Skip to content

Data Act: Overview

Regulation: EU 2023/2854 Applicability: 12 September 2025 (main provisions) Scope: Data access and sharing (IoT, cloud, B2B)

What is the Data Act?

The Data Act is an EU regulation on harmonised rules for fair access to and use of data. It regulates access to data from connected devices (IoT), the rights of cloud service customers to switch between providers, and rules for B2B data sharing.

Main pillars

Who falls under the Data Act?

Directly regulated entities

EntityDescriptionExamples
IoT manufacturersManufacturers of connected productsSmart home, automotive, industrial machines
Service providersRelated services to IoTMobile apps and software controlling device functions (if within Art. 2(6))
Data holdersPersons with a right or obligation to use and make data available under Article 2(13); technical access alone is insufficientManufacturers, platform operators
Cloud providersIaaS, PaaS, SaaSAWS, Azure, GCP, Salesforce, SaaS companies

Rights holders (with their own obligations)

EntityNew rights
IoT usersAccess to data from their devices
Cloud customersRight to switching, data portability
SME and non-profit research recipientsArticle 9(4) compensation cap, provided they have no non-SME partner or linked enterprises
Third partiesAccess to data at the user’s request

Personal data is not excluded from the Data Act; GDPR continues to apply and takes precedence in a conflict. The Data Act gives the data holder no new basis for collecting or generating personal data, or a new right to use it. For access, it distinguishes whether the user is the data subject; if not, a GDPR legal basis and any further applicable conditions must be satisfied (recital 7, Articles 4(12) and 5(7)). DORA-regulated financial entities have no blanket Data Act exemption.

Smartphones, tablets and connected cameras are not excluded as a class. Distinguish product/related-service data about use and the environment from content such as an audiovisual recording. The Commission’s FAQ gives smartphones and televisions as examples and distinguishes a camera’s operational data from audiovisual content. Assess Article 2 definitions and Chapter II exceptions, including the relevant micro/small-enterprise provisions in Article 7.

Key obligations

Connected products: distinguish manufacturer, seller, service provider and data holder

ObligationDescriptionDeadline
Data accessEnsure user access to data12.9.2025
TransparencyPre-contract information by seller/lessor (Art. 3(2)) and related-service provider (Art. 3(3))12.9.2025
Real-time accessReadily available data, continuously/in real time where relevant and technically feasible12.9.2025
Machine-readableStructured, machine-readable format12.9.2025
Data access by designProducts and related services placed on the market after 12.9.2026after 12.9.2026

For providers of data processing services

Check the Article 2(8) definition and Article 31 exceptions; IaaS, PaaS or SaaS labels alone are insufficient. For the product table above, also check Article 7 exceptions.

ObligationDescriptionDeadline
Switching rightsEnable switching on request under Art. 25; distinguish notice and transition12.9.2025
Max notice periodAt most 2 months to initiate switching; assess early-termination charges separately12.9.2025
Data exportExportable data and digital assets within Arts. 2 and 25; technical requirements under Art. 3012.9.2025
Technical assistanceAssistance with migration12.9.2025
Prohibition of switching feesNo switching charges12.1.2027

Unilaterally imposed B2B data terms within Article 13

ObligationDescriptionDeadline
Fair termsUnfair unilaterally imposed terms are not bindingcontracts concluded after 12.9.2025
Existing contractsOnly the legacy contracts specified in Art. 50 (indefinite or sufficiently long duration)From 12.9.2027

Timeline

DateScope
12 September 2025Main applicability, including Chapter VI switching
After 12 September 2026Article 3(1) design/access duty for connected products and related services placed on the market after this date
12 January 2027Article 29 prohibition of switching charges; distinct from ordinary service fees or separately applicable early-termination charges
From 12 September 2027Chapter IV also applies to contracts concluded on/before 12 September 2025 if indefinite or expiring at least 10 years from 11 January 2024 (Art. 50)

There is no general “enhanced interoperability in September 2026 / full portability standardisation in September 2027” milestone. Technical duties follow Articles 30 and 35 and relevant standards/specifications.

Penalties

Article 40 requires Member States to establish effective, proportionate and dissuasive penalties. The GDPR-based fine route in Article 40(4) concerns infringements of Chapters II, III and V within the data-protection authorities’ competence. It is not a universal EUR 20 million/4% penalty for any IoT access dispute. Unfair terms under Article 13 may be non-binding under that provision; identify the actual duty, competent authority and national enforcement route.

Synergies with other regulations

Next steps

  1. Run a Quick Assessment -> Data Act Assessment template
  2. IoT Data Access obligations - for manufacturers of connected products
  3. Cloud Switching requirements - for SaaS/cloud providers and customers
  4. Review questions to assess your obligations

Sources

Content reviewed: 6 September 2026. Primary sources: Data Act — Arts. 1–7, 13, 23–31, 35, 40, 50, Commission Data Act FAQ.