Data Act
Data Act, Regulation (EU) 2023/2854
Rights for users to access and share data from connected products, and rules making it easier to switch cloud providers.
The law in brief
The Data Act gives users of connected products, such as cars, machines and smart devices, the right to access the data those products generate and to share it with other businesses. It also restricts unfair contract terms in business data sharing, lets public bodies request data in exceptional situations, and makes it easier to switch between cloud and other data processing services.
It has applied since 12 September 2025, with further duties arriving in stages.
Who it applies to
- Manufacturers of connected products and providers of related services placed on the EU market, and data holders that control product or service data.
- Users of those products and services in the EU, whether individuals or businesses, and data recipients they choose.
- Providers of data processing services, including cloud and edge services, for the switching rules.
- Businesses in data sharing contracts, for the unfair terms rules.
- It applies alongside the GDPR: where product data is personal data, the GDPR's rules still govern it.
What it requires
Access by design
Design and manufacture connected products, and design related services, so that product data and related service data are easily, securely and, where relevant, directly accessible to the user by default.
Information before the contract
Before a contract for a connected product or related service, tell the user what data it generates, how they can access it, and who will use it.
Share with users and their chosen recipients
Make readily available data available to the user, and to a third party at the user's request, without undue delay and on fair, reasonable and non-discriminatory terms.
No unfair terms in data sharing contracts
A contractual term concerning data access and use that one business unilaterally imposes on another is not binding if it is unfair under the Act's tests.
Cloud switching
Providers of data processing services must remove obstacles to switching, support migration of data and digital assets, and phase out switching charges.
People's rights
Users can access product and related service data readily available to the data holder, free of charge and, where feasible, in real time (Art. 4), and can ask for it to be shared with a third party of their choice (Art. 5). Customers of data processing services can switch provider and move their data (Arts. 23 to 31).
Enforcement and penalties
Member states set penalties, which must be effective, proportionate and dissuasive. Where personal data is involved, data protection authorities can impose GDPR-level fines (Art. 40).
What's changing
Design duty from 12 September 2026. Connected products and related services placed on the market from that date must be designed so their data is accessible to users by default. Switching charges for cloud services must end from 12 January 2027. The Commission's Digital Omnibus package, proposed in November 2025, would fold the Data Governance Act into the Data Act and adjust some rules; it is a proposal, not law. Regulatory Watch reports its progress.
What to do first
- Map connected products and related services you place on the EU market and the data they generate.
- Design for access: products placed on the market from 12 September 2026 must make data accessible by default.
- Publish pre-contract information on the data generated and how users can get it.
- Build request handling for users and the third parties they nominate, with trade secret safeguards.
- Review B2B data contracts for terms the Act treats as unfair.
- If you provide cloud services, prepare switching and egress processes and the removal of switching charges.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
- Regulation (EU) 2023/2854 EUR-Lex · Official text or regulator