The EU Data Act, what it means for your products and cloud services

Design and make connected products, and design and provide related services, so product data and related service data, with the metadata needed to use it, are by default easily, securely, free of charge, structured, machine-readable and, where relevant and feasible, directly accessible to the user.

Before a purchase, rent or lease of a connected product, tell the user the type, format and estimated volume of data the product can generate, whether it is continuous and real-time, whether it is stored on the device or a remote server and for how long, and how to access, retrieve or erase it.

Before a related service contract, give the user information on the nature, volume and collection frequency of data, how to access it, storage and retention, whether you will use the data and for what purposes, whether third parties may use it and who the data holder is.

Where the user cannot access data directly, make readily available data and its metadata accessible without undue delay, of the same quality as you have, easily, securely, free of charge, in a structured machine-readable format and, where relevant, continuously and in real time, on a simple electronic request.

Users and data holders may restrict or prohibit access, use or sharing of data by contract only if it could undermine product security requirements in law and seriously harm the health, safety or security of people, and a refusal must be notified to the competent authority.

On a user's request, make readily available data and metadata available to a third party without undue delay, at the same quality, easily, securely, free of charge to the user, in a structured machine-readable format, under the terms of Articles 8 and 9.

A third party receiving data processes it only for the purposes and conditions agreed with the user, subject to data protection law, and erases it when no longer needed for the agreed purpose.

A third party must not make it unduly difficult for the user to exercise choices, including by manipulating or deceiving the user, and must not use the data for profiling unless necessary to provide the requested service.

When you must make data available to another business, agree the arrangements on fair, reasonable and non-discriminatory terms, transparently, and know that a term that is unfair or that cuts back the user's Chapter II rights is not binding.

Do not discriminate between comparable categories of data recipients, including your own partner or linked enterprises.

Compensation agreed between a data holder and a data recipient must be non-discriminatory and reasonable and may include a margin, taking into account costs of making the data available and investments in producing it.

A data access or use term unilaterally imposed on another enterprise is not binding if it is unfair, meaning it grossly deviates from good commercial practice, contrary to good faith and fair dealing.

Treat as unfair terms that, for example, exclude or limit liability for intentional acts or gross negligence of the party that imposed the term, or exclude the other party's remedies.

Make data available on a duly reasoned request from a public sector body, the Commission, the European Central Bank or a Union body that shows an exceptional need, limited in time and scope, such as responding to a public emergency.

Check that a request specifies the data, shows the exceptional need, explains the purpose, intended use and duration, the planned erasure, why you were chosen and who the data will be shared with.

Make the data available without undue delay, and if you decline or seek changes to a request, say so promptly and within five working days where the data is needed to respond to a public emergency.

Provide data needed for a public emergency free of charge unless you are a micro or small enterprise, and know you are entitled to fair compensation in other cases.

Take the measures in Articles 25, 26, 27, 29 and 30 so customers can switch to another provider, to on-premises infrastructure, or use several providers at once, and remove commercial, technical, contractual and organisational obstacles.

Set the customer's switching rights and the provider's obligations out in a written contract that the customer can store and reproduce before signing.

Include clauses allowing switching or porting of all exportable data without undue delay and within a mandatory maximum transition period of 30 calendar days, with assistance and continuity during it, a maximum notice period of two months and support for the customer's exit strategy.

List exhaustively the categories of exportable data and digital assets, any provider-internal data exempt from export for trade secret reasons, a data retrieval period of at least 30 days, full erasure after that and the switching charges allowed.

Give customers information on available switching and porting procedures, methods and formats and known limits, and cooperate in good faith, including destination providers, to make switching work.

Publish and keep up to date the jurisdiction that governs your ICT infrastructure for each service and a general description of measures to prevent unlawful international government access, and list those web pages in contracts.

Charge nothing for the switching process from 12 January 2027, and until then charge no more than the costs directly linked to switching.

Give prospective customers clear information on standard fees, early termination penalties and any reduced switching charges before contract, flag services where switching is highly complex or costly, and publish this on a dedicated web page.

Providers of infrastructure-type services (such as servers, networks and virtual resources) take all reasonable measures to help the customer reach functional equivalence on the new service after switching.

Take adequate technical, organisational and legal measures to prevent international or third-country government access to, or transfer of, non-personal data held in the Union where that would conflict with EU or national law, and recognise a third-country order only if it rests on an international agreement.

Participants in data spaces that offer data or data services meet the essential interoperability requirements, starting with describing dataset content, licences, collection methods, quality and uncertainty in a machine-readable form.

Support interoperability for customers who use data processing services in parallel by applying the main switching duties, and charge data egress fees for that parallel use only to pass on the costs actually incurred.

Vendors and deployers of smart contracts used to execute data sharing agreements make sure they meet essential requirements such as robustness and access control and safe termination and interruption.

Know that each Member State designates competent authorities (and a data coordinator where there is more than one), that users and others can lodge complaints, and that Member States set effective, proportionate and dissuasive penalties.

Do not rely on the database sui generis right to block access to data generated by a connected product or related service that falls within scope, especially for Articles 4 and 5.