EU Data Act: what evidence and documents should you prepare?

The EU Data Act was published on 22 December 2023 and has applied since 12 September 2025. Evidence depends on your role. Makers of connected products and data holders need records of user data access. Cloud and edge providers need switching and interoperability records. Everyone needs contract and enforcement contact records.

What does the Data Act cover?

The European Commission's explainer says the law makes data, in particular industrial data, more accessible and usable, and clarifies who can use what data and under which conditions. Its chapters are:

1. Chapter II: business to business and business to consumer data sharing for connected products. Users can access, use and port the data they co-generate.
2. Chapter III: conditions for business to business data sharing where a business is obliged by law to share.
3. Chapter IV: unfair contractual terms, protecting all businesses, in particular SMEs.
4. Chapter V: business to government data requests in situations of exceptional need.
5. Chapter VI: switching between data processing services, with minimum requirements for cloud and edge providers.
6. Chapter VII: protection of non-personal data against unlawful third country government access.
7. Chapter VIII: interoperability criteria.
8. Chapter IX: enforcement by designated national competent authorities, with a data coordinator as single contact where several exist.

The text of the regulation is the authority. This post uses the Commission's summary to organize a checklist, so confirm article details before you rely on any item.

What evidence maps to each role?

Connected product makers and data holders. The Commission says Chapter II applies to raw and pre-processed data generated from use of a connected product or related service that is readily available to the data holder, including personal and non-personal data and relevant metadata. Evidence: a data inventory per product listing what data is generated and where it is held, the mechanism by which users request access and receive data, request logs with dates and outcomes, and documentation of formats offered.

A constructed example: a maker of connected agricultural sensors stores readings in a cloud database and shows farmers a dashboard. A farmer asks for the raw readings to move to another service provider. The maker's evidence file should show the data categories, the request, the export delivered and the date. If the only way to get data is a support ticket handled ad hoc, the process is hard to demonstrate.

Businesses with sharing obligations. Evidence: terms offered, how they were set, and records of requests and responses.

Contracting parties. Evidence: a review of standard data-sharing clauses against Chapter IV, with legal sign off.

Cloud and edge providers. Evidence: documented switching process, interoperability documentation, customer communications about switching, and test runs.

Anyone holding non-personal data in the EU for customers. Evidence: a policy and procedure for handling third country government requests, with escalation to legal and records of each request.

All roles. Evidence: the name of your national competent authority and an internal contact for regulator inquiries.

How do you keep this practical?

Start with a single table: role, chapter, obligation, owner, evidence, review date. Add a process owner for each. Test the user data access process once with an internal request and record the result.

Safeguard's compliance automation can help collect evidence and track tasks for frameworks you map, and its asset discovery and SBOM features can support the data and system inventory. It does not certify compliance with the Data Act, and legal review is still needed.

What to do

1. Decide which roles you hold: manufacturer of connected products, related service provider, data holder, cloud or edge provider, or recipient.
2. Build the data inventory for connected products and services.
3. Create and test a user data access and portability process with logging.
4. Review contract templates for unfair term risks in Chapter IV.
5. If you provide cloud or edge services, document switching and interoperability and test them.
6. Write a procedure for third country government access requests.
7. Record your competent authority and a regulator contact, and review the table quarterly.

Quick check

Sources

1. European Commission: Data Act explained

Last reviewed: 18 October 2026.