The Data Act is Regulation (EU) 2023/2854 on harmonized rules on fair access to and use of data. In data regulation it is the EU law that decides who may use the data generated by connected products and related services, on what terms data must be shared between businesses, when public bodies may request data, and how customers can switch between cloud and other data processing services.
Unlike the GDPR, which protects people with respect to personal data, the Data Act covers both personal and non-personal data and focuses on economic access and fairness. It entered into force on 11 January 2024 and has applied in general since 12 September 2025, with some provisions following later. This description is for orientation and is not legal advice.
What the Data Act regulates
The Data Act is organized into separate chapters that address distinct data situations. A single company can be affected by several of them at once, for example as a manufacturer of connected machines and as a customer of a cloud provider.
| Chapter topic | Core rule | Main addressees |
|---|---|---|
| Connected product data | Users can access and share data their products and related services generate | Manufacturers and data holders |
| Conditions for making data available | Sharing on fair, reasonable and non-discriminatory terms | Data holders and data recipients |
| Unfair contractual terms | Unilaterally imposed data terms that are unfair do not bind the other enterprise | All businesses contracting on data |
| Exceptional need of public bodies | Data must be provided to public bodies in defined emergencies | Data holders, public sector bodies |
| Switching data processing services | Removal of obstacles to changing cloud and edge providers | Cloud and other processing providers |
| Interoperability and safeguards | Interoperability requirements and protection against unlawful foreign access | Providers, data space participants |
Access rights for users of connected products
The central idea is that the user of a connected product, whether a consumer or a business, should benefit from the data the product generates. Connected products include vehicles, industrial machines, smart home devices and agricultural equipment; related services are digital services, such as a companion app, that change how the product functions.
The user may access the data directly where the design allows, request it from the data holder without undue delay, free of charge to the user, and ask that it be shared with a third party of the user’s choice, such as an independent repair shop. Content such as videos or texts is excluded; the rights cover raw and pre-processed data, not data that has been substantially enriched by proprietary algorithms.
Several safeguards limit these rights. Trade secrets may be withheld or protected through confidentiality measures, and in exceptional cases disclosure can be refused if serious economic damage is highly likely. Recipients may not use the data to develop a competing product, and companies designated as DMA gatekeepers cannot be eligible third-party recipients. Micro and small enterprises are exempt from the data holder duties in most cases.
The following table shows how the main roles in a connected product data flow relate to each other.
| Role | Position in the flow | Key right or duty |
|---|---|---|
| User | Owns, rents or leases the product | Access data and direct its sharing |
| Data holder | Controls access to the generated data | Make data available to the user and chosen recipients |
| Data recipient | Third party chosen by the user | Use data only for agreed purposes, not to build a competing product |
| Manufacturer | Designs and places the product on the market | Design products for data access and inform users before purchase |
Cloud switching and interoperability
The Data Act tackles vendor lock-in in cloud computing. Providers of data processing services must remove commercial, technical, contractual and organizational obstacles that prevent customers from switching to another provider or to their own infrastructure, including multi-cloud use.
- Maximum notice period of two months for initiating a switch.
- Transition period of up to 30 calendar days, extendable when technically unfeasible.
- Export of all exportable data and digital assets in a structured, commonly used format.
- Switching charges limited to cost-based levels until 12 January 2027 and abolished afterward.
- Transparency on jurisdiction and on safeguards against unlawful foreign governmental access.
For infrastructure-type services, providers must aim for functional equivalence at the destination. Open interoperability specifications and harmonized standards are expected to support these duties as they mature.
Application dates and the policy context
The Data Act applies in several phases. The dates below follow the adopted text, but parts of the framework may be amended, so practitioners should confirm current requirements before relying on them.
| Date | What applies | Note |
|---|---|---|
| 11 January 2024 | Entry into force | Fixed |
| 12 September 2025 | General application of most chapters | In application |
| 12 September 2026 | Access-by-design duty for newly placed connected products | Applies to products placed on the market after this date |
| 12 January 2027 | Full abolition of switching charges | Reduced charges allowed until then |
| 12 September 2027 | Unfair terms rules extend to certain older long-term contracts | Contracts concluded before September 2025 |
In late 2025 the Commission proposed a Digital Omnibus package that would fold the Data Governance Act and related rules into a consolidated data framework and adjust some Data Act provisions. Until the legislative process ends, such changes remain proposals subject to change. Penalties are set by member states, and breaches involving personal data can also trigger GDPR-level fines.
How the Data Act differs from related data laws
The Data Act is one piece of the EU data strategy and is often confused with its neighbors. The comparison clarifies the boundaries.
| Instrument | Main purpose | Difference from the Data Act |
|---|---|---|
| GDPR | Protection of personal data | Data Act adds access rights but never overrides GDPR |
| Data Governance Act | Trust in data intermediaries and data altruism | Builds sharing structures rather than access rights |
| Open Data Directive | Reuse of public sector information | Concerns public bodies, not connected products |
| Free Flow of Non-Personal Data Regulation | Bans unjustified data localization | Earlier porting rules, now strengthened by switching duties |
A frequent mistake is to treat the Data Act as a privacy law. Where personal data is involved, a valid GDPR legal basis is still needed before the data holder shares it, and the two assessments must be made together.
Put simply
Many products now collect data while you use them. A tractor records soil and fuel figures. A car logs engine faults. Until recently, the maker usually kept that data to itself.
The Data Act says the people who use these products should get the data too. They can pass it to a repair shop or another service of their choice. The law also makes it easier to move from one cloud provider to another without heavy exit fees.
In practice
A farming cooperative leases twenty connected tractors from a large manufacturer. The tractors record engine hours, fuel use and fault codes. The cooperative wants an independent repair workshop to plan maintenance, so it asks the manufacturer, as data holder, to share the tractor data with the workshop under the Data Act.
The manufacturer provides the raw usage and diagnostic data through an interface, agrees reasonable compensation with the workshop, and protects confidential calibration logic under a trade secret agreement. The workshop may use the data only for maintenance, not to design a rival tractor. The cooperative gains a real choice of service partner, and breakdown planning becomes faster and cheaper.