pre-contractual information on what data the product generates; contractual exit clauses and real assistance for switching provider; transparency on charges; and safeguards against third-country government access to non-personal data.
January 2027: the date you can’t miss
From 12 January 2027 you will not be able to charge anything for switching provider. Until then, you may only pass on reduced charges that do not exceed the costs directly linked to the switch. Therefore, if your pricing depends on exit friction, Data Act compliance is a business change, not just a contractual one.
Atalaya GRC
How Atalaya GRC helps with Data Act compliance
In short, Atalaya GRC turns Data Act compliance into something you control:
- The platform assigns it automatically if you flag connected product or data processing services: no manual lists.
- The regulatory clock tracks the staggered dates (September 2026, January 2027) so none catches you out.
- In addition, Chapter II and Chapter VI obligations broken down service by service, each with its evidence and its review date.
- Real portability: every client downloads all their data as a ZIP with JSON, CSV and files —exactly what Art. 30 asks for.
Want to see it with your own services?
Request a demoBy sector: Connected-product manufacturers
FAQ
Frequently asked questions
Who does the Data Act apply to?
Manufacturers of connected products and providers of related services, and providers of data processing services (cloud). It depends on your activity, not your sector. There are exemptions for micro and small enterprises.
When does the Data Act apply?
It has applied since 12 September 2025. Access by design (Art. 3(1)) only binds products placed on the market from 12 September 2026, and switching charges are banned on 12 January 2027.
Can I still charge for switching provider?
Until 12 January 2027, only reduced charges that do not exceed the costs directly linked to the switch. From that date, no charge at all.
Is it the same as GDPR portability?
No. GDPR Art. 20 covers the data subject’s personal data. The Data Act covers product data and switching provider, including non-personal data. They are different obligations and they coexist.
