What is the Data Act?
The Data Act is an EU regulation that establishes harmonised rules on access to and use of data generated by connected products and related services. Its full name is Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828. According to Article 50 of the Regulation, most of its provisions apply from 12 September 2025, with certain exceptions.
The Data Act is intended to clarify who may access data, under what conditions data must be shared, and how contractual and technical restrictions should be assessed. It is particularly relevant for manufacturers, suppliers of connected devices, providers of digital services, cloud service providers, industrial users, public sector bodies and companies using data-driven business models.
The Regulation does not replace the GDPR. Where data generated by a connected product or related service includes personal data, the GDPR continues to apply. In practice, this means that organisations must analyse both regimes together: the Data Act may create an obligation to make data available, but any disclosure of personal data still requires a lawful basis, appropriate transparency, security measures and compliance with data protection principles.
What does the Data Act regulate?
The Data Act primarily regulates access to data generated by connected products, such as machinery, vehicles, industrial equipment, smart devices or other products capable of generating data and communicating it electronically. It also covers data generated by related services, for example digital services connected with the use or functions of such products.
A central concept of the Data Act is the distinction between the user, the data holder and the data recipient. The user is the person or entity that owns, rents or leases a connected product or receives a related service. The data holder is usually the entity that has the right or obligation to use and make data available. The data recipient is a third party to whom data may be made available, including at the user’s request.
The Regulation gives users stronger rights to access readily available data generated through their use of connected products and related services. In many cases, users may also request that such data be made available to a third party, for example a maintenance provider, insurer, analytics provider or other service provider. This can affect contractual relationships across supply chains, especially where manufacturers or platform operators previously controlled access to operational data.
The Data Act also introduces rules on unfair contractual terms concerning data access and use in business-to-business relationships. Terms unilaterally imposed by one party may be assessed as unfair if they grossly deviate from good commercial practice and create an imbalance between the parties. This is relevant for data licensing agreements, service contracts, manufacturing agreements, distribution arrangements and technology contracts.
Another important area concerns switching between data processing services, including cloud and edge services. The Data Act contains rules aimed at reducing obstacles to switching providers, including contractual, technical and economic barriers. Providers of such services should therefore review their terms, exit procedures, interoperability arrangements and technical documentation.
The Regulation also addresses access to data by public sector bodies in cases of exceptional need, safeguards against unlawful third-country governmental access to non-personal data, and interoperability requirements for data spaces and data processing services. These provisions may require operational procedures, internal controls and coordination between legal, compliance, IT and business teams.
When should legal advice on the Data Act be considered?
Legal advice on the Data Act may be needed when a company manufactures or distributes connected products, provides related digital services, operates platforms that collect product data, or offers cloud or other data processing services. It may also be relevant for businesses that depend on access to machine, sensor, vehicle, energy, logistics, production or usage data.
Companies should assess the Data Act when designing new products, drafting or renegotiating contracts, responding to user data access requests, sharing data with third parties, or building data monetisation models. Early legal review is also advisable where data includes trade secrets, confidential technical information, commercially sensitive data or personal data.
Entrepreneurs and corporate users may need support when they want to obtain access to data generated by equipment, devices or systems used in their business. The Data Act may strengthen their position in negotiations with manufacturers, service providers or platform operators, but the exact scope of access must be assessed in light of the Regulation, contract terms, technical feasibility, trade secret protection and data protection law.
A prompt consultation with a lawyer can help avoid incorrect contractual clauses, unlawful refusals to provide data, excessive disclosure of protected information, GDPR infringements, disputes with business partners, regulatory exposure or financial losses resulting from inadequate data governance.
Legal support in matters concerning the Data Act
Support of a law firm in the area of the Data Act may include in particular:
- assessment of whether a product, service or business model falls within the scope of the Data Act;
- review and preparation of contracts concerning data access, data sharing, licensing and use of data;
- analysis of user requests for access to data or transfer of data to third parties;
- preparation of procedures for responding to Data Act requests;
- coordination of Data Act compliance with GDPR requirements;
- protection of trade secrets and confidential business information when data must be made available;
- review of cloud service contracts, switching clauses and exit mechanisms;
- support in disputes concerning access to data, unfair contractual terms or refusal to share data;
- legal assessment of data-driven products, IoT solutions and digital service models before market launch.
Need assistance with the Data Act? Contact us.
See also
- Commercial Law
- Consumer Rights
- Intellectual Property
- Business Disputes