EU Data Act: Connected Product Data, Cloud Switching and Fair Terms

The EU Data Act, Regulation (EU) 2023/2854, sets rules on who can access and use data generated in the EU economy. Its best-known part gives users of connected products, from smart appliances and fitness trackers to cars and factory machines, the right to access the data their use generates and to share it with third parties. It also requires manufacturers to design products that make this data accessible, and it reshapes cloud contracts by making switching between providers easier and, from 2027, free of switching charges.

The Data Act has applied since 12 September 2025, with further obligations in 2026 and 2027. In November 2025, the Commission proposed targeted amendments in its Digital Omnibus package. This guide explains who is covered, user rights and data holder duties, design obligations, cloud switching, unfair terms, public sector access, international data safeguards, enforcement and practical steps for technology companies.

What is the Data Act?

The Data Act is a cornerstone of the EU's data strategy. It aims to make more data available for use, while keeping incentives to invest in data generation, and to ensure fairness in how the value of data is shared. It complements the GDPR, which governs personal data, by covering both personal and non-personal data generated by products and services, and by regulating business relationships around data. Where personal data is involved, the GDPR continues to apply in full.

It was published in the Official Journal on 22 December 2023, entered into force on 11 January 2024, and applies from 12 September 2025.

Who must comply?

• Manufacturers of connected products placed on the EU market, and providers of related services, digital services that affect a product's functions, such as companion apps.
• Data holders with the right or obligation to use and make available data from connected products.
• Data recipients, third parties to whom data is made available.
• Providers of data processing services, including cloud and edge services such as IaaS, PaaS and SaaS, offered to EU customers.
• Businesses entering data-sharing contracts with other businesses.
• Public sector bodies requesting data in exceptional need.

Non-EU companies are covered when they place products on the EU market or provide services to EU customers. Micro and small enterprises have some exemptions from connected product obligations.

Is it mandatory or voluntary?

Mandatory for in-scope businesses. There is no certification. Member states designate competent authorities and set penalties that must be effective, proportionate and dissuasive; for personal data aspects, GDPR authorities enforce with GDPR-level fines.

Key dates

Date	What applies
11 January 2024	Entry into force.
12 September 2025	Most obligations apply, including user access rights, data sharing, unfair terms for new contracts, public sector access and cloud switching rules.
12 September 2026	Design obligations for connected products and related services placed on the market after this date.
12 January 2027	Switching charges, including data egress charges, must be removed; until then only cost-based charges are allowed.
12 September 2027	Unfair terms rules extend to certain older long-term contracts.

User rights to connected product data

Users, whether consumers or businesses, have the right to access data generated by their use of a connected product or related service, including relevant metadata, easily, securely, free of charge and, where technically feasible, continuously and in real time. They can also ask the data holder to share the data with a third party of their choice, such as a repair shop, insurer or app developer. Data holders must provide clear pre-contractual information about what data is generated, how it can be accessed and who holds it.

Design obligations

Connected products and related services placed on the market after 12 September 2026 must be designed and manufactured so that product data and related service data, including metadata, are by default easily, securely and, where relevant and technically feasible, directly accessible to the user, free of charge, in a complete, structured, commonly used and machine-readable format. This affects device firmware, cloud back ends and companion apps, and needs planning well before launch.

Data holder duties and protections

• Data holders may only use non-personal data on the basis of a contract with the user.
• They must not use data to derive insights about the user's economic situation that could undermine the user's commercial position.
• When sharing with third parties at the user's request, they must do so on fair, reasonable and non-discriminatory terms and may ask for reasonable compensation from business recipients, with limits for SMEs.
• Trade secrets are protected: data holders can require confidentiality measures and, in exceptional cases, refuse sharing where serious economic damage is likely, with justification.
• Third parties receiving data must not use it to develop competing products and must respect agreed purposes.
• Gatekeepers designated under the Digital Markets Act cannot be data recipients under these provisions.

What SaaS companies should know

Even without connected devices, SaaS companies are often "providers of data processing services" under Chapter VI. That means customer contracts must set out switching rights, notice periods, transition assistance, data formats and exit procedures, and egress or switching fees must be phased out by January 2027. Many SaaS providers are building self-service export tools that deliver customer data and relevant metadata in open formats, documenting known restrictions, and offering a structured exit process. Custom-built services and certain trial arrangements have lighter obligations, but most standard SaaS falls in scope. SaaS products that act as related services for connected products, such as an app controlling a device, also face the user data access rules.

Unfair contractual terms

The Data Act prohibits unfair contractual terms related to data access and use that are unilaterally imposed by one business on another. It lists terms that are always unfair, such as excluding liability for intentional acts or gross negligence, and terms presumed unfair, such as inappropriately limiting remedies or giving one party the exclusive right to interpret the contract. Unfair terms are not binding. The Commission has developed non-binding model contractual terms to help businesses draft fair agreements.

Cloud and edge switching

Chapter VI requires providers of data processing services to remove obstacles to switching to another provider or to on-premises infrastructure. Key requirements include:

• Written contracts setting out switching rights, a maximum notice period of two months and a transition period of up to 30 days, extendable in justified cases.
• Assistance with switching and exporting exportable data and digital assets.
• Information on available procedures, data formats, known restrictions and the location of infrastructure.
• Gradual withdrawal of switching charges: only cost-based charges are allowed until 12 January 2027, after which switching and egress charges must be removed.
• Interoperability measures, including open interfaces and compatibility with standards for certain services.

Some obligations are lighter for custom-built services and services provided under trial arrangements.

Public sector access in exceptional need

Public sector bodies, the Commission and EU agencies can request data from businesses where there is an exceptional need, such as responding to a public emergency, or in limited non-emergency cases where data is needed for a specific task in the public interest and cannot be obtained otherwise. Requests must be proportionate, explain the purpose and respect trade secrets and personal data rules. Micro and small enterprises are exempt from non-emergency requests.

International access safeguards

Providers of data processing services must take reasonable technical, legal and organisational measures to prevent international and third-country governmental access to non-personal data held in the EU where it would conflict with EU or national law. Requests from foreign courts or authorities are recognised only under international agreements or specified conditions.

Interoperability and smart contracts

The Data Act sets essential requirements for interoperability of data spaces and data processing services, and requirements for smart contracts used to execute data-sharing agreements, such as robustness, safe termination, data archiving and access control. The Commission can adopt common specifications where standards are insufficient.

Proposed amendments

In November 2025, the Commission's Digital Omnibus proposals included targeted amendments to the Data Act aimed at reducing burden, such as integrating other data legislation and adjusting certain obligations. As of October 2026, these proposals were still in the legislative process. Businesses should comply with the current text while tracking changes.

Enforcement and dispute settlement

Each member state designates competent authorities, and where there are several, a data coordinator acting as single point of contact. The Commission publishes a register of them. Data protection authorities remain responsible for personal data issues. Member states may certify dispute settlement bodies to help businesses and users resolve disagreements over data sharing terms and compensation, without preventing access to courts. Penalties are set nationally and must be effective, proportionate and dissuasive; for infringements involving personal data, GDPR-level fines can apply.

How to comply, step by step

1. Map your role: manufacturer, related service provider, data holder, recipient or cloud provider.
2. Inventory data generated by connected products and related services.
3. Prepare pre-contractual information for users.
4. Build user access and sharing mechanisms, such as portals and APIs.
5. Design new products for direct data access by default before September 2026 launches.
6. Review data-sharing contracts for unfair terms, using model terms.
7. Update cloud contracts with switching rights, notice and transition periods, and plan to remove switching charges by January 2027.
8. Protect trade secrets with confidentiality measures.
9. Set up processes for public sector and foreign government requests.

Documentation you will need

• Data inventories for products and services.
• User information notices.
• Data access and sharing procedures and API documentation.
• Data sharing contracts and fairness reviews.
• Cloud service contracts with switching terms.
• Trade secret protection measures.
• Records of data requests and responses.

Timeline and cost considerations

For connected product makers, the largest effort is architectural: exposing data securely to users and third parties, with authentication, authorisation and documentation, ideally before the September 2026 design deadline for new products. For SaaS and cloud providers, the main work is contract updates, export tooling and pricing changes ahead of January 2027. Legal reviews of data-sharing agreements can run alongside. Designing open data access from the start costs far less than retrofitting it into products already on the market.

Common mistakes

• Assuming it only applies to personal data.
• Locking data in proprietary formats or cloud back ends.
• Ignoring companion apps as related services.
• Keeping egress fees beyond January 2027.
• Using one-sided data terms with SME customers or suppliers.
• Forgetting GDPR when user data includes personal data.

Best practices, tools and technologies

• Design data access APIs and export features alongside product features.
• Use open, documented data formats and schemas.
• Offer self-service data portals with authentication and consent management.
• Automate tenant data export for cloud switching.
• Align with interoperability standards in your sector.

We build data access portals, export APIs, interoperable formats and cloud migration tooling through our API integration, SaaS product and migration services.

How the Data Act relates to other EU laws

Law	Relationship
GDPR	Applies to personal data; Data Act complements and does not override it.
Digital Services Act	Platform obligations; separate from data access rights.
Cyber Resilience Act	Security requirements for connected products, relevant to secure data access.
EU AI Act	AI rules; Data Act data access can support AI development.
Data Governance Act	Rules for data intermediaries and reuse of protected public data.

Real-world example

A European maker of smart HVAC controllers, with firmware and cloud work done by an Indian partner, prepares for the September 2026 design obligation. The team adds a user data portal and a documented API that exposes device readings and metadata in JSON, lets building owners authorise a third-party energy optimisation service to receive data directly, and updates product documentation with pre-contractual information. Contracts with installers are reviewed for unfair terms, and the cloud back end is designed so customers can export their data if they switch platforms.

Next steps

1. Identify your Data Act roles.
2. Build user access and sharing.
3. Design new products for direct access.
4. Fix cloud switching terms and charges.
5. Track the Digital Omnibus.

Frequently asked questions

What is the EU Data Act?

An EU regulation on fair access to and use of data, covering connected product data, cloud switching, unfair data terms and more.

When did the Data Act start to apply?

On 12 September 2025, with design obligations from 12 September 2026 and switching charge removal by 12 January 2027.

Does the Data Act apply to non-EU companies?

Yes, when they place connected products on the EU market or provide related or data processing services to EU customers.

What is a connected product?

An item that obtains, generates or collects data about its use or environment and can communicate it, such as smart devices, vehicles and machines.

Does the Data Act replace the GDPR?

No. The GDPR still applies to personal data; the Data Act covers both personal and non-personal data in specific contexts.

What does it mean for cloud providers?

They must support switching with defined notice and transition periods, export assistance and, from January 2027, no switching or egress charges.

Can data holders refuse to share data?

Only in limited cases, such as to protect trade secrets where serious economic damage is likely, with justification.

Are SMEs exempt?

Micro and small enterprises have exemptions from some connected product obligations and protections in data sharing.

What counts as an unfair term?

Unilaterally imposed data terms that grossly deviate from good commercial practice, including listed terms that are always or presumed unfair.

Is the Data Act changing?

The Commission proposed targeted amendments in the 2025 Digital Omnibus, which were still being negotiated as of October 2026.

Do SaaS providers have to stop charging egress fees?

Yes. Switching and data egress charges must be removed from 12 January 2027; until then, only cost-based charges are allowed.