The EU Data Act is a landmark regulation (EU 2023/2854) formally adopted on December 13, 2023, and published on December 22, 2023. Its primary goal is to establish common rules across all sectors of the European Economic Area to foster a fair, competitive data economy and grant users greater control over data generated by connected devices and services.
Timeline & Applicability
- January 11, 2024: Regulation enters into force.
- September 12, 2025: Obligations begin—for example, users must be allowed access to data generated by connected products.
- September 12, 2026: New devices must be designed to provide direct access to data (e.g., via APIs or user interfaces).
Scope & Definitions
- Covers both personal and non-personal data generated by “connected products” (IoT devices, vehicles, smart appliances) and related services.
- Applies extraterritorially—manufacturers or providers outside the EU that place connected products or services into the EU market are covered.
Key Provisions
1. User Data Access & Sharing (B2C & B2B)
- Data holders must allow users (whether consumers or businesses) to access user-generated data.
- If data isn’t directly accessible, users can request it be provided to themselves or a third party of their choice.
- Third parties can only access data if within the EU, preventing certain non-EU entities from obtaining access.
- Charges for data access must be Fair, Reasonable and Non-Discriminatory (FRAND) .
2. Unfair Contract Terms
- Providers cannot impose unilateral, unfair contractual terms, including clauses that limit liability for gross negligence.
- Data holders can reject requests to share trade secret data, but only under strict conditions and must document objections.
3. Public Sector Access (B2G)
- Public authorities can request data in exceptional situations, such as emergencies, provided there’s no comparable existing source .
4. Cloud Switching & Interoperability
- Strengthens cloud service customers’ abilities to switch providers freely, with improved portability and no lock-in.
- Requires providers to offer transitional services at capped fees until full migration.
5. Safeguards for Non-Personal Data Transfers
- Cloud and data-processing providers must block unauthorized third-country government access to non-personal data held in the EU.
6. Interoperability & Standards
- The regulation sets frameworks for data format standards, harmonized interfaces, and model contract clauses to drive seamless data exchange.
Enforcement & Penalties
- National supervisory authorities, supported by the European Commission, are charged with enforcement.
- Violations can lead to fines of up to €20 million or 4% of global annual turnover—whichever is higher.
Relationship with GDPR & Other Laws
- GDPR continues to govern personal data. In case of conflict, GDPR takes precedence.
- Extends portability rights beyond GDPR to include non-personal data and business-to-business contexts .
- Interacts with other EU regulations like the Digital Markets Act, Data Governance Act, and Cyber Resilience Act (formerly AI Act) under the EU Data Strategy.
Why It Matters
- Aims to unlock economic value—the EU estimates increased GDP by up to €270 billion by 2028.
- Empowers users—whether individuals or businesses—to control, reuse, and monetize the data generated by devices they own.
- Encourages a competitive ecosystem by lowering barriers to entry for smaller innovators.
- Providers of cloud services and connected products must reassess design, contracts, and infrastructure ahead of deadline dates.
Summary Table
| Aspect | Data Access / Sharing | Charging / Contracts | Interoperability | Cloud Switching |
| What users can do | Access data (B2C, B2B, B2G) | Pay FRAND fees | Use standards/interfaces | Migrate providers easily |
| What holders must avoid | Imposing unfair terms, denying access unfairly | Unilateral terms & fees | Lock-in barriers | Heavy switching restrictions |
| Technical obligations | Direct/indirect data access, APIs | Model contract clauses | Interoperable formats | Transitional service terms |
| Effective by | Sept 2025 (general), Sept 2026 (design phase) | Sept 2025/26 | Sept 2025/26 | Sept 2025 |
For Attorneys & Clients
If your clients are manufacturers, cloud providers, IoT developers, or ordinary businesses using connected devices:
- Advise a compliance roadmap—from audit to redesign—before Sept 2025/2026 deadlines.
- Review contractual terms, particularly around liability and data ownership.
- Ensure data interfaces are accessible and secure (APIs, download tools).
- Watch for cross-border implications—non-EU third parties and government access must be managed carefully.
In Conclusion
The EU Data Act is a sweeping regulation that repositions data as a strategic asset, mandating transparency, user rights, fairness, and portability across sectors. Its phased rollout gives stakeholders time to adapt, but the fines for non-compliance make timely action essential. As a regulatory cornerstone in Europe’s digital sovereignty agenda, it marks a major evolution in how data is shared, accessed, and monetized across the economy.