The EU Data Act, applied since September 2025, lets users of connected devices get and share their data

On September 12, 2025, in Brussels, the European Commission announced that the EU Data Act had started to apply. The regulation, published in the EU's Official Journal on December 22, 2023, and in force since January 11, 2024, gives consumers and businesses that use connected products, from smartwatches and cars to industrial machinery, the right to access the data those products generate and to have it passed to a service of their choice. It also sets rules for switching between cloud providers, for unfair contract terms in data deals and for public bodies' access to private data in emergencies. More than a year on, the Commission's guidance and helpdesk are in place, and its own page still describes the changes it put forward in November 2025 as proposals.

Who gets which rights

The core rights are in Chapter II. A user, meaning any person or company that owns, rents or leases a connected product, can access the data generated by using it or a related service, such as an app. The user can share that data directly or ask the data holder, typically the manufacturer or the service provider, to send it to a third party. Gatekeepers designated under the Digital Markets Act cannot be chosen as recipients. Data holders must tell users what data a product generates, including its volume and how often it is collected, offer a simple way to request it and provide it to users free of charge.

The Commission gives two examples. A company running a bulldozer would typically be the user, and the bulldozer's manufacturer the data holder. Someone who buys a connected fridge and installs an app to manage its temperature could face two data holders, the company that sold the fridge and the one offering the app.

Direct access is required only where relevant and technically feasible, according to the Commission's FAQs, which leave manufacturers to decide whether a product gives users access with no other party involved or with added controls, typically through a remote server. The Commission's explainer adds that micro and small manufacturers and service providers do not carry the same obligations as larger companies.

The limits

The law balances users' rights against manufacturers' investments. Nobody may use the data obtained this way to build a rival connected product, though rivals may still compete in repair and other aftermarket services. Nor does the law oblige a data holder to pass data to a third party based outside the EU. Personal data is still governed by the GDPR, so where the user is not the person the data is about, it can be passed on only with a valid legal basis such as consent.

Trade secrets get their own procedure. Data holders and recipients can agree on confidentiality measures, and a data holder may withhold or suspend sharing if those measures are not respected. It may refuse outright only if it can show that disclosure is highly likely to cause it serious economic damage, and it must then notify the national competent authority. Users can challenge such a decision in court, through a complaint to that authority or before a dispute settlement body. When a business is required to share data with another business, it may ask for reasonable compensation, but small and medium-sized companies and non-profit research organizations can be charged no more than the costs of making the data available.

Cloud switching and the timetable

Chapter VI aims to make switching cloud and edge providers easier. Contracts must meet minimum requirements, providers must remove obstacles to switching or to using several services at once, and platform and software services must offer open interfaces and export data in a commonly used, machine-readable format. Since January 11, 2024, providers have been allowed to charge only the costs they incur for switching, including data egress. From January 12, 2027, they may not charge for switching at all, although the Commission's FAQs say a provider can still bill egress costs when a customer runs services from several providers in parallel.

The unfair-terms rules in Chapter IV protect businesses, particularly smaller ones, from one-sided data terms imposed on a take-it-or-leave-it basis. They apply to contracts concluded after September 12, 2025. Contracts concluded earlier fall under them from September 12, 2027, if they run indefinitely or expire at least 10 years after January 11, 2024, giving the parties time to renegotiate.

Enforcement and the Commission's case for it

Each member state designates one or more competent authorities, and where there are several, a data coordinator acts as the single national contact. Penalties are set nationally and must be effective, proportionate and dissuasive; the European Data Innovation Board helps coordinate them. Public bodies can also require data from companies in a public emergency, and in other exceptional cases ask for non-personal data, but micro and small companies are exempt from non-emergency requests.

The Commission presents the law as a way to open markets for repair and data-driven services. "The Data Act empowers users, opens markets, and gives businesses the data they need to create innovative services," Henna Virkkunen, the Commission's Executive Vice-President for Tech Sovereignty, Security and Democracy, said when it started to apply. She added that the Commission was equally committed to helping companies adapt and to reducing administrative burden.

What applies now, and what is only proposed

The Data Act has applied since September 12, 2025, with the later dates above still to come. The Commission's Data Act page, last updated on November 5, 2026, lists its published FAQs, guidance on vehicle data and draft model contract terms and cloud contract clauses, says a Data Act Legal Helpdesk is open, and says guidance on reasonable compensation for mandatory business-to-business data sharing is still to come.

Changes to the law have been proposed. In its Digital Omnibus of November 2025, the Commission proposed folding the Data Governance Act, the Open Data Directive and the regulation on the free flow of non-personal data into a single, restructured Data Act. The Commission links the simplification drive to the 2024 Draghi report, which blamed the EU's competitiveness gap partly on administrative burdens and inconsistent rules. Its digital rulebook page, also last updated on November 5, 2026, still describes the data changes as proposed revisions, while it reports that the separate omnibus amending the AI Act entered into force on July 27, 2026. Connected products also face security rules under a different law, the Cyber Resilience Act.