IoT Data Access
Chapters II–III Data Act | Distinguish manufacturer, seller, related-service provider and data holder
What are connected products?
Connected products are physical products that:
- Obtain, generate or collect data about their use or environment
- Can communicate data via an electronic communications service, physical connection or on-device access; their primary function is not storing, processing or transmitting data on behalf of parties other than the user (Art. 2(5))
- May have a related digital service; its presence is not a mandatory element of every connected product
Examples of connected products
These are examples: each specific product must meet Article 2(5); Articles 1(2) and 7 further define the data and obligations in scope.
| Category | Examples | In scope |
|---|---|---|
| Smart Home | Thermostats, lighting, security systems, doorbells | Subject to definition and exceptions |
| Automotive | Connected vehicles, telematics; infotainment usage data, not content | YES, if Art. 2(5) is met |
| Industry 4.0 | Sensors, CNC machines, robots, production lines | Subject to definition and exceptions |
| Wearables | Fitness trackers, smartwatches, health monitors | Subject to definition and exceptions |
| Medical Devices | Connected diagnostics, monitoring, implants | Subject to definition and exceptions |
| Smart Appliances | Washing machines, fridges, dishwashers, HVAC | Subject to definition and exceptions |
| Energy | Smart meters, solar inverters, EV chargers | Subject to definition and exceptions |
Determine the product, data and legal role
Personal data is not excluded from the Data Act; GDPR continues to apply and takes precedence in a conflict. The Data Act gives the data holder no new basis for collecting or generating personal data, or a new right to use it. For access, it distinguishes whether the user is the data subject; if not, a GDPR legal basis and any further applicable conditions must be satisfied (recital 7, Articles 4(12) and 5(7)). DORA-regulated financial entities have no blanket Data Act exemption.
Smartphones, tablets and connected cameras are not excluded as a class. Distinguish product/related-service data about use and the environment from content such as an audiovisual recording. The Commission’s FAQ gives smartphones and televisions as examples and distinguishes a camera’s operational data from audiovisual content. Assess Article 2 definitions and Chapter II exceptions, including the relevant micro/small-enterprise provisions in Article 7.
Duties by legal role
Chapter II: Data Access Rights
Access concerns product/related-service data within the statutory definitions, including readily available data under Articles 4–5, not every inferred insight, secret or retained historical dataset. Direct access applies where relevant and technically feasible; trade-secret/security restrictions have specific conditions and must not become a blanket refusal.
Chapter III: B2B Data Sharing
Articles 8–12 set conditions where a duty to make data available arises under Article 5 or other applicable law; they do not create a general duty to share all data. For other legal duties, consider the Article 50 transition and Article 44 relationship with sectoral rules.
| Obligation | Description | Conditions |
|---|---|---|
| Sharing on request | Data holder must provide data to a third party | At the user’s request |
| FRAND conditions | Fair, Reasonable, Non-Discriminatory | Non-discriminatory pricing |
| Compensation | Non-discriminatory and reasonable; may include a margin. For SME and non-profit research recipients, capped at Article 9(2)(a) costs if they have no non-SME partner or linked enterprises | Art. 9(1)–(4); specific law may require lower or no compensation |
| Format for an Article 5 request | Comprehensive, structured, commonly used and machine-readable | Art. 5(1); no particular format is prescribed |
| Speed | Without undue delay | Continuously and in real time where relevant and technically feasible |
User rights
What a user can request
| # | Right | Description |
|---|---|---|
| 1 | ACCESS TO DATA | Readily available data from the product/related service used, free of charge; continuously and in real time where relevant and technically feasible |
| 2 | SHARING WITH THIRD PARTIES | Right to determine who receives the data (independent service, analytics provider) |
| 3 | RETAINED DATA | Access to readily available data under Articles 4–5, including relevant historical data, respecting previous users and other persons; this is not a general duty on the holder to retain data |
| 4 | INFORMATION BEFORE PURCHASE | What data the product generates, how to access it |
User restrictions (Article 4(10)–(11)): The user must not use data obtained through an Article 4(1) request to develop a connected product competing with the product from which the data originates, or share it with a third party for that purpose. The user must not use that data to derive insights about the economic situation, assets and production methods of the manufacturer or, where applicable, the data holder. The user must not use coercive means or exploit gaps in the data holder’s technical infrastructure designed to protect data to obtain access.
Restrictions for third parties (data recipients)
| Restriction | Description |
|---|---|
| Competing products | Must not use the received data to develop a product competing with the connected product from which it originates, or share it for that purpose (Art. 6(2)(e)) |
| Insights about the data holder | Must not use received non-personal product or related-service data to derive insights about the economic situation, assets and production methods of the data holder, or use by the latter (Art. 6(2)(e)) |
| Trade secrets | Must respect trade secrets |
| User choices and rights | Must not make user choices or the exercise of rights unduly difficult, including through coercion, deception or manipulation; or prevent a user who is a consumer from making received data available to other parties (Art. 6(2)(a), (h)) |
| Onward sharing | Only under a contract with the user and keeping trade-secret measures; never to gatekeepers (Art. 6(2)(c)–(d)) |
| Security, purpose and erasure | Must not adversely affect product or service security. Use only for agreed purposes; then erase unless otherwise agreed for non-personal data. Profiling only where necessary for the service requested by the user (Art. 6) |
Implementation requirements
For Manufacturing / Industry 4.0
PHASE 1: AUDIT (illustrative project stage)
- Inventory of all connected products
- Map generated data (type, volume, frequency)
- Identify data holders under Article 2(13): who has a right or obligation to use and make data available; technical access alone is insufficient
- Gap analysis vs. Data Act requirements
PHASE 2: TECHNICAL IMPLEMENTATION (illustrative project stage)
- API/interface for data access
- Authentication mechanism
- Data export function
- Real-time streaming (where applicable)
- Logging only as necessary under Articles 4(5) and 5(4)
PHASE 3: DOCUMENTATION (illustrative project stage)
- Terms of Service update
- Pre-purchase information
- User manual for data access
- Process for third-party requests
- SLA for data availability
PHASE 4: DATA ACCESS BY DESIGN (products and related services placed on the market after 12.9.2026)
- Design review for new products
- Built-in data access mechanisms
- User interface for access
- Testing and validation
Example technical options — choose for the product and security context
| Requirement | Specification |
|---|---|
| Data format | JSON, CSV, XML (machine-readable) |
| API | REST API recommended, documented |
| Authentication | OAuth 2.0 or equivalent |
| Real-time | WebSocket, MQTT for streaming |
| Export | Bulk export function (ZIP, tar.gz) |
| Metadata | Timestamp, source device, unit, accuracy |
Example use cases
Smart Factory (Industry 4.0)
SCENARIO: A manufacturing company has CNC machines from various manufacturers
| Aspect | Example of an existing obstacle | Potential use of Data Act rights |
|---|---|---|
| Data | Locked in proprietary systems | Company can access the product data covered by Articles 4–5 |
| Access | Manufacturer controls | Can share with independent service |
| Maintenance | Limited independent-service access to data | Own predictive maintenance |
| Integration | Vendor lock-in | Integration into central system |
Connected Vehicle
SCENARIO: Fleet of company vehicles
New company rights:
- Access to telematics data (consumption, location, diagnostics)
- Sharing with a third-party fleet management system
- Independent service can access diagnostics
- Available historical data for permitted purposes, respecting previous users and other persons
Smart Building
SCENARIO: Commercial building with IoT systems
Data access enables:
- Integration of different systems (HVAC, lighting, security)
- Third party for energy management
- Independent analytics for optimisation
- Predictive maintenance
Synergies with the AI Act
Data for AI training
The Data Act can provide access to defined product and related-service data under its conditions; it does not guarantee a lawful right to train any model on any obtained data. Check purpose, user/third-party rights, GDPR, intellectual property, trade secrets and restrictions on use. An access right alone does not authorise further training on personal data; assess the specific GDPR basis and conditions.
AI Act Article 10 sets data-governance requirements for relevant high-risk systems using data-driven training techniques, with its own scope. Shared lineage and quality evidence can support both assessments; joint documentation does not automatically satisfy both regulations.
Practical example
PREDICTIVE MAINTENANCE AI
| Regulation | Requirements |
|---|---|
| 1. DATA ACT | Right to access data from machines; Continuous/real-time access where relevant and technically feasible; machine-readable format (e.g. JSON) |
| 2. AI ACT | First determine whether the system is high-risk under Art. 6. Then assess data governance (Art. 10), documentation and monitoring; relevant Chapter III rules apply from 2 December 2027 for Art. 6(2), or 2 August 2028 for Art. 6(1), subject to Art. 111 transitions |
| 3. RESULT | Evidence for assessing lawful data access and the AI system’s applicable obligations |
Penalties
Article 40 requires Member States to establish effective, proportionate and dissuasive penalties. The GDPR-based fine route in Article 40(4) concerns infringements of Chapters II, III and V within the data-protection authorities’ competence. It is not a universal EUR 20 million/4% penalty for any IoT access dispute. Unfair terms under Article 13 may be non-binding under that provision; identify the actual duty, competent authority and national enforcement route.
Next steps
- Conduct an IoT product inventory
- Identify gaps vs. Data Act requirements
- Plan technical implementation
- Go through the complete checklist
Sources
Content reviewed: 6 September 2026. Primary sources: Data Act — Arts. 1–7, 13, 23–31, 35, 40, 50, Commission Data Act FAQ.