EU Data Act
The EU Data Act (Regulation (EU) 2023/2854) governs access to data generated by connected products and its sharing with third parties, fair data-related contract terms and switching between cloud services – without overriding the GDPR.
The EU Data Act – Regulation (EU) 2023/2854 – entered into force on 11 January 2024 and has applied since 12 September 2025. It shifts control over usage data from connected products: under Art. 4, the user of a connected product or related service may require the data holder to make the data generated by that use available, including the relevant metadata, easily, free of charge and – where technically feasible – continuously and in real time. Under Art. 5, the same user may instruct the data holder to share those data with a third party of their choice, for example an independent repair shop, a maintenance provider or an analytics vendor. Art. 3(1) adds an access-by-design duty: connected products and related services must be built so that the data are accessible from the outset, a requirement that applies to products placed on the market after 12 September 2026. The access regime is flanked by pre-contractual information duties (Art. 3(2) and (3)), a fairness test for unilaterally imposed business-to-business contract terms on data access (Art. 13) and rules on making data available to public sector bodies in situations of exceptional need (Chapter V).
The second major block concerns switching between data processing services, that is cloud and edge services (Chapter VI, Art. 23 to 31). Providers must remove pre-commercial, commercial, technical and contractual obstacles to switching: the contract must provide for a maximum notice period of two months and a transitional period of, as a rule, no more than 30 calendar days, must list the exportable data and digital assets, and requires deletion of the data once the switch is complete. Since the date of application, switching charges may only be cost-based, and they must be withdrawn entirely from 12 January 2027. Art. 32 additionally requires technical, organisational and legal safeguards against unlawful access by third-country authorities to non-personal data held in the EU – the mirror image of Art. 48 GDPR and the point where the Data Act meets the US CLOUD Act. Enforcement lies with the competent authorities designated by the Member States; in Germany the Federal Network Agency is foreseen as data coordinator, while supervision of personal data processing stays with the data protection supervisory authorities.
For the boundary with data protection law, Art. 1(5) of the Data Act is decisive: the Regulation is without prejudice to EU data protection law and, in particular, creates no legal basis of its own for processing personal data; in the event of conflict, the GDPR prevails. In practice this means that where product data are personal data and the user is the data subject, the Data Act access right and the right of access under Art. 15 GDPR overlap. Where the user is a legal person, or where the data also concern other individuals such as passengers, employees or household members, disclosure additionally requires a legal basis under Art. 6 GDPR, and the data holder may only make the data available if one exists. Substantively, the Data Act reaches further than the right to data portability under Art. 20 GDPR: it also covers non-personal and mixed datasets, is not limited to consent or contract as a legal basis, and calls for provision in real time wherever feasible. Note that in November 2025 the European Commission proposed, as part of the Digital Omnibus package, to consolidate and simplify EU data legislation including the Data Act; that proposal is still going through the legislative process, so individual requirements may yet change.
Legal Basis
Regulation (EU) 2023/2854 (Data Act), in particular Art. 3 to 5, Art. 13, Art. 23 to 31 and Art. 32; Art. 1(5) Data Act in relation to Art. 15 and Art. 20 GDPR
Practical Example
A machinery manufacturer operates a fleet of connected production lines at customer sites and analyses sensor data for predictive maintenance. After the Data Act became applicable, one customer demands that the sensor and operating data from its machines be shared on an ongoing basis with an independent maintenance provider. Together with the sales team, the data protection officer works out which data fields fall within scope, separates raw data and metadata from the company's own derived analytics – which do not have to be handed over – and identifies a personal-data element: the machines log operator IDs. For that part she documents a legal basis under Art. 6 GDPR or pseudonymises the IDs before sharing, adds the new recipient to the record of processing activities, concludes a data-sharing contract with terms that meet the fairness test in Art. 13 Data Act, and updates the pre-contractual product information. In parallel she has the cloud contract holding the telemetry reviewed, because it does not yet reflect the switching requirements of Art. 23 et seq. Data Act.