The EU Data Act is a regulation on fair access to and use of data. It applies from 12 September 2025. It gives users of connected products access to the data those products generate, limits unfair data contract terms between businesses, and sets switching rules for cloud and other data processing services.
Who does it apply to?
Three groups carry most of the duties: makers of connected products and related services, businesses that hold data from them, and providers of data processing services such as cloud and SaaS. The European Commission describes it as cross-sectoral, meaning it sets principles for all sectors rather than one industry.
The regulation entered into force on 11 January 2024. Article 50 sets application from 12 September 2025, with one delayed piece: the design obligation in Article 3(1) applies to connected products and related services placed on the market after 12 September 2026.
What do connected product makers have to do?
Article 3 says connected products and related services must be designed so that product data and related service data, plus the metadata needed to interpret them, are by default easily, securely, free of charge, in a comprehensive, structured, commonly used and machine readable format, and where relevant and technically feasible directly accessible to the user.
For an engineering team this is an API and data model question. A constructed example: a company sells smart industrial pumps with a cloud dashboard. Today only the vendor's dashboard shows flow and fault data. Under Article 3 the buyer should be able to get that data, with the field definitions, without paying and without a support ticket.
What changes for contracts between businesses?
Article 13 says a contract term about data access or use, or about liability and remedies for breaching data obligations, that one business unilaterally imposes on another is not binding on the other business if it is unfair. The Commission says it will also develop model contract clauses.
If your standard customer terms let you use customer generated data for any purpose, or cap your data obligations far below the customer's, have counsel read them against Article 13.
What are the cloud switching rules?
The switching chapter is the part most software companies feel first.
- Article 25 requires the rights and obligations around switching to be set out in a written contract, made available before signing in a form the customer can store.
- The contract must include a minimum period for data retrieval of at least 30 calendar days, followed by a clause guaranteeing full erasure of exportable data and digital assets after that period.
- Article 29: from 12 January 2027, providers may not charge switching charges. From 11 January 2024 to 12 January 2027, reduced charges are allowed, limited to costs directly linked to switching.
- Article 28 requires providers to publish on their website the jurisdiction their infrastructure is subject to and a description of measures against international access and transfer of non personal data.
- Article 32 requires adequate technical, organisational and legal measures to prevent third country governmental access to non personal data held in the Union where it would conflict with Union or national law.
What this is not
The Data Act does not replace GDPR. Where personal data is involved, both apply. It is also not a security standard, though Article 3 uses the word "securely", so data access endpoints must not become a new weakness.
How to check or apply this
- List each product you ship that generates data and decide whether it is a connected product or a related service.
- Map every data field a user would need, with definitions, and check whether a user can export it today without charge.
- Read customer contracts against Article 13 and flag one sided data terms.
- For SaaS, check that your terms have a switching clause, a retrieval period of at least 30 calendar days and an erasure commitment.
- Publish the jurisdiction and transfer safeguards page that Article 28 asks for.
- Review which of your data sits with subprocessors and how it would be exported on a switch. A current inventory of components and services helps here.
Quick check
When did the EU Data Act start to apply?
It applies from 12 September 2025. The Article 3(1) design obligation applies to connected products and related services placed on the market after 12 September 2026.
Can a cloud provider charge to switch away?
Reduced charges, limited to direct costs, are allowed until 12 January 2027. From that date no switching charges may be imposed under Article 29.
This is a summary, not legal advice. Check the regulation text and your counsel for your own case.
Sources
Last reviewed: 18 October 2026.
