The EU Data Act's switching rules, applicable from 12 September 2025, require providers of data processing services to let customers move to another provider or to their own infrastructure. A law firm summary describes a notice period of up to two months, a maximum 30 day transition and the end of most switching charges from 12 January 2027.
I could not retrieve the regulation's operative text, so this relies on one law firm's summary. Check Regulation 2023/2854 and counsel.
Who it covers
Per the summary, the rules apply to providers of data processing services, including IaaS, PaaS and SaaS, and to non-EU providers serving customers in the EU. Services that need heavy provider interaction are excluded, and custom built services fall under a lighter regime.
What providers must allow
The summary lists:
- Switching or porting after a notice period of up to two months.
- A transition within a maximum of 30 days, and without undue delay.
- Contracts that exhaustively list the data and digital assets that can be ported, to a new provider or on premises.
- Support for the customer's exit strategy and no obstacles to switching.
Switching charges
Until 12 January 2027, charges are allowed but cannot exceed the provider's direct switching costs. After that date, providers generally cannot impose switching charges, although early termination penalties may still apply.
Why it matters for security and residency
Exit is part of risk. A customer that can leave in 30 days will ask for export formats, deletion proof and key handling at exit. These questions overlap with data residency promises and the transfer assessments in this series. See the transfer map.
What to prepare
- Document which data and assets a customer can export, with formats.
- Build and test an export path that does not need a support ticket.
- Define deletion after exit, including backups and logs. See deleting data across regions.
- Decide who holds encryption keys at exit.
- Review contract templates for switching terms.
- Plan for the charge change in January 2027.
If you are a customer, the reverse applies: keep your own exit plan current. Exit strategies for ICT services under DORA is a related discipline.
Practical consequences for engineers
Export is a product feature now. A bulk export that is documented, versioned and tested serves customers and also reduces support load. Think about formats too: a customer moving to another provider wants structured data and metadata, not only a dump of files.
Interaction with security controls
Short switching windows put pressure on access control and logging. A customer who exports everything in one day creates a spike that looks like exfiltration. Decide how your monitoring tells a legitimate bulk export from a compromised account, for example with a confirmation step for the admin and an alert to the customer's security contact.
Quick check
Does the Data Act apply to non-EU providers?
The summary says it applies to providers serving customers in the EU even if established elsewhere. Confirm with counsel.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
