CyberLAWYERS.pt

Home / EU Regulation / Data Act

Data Act

Regulation (EU) 2023/2854 · in force since 11 January 2024, applicable since 12 September 2025

01What it is

The Data Act decides who may reach the data a connected product generates, and who may move data between service providers. It is not a data protection instrument. It is an instrument about access, and it reaches data whether or not anyone's personal data is in it.

Article 1(1) sets out six subjects: making product and related service data available to the user; making data available by data holders to data recipients; making private-sector data available to public bodies in cases of exceptional need; switching between data processing services; safeguards against unlawful third-country access to non-personal data; and interoperability standards.

The obligation that has already arrived. Article 3(1) requires connected products to be designed and manufactured, and related services designed and provided, so that the data they generate is accessible to the user by default — easily, securely, free of charge, in a structured, commonly used, machine-readable format. Under Article 50, that obligation applies to connected products and related services placed on the market after 12 September 2026. What the date turns on is placement on the market, not design. A product designed years earlier but first placed on the Union market after 12 September 2026 is within the obligation; one placed on the market before it is outside, until it is substantially modified.

02Who it applies to

Manufacturers of connected products and providers of related services placed on the Union market. Data holders who are obliged, by this Regulation or by other law, to make data available. Providers of data processing services — which in practice means cloud and edge providers, whatever they call themselves. And any enterprise that imposes data terms on another enterprise.

Chapter II does not reach everyone. Article 7 excludes data generated through connected products manufactured or designed, or related services provided, by a microenterprise or a small enterprise — provided it has no partner or linked enterprise that is larger, and is not subcontracted to manufacture, design or provide for someone else. The exclusion extends for a year to an enterprise that has only recently become medium-sized.

The duties do not fall on a single category of undertaking, which is why scoping is the first exercise. A manufacturer can be a data holder under Chapter II, a data recipient under Chapter III, the imposing party under Chapter IV and a customer under Chapter VI, in relation to the same product.

03Core obligations

  • Accessibility by design: product and related service data, with the metadata needed to interpret it, accessible to the user by default, free of charge and in a machine-readable format, directly where relevant and technically feasible (Article 3(1))
  • Pre-contractual information to the user, before purchase, rent or lease, on the type, format and estimated volume of data the product generates, and on how it may be accessed (Article 3(2))
  • Where data cannot be reached directly from the product: the data holder makes readily available data accessible to the user without undue delay, of the same quality as the holder has, free of charge, and where relevant and technically feasible continuously and in real time, on a simple electronic request (Article 4(1))
  • On the user's request, the same data made available to a third party the user names, free of charge to the user (Article 5(1))
  • Chapter III terms for making data available: fair, reasonable and non-discriminatory, and transparent (Articles 8 to 12)
  • No reliance on unfair terms about data access and use unilaterally imposed on another enterprise — those do not bind (Article 13)
  • Data made available to public bodies, the Commission, the ECB or Union bodies on a duly reasoned request where exceptional need is demonstrated (Articles 14 and 15)
  • Removal of pre-commercial, commercial, technical, contractual and organisational obstacles to switching data processing service, including to on-premises infrastructure and to parallel use of several providers (Article 23)
  • Measures to prevent third-country governmental access to non-personal data held in the Union where it would conflict with Union or national law; a third-country judgment or administrative decision is recognised or enforceable only on the basis of an international agreement in force (Article 32)

Switching charges fall to zero on 12 January 2027

Article 29 is staged. From 11 January 2024 to 12 January 2027 a provider may impose reduced switching charges, which may not exceed the costs directly linked to the switching process. From 12 January 2027 it may impose none at all.

But not for every service. Article 31(1) disapplies Article 29 — along with Article 23(d) and Article 30(1) and (3) — to a data processing service of which the majority of main features has been custom-built for an individual customer, or all of whose components were developed for that customer, and which is not offered at broad commercial scale through the provider's service catalogue. Article 31(2) disapplies the whole of Chapter VI to a non-production version supplied for testing and evaluation for a limited period. A provider relying on either must tell the prospective customer, before contracting, which obligations of the Chapter do not apply (Article 31(3)).

The duty that bites before then is informational: before entering into a contract, the provider must give the prospective customer clear information on standard service fees, early termination penalties and the reduced switching charges that may be imposed in the meantime. A contract signed now without that information is exposed now, not in 2027.

04Timeline

  1. 11 January 2024Entry into force.
  2. 12 September 2025General application. Chapter IV, on unfair contractual terms, applies to contracts concluded after this date. Chapter III applies in relation to data-sharing obligations under Union or national law entering into force after it. Member States were to have notified their penalty rules to the Commission by this date (Article 40(2)).
  3. 12 September 2026The Article 3(1) obligation reaches connected products and related services placed on the market after this date.
  4. 12 January 2027No switching charges may be imposed for a service subject to Article 29 (Article 29(1)), which is not every service — see Article 31.
  5. 12 September 2027Chapter IV reaches contracts concluded on or before 12 September 2025 which are of indefinite duration, or due to expire at least ten years from 11 January 2024.

05Where it meets the other regimes

Data Act ↔ GDPR — complement, and which one yields

Article 1(5) settles what is usually argued about. The Regulation is without prejudice to Union and national law on the protection of personal data, privacy and confidentiality of communications, and those laws apply to personal data processed in connection with its rights and obligations. Where the user is a data subject, the Chapter II rights complement the rights of access and portability in Articles 15 and 20 of the GDPR. The complement runs both ways: answering an Article 15 request does not discharge Article 4 or 5 of this Regulation, and answering those does not discharge Article 15.

And the conflict rule runs one way only: in the event of a conflict between this Regulation and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with that Union law, that law prevails. A data-access demand under Article 4 or Article 5 does not supply a lawful basis that the GDPR would otherwise require.

Data Act ↔ ePrivacy

Where an operation stores information on, or accesses information already stored in, terminal equipment, Article 5(3) of the ePrivacy Directive falls to be assessed on its own terms — including its two exceptions — alongside the access question under this Regulation, not after it. Article 1(5) preserves the law on integrity of terminal equipment expressly. A connected product is terminal equipment more often than product teams assume.

Data Act ↔ AI Act and CRA

The same connected product can be a product with digital elements under the CRA, carry an AI system under the AI Act, and generate data within Chapter II of this Regulation. Each classification is made under its own instrument. Compliance with one is not a defence under another, and the three ask different questions about the same device: whether it is secure, what the system does, and who may reach what it records.

06What we are instructed on

Scoping across the chapters, data access and sharing arrangements, Chapter IV review of data terms, switching and exit provisions in cloud contracts, third-country access exposure under Article 32, and the design questions that have to be answered before a product is placed on the market.

The practice →
Back to the Hub →
CyberLAWYERS.pt
Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.