The EU Data Act entered into force on January 11, 2024, but its main provisions began applying on September 12, 2025. As of October 8, 2026, it is not a new law “coming into force”: businesses are working under it, with cloud-switching and older-contract deadlines still ahead. The Act may create near-term compliance work, while aiming to reduce data silos and make it easier to switch cloud providers.
What the EU Data Act changes
Regulation (EU) 2023/2854 sets EU-wide rules for access to and use of data, particularly data generated by connected products and related services. It is intended to give users more access to that data, allow them to share it with third parties they choose, support repair and other aftermarket services, and make business data sharing and cloud switching more workable. It also addresses exceptional public-sector requests and unfair contractual terms imposed on smaller businesses. The regulation does not simply transfer ownership of a product’s data to its user.
Its ambitions are balanced by safeguards: personal data remains subject to the GDPR, and trade secrets and other legitimate interests must be protected. The Act operates alongside sector-specific rules rather than replacing them. The official regulation and the Commission’s Data Act explanation set out the framework.
Key dates: in force is not the same as applicable
| Date | Milestone | Practical meaning |
|---|---|---|
| December 22, 2023 | Published in the Official Journal | The adopted regulation was formally published. |
| January 11, 2024 | Entered into force | The law became part of the EU legal framework. |
| September 12, 2025 | Main provisions began applying | Most substantive obligations became operational. |
| September 12, 2026 | Article 3(1) product-design requirement applies to relevant products placed on the EU market after this date | Covered new connected products and related services must be designed to provide direct access to the required data. |
| January 12, 2027 | Cloud switching-charge phaseout | Providers must stop imposing charges for the switching process. |
| September 12, 2027 | Transitional treatment ends for specified older contracts | Chapter IV applies to certain contracts concluded before September 12, 2025, that are of indefinite duration or set to expire at least 10 years after their conclusion. |
| September 12, 2028 | Commission evaluation deadline | The Commission must evaluate specified aspects of the regulation. |
The dates follow Article 50 of the regulation and the Commission’s Data Act policy page. The 2026 milestone is significant for relevant new products, not a second start date for the whole Act.
#1 Best Overall
Who may be affected
Connected-product makers and data holders
Manufacturers and designers should assess connected products and related services that generate data about use or the surrounding environment. Examples can include vehicles, smart appliances, wearables, industrial machinery and agricultural equipment. A product being marketed as “smart” is not, by itself, enough to settle whether or how a particular obligation applies. Data holders—often entities that control access to product or service data—need to identify covered data, establish ways to make it available where required, and protect confidential and security-sensitive information.
Users and third-party services
Users can include consumers and businesses that own, rent or lease a connected product or use a related service. A consumer might seek data for an alternative repair service; a business might want operational data from machinery or a fleet. Users may, in appropriate circumstances, request access or direct data to a third party, such as a repairer, maintenance provider or analytics service. The Commission’s overview of user access to connected-device data describes the intended effect.
Cloud and data-processing providers and their customers
Chapter IV addresses switching between data-processing services, including cloud services, and the use of multiple providers. It concerns contractual transparency, technical support and interoperability as well as charges. Customers should not assume that a legal right to switch automatically makes a workload easy to move.
Public-sector bodies
The Act permits requests for privately held data in defined circumstances involving exceptional public need, including certain public emergencies. It is not a general power to demand any company’s data at will; the conditions in Chapter V matter.
What data access does—and does not—mean
The core question is not whether a company must disclose “all its data.” The obligation depends on the data, the parties, the request and the applicable safeguards. Businesses need to determine what a product or related service generates, whether data is readily available, whether it is personal or non-personal, and whether disclosure would expose trade secrets or conflict with another legal requirement.
- Do not assume that raw, processed and inferred data receive identical treatment.
- Where personal data is involved, the Data Act does not displace the GDPR. The lawful basis, data minimisation, security and other applicable data-protection requirements still matter.
- A request may involve information about people other than the requesting user, or reveal another company’s commercially sensitive information. Those issues need assessment rather than automatic disclosure or blanket refusal.
- Access rights do not necessarily provide a usable dataset without proprietary software, or transfer intellectual-property rights in a database, product or service.
The Commission’s Data Act explanation describes the framework; the binding text is available on EUR-Lex.
Cloud switching: fewer legal barriers do not mean a free migration
The Act aims to make switching providers and using multiple providers more feasible through clearer conditions, cooperation between outgoing and incoming providers, and support for transferring data and applications. Where applicable, it also addresses commonly used machine-readable formats and open interfaces. The relevant rules are in Articles 23–31.
Switching charges are phased out. During the transitional period, switching-related charges are limited to directly incurred costs; from January 12, 2027, providers must not impose charges for the switching process. That is not a promise that moving a cloud workload will cost nothing. Internal engineering, data transformation, application recoding, security work, testing, architecture changes and service downtime can still require substantial effort. A data export is not the same as application migration, functional equivalence or uninterrupted service.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Before relying on portability, customers should map managed databases, proprietary APIs, identity systems, monitoring and network dependencies; request the provider’s exit documentation; and test an export or migration path. The European Commission’s Data Act explanation outlines the switching framework.
Is regulation fatigue a fair concern?
“Regulation fatigue” is a concern, not a measured legal conclusion established by the regulation itself. Businesses may have to coordinate the Data Act with the GDPR, Data Governance Act, AI Act, Digital Services Act, Digital Markets Act, cybersecurity requirements and sector-specific rules. In practice, a data-access decision can involve legal, privacy, security, product, engineering, procurement and commercial teams at once. Smaller firms may have fewer people to handle that work.
The counterargument is that shared rules could reduce friction over time. Better access to equipment data may help independent repair, maintenance and analytics providers compete; clearer data-sharing terms may help smaller firms negotiate; and cloud-switching rules may reduce some forms of lock-in. Those outcomes depend on data being useful, systems being interoperable and alternatives actually being available. The Act may therefore add compliance work in the near term while trying to remove structural barriers over the longer term.
The Commission has published FAQs, model contractual terms, cloud contractual clauses, vehicle-data guidance and a Legal Helpdesk. Its Data Act FAQ page lists implementation support, including FAQs version 1.4 dated January 22, 2026. Support materials can clarify implementation, but do not erase the need to assess a company’s products, contracts and systems.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Best Value
What businesses should do next
Manufacturers of connected products
- Inventory relevant products and related services supplied, sold or leased in the EU.
- Map the data generated during use; classify it as personal or non-personal and distinguish raw, processed and inferred information where relevant.
- Identify the user, data holder and potential third-party recipients, then document how access requests will be handled.
- Review APIs, dashboards, export functions, formats and product documentation for user access and sharing.
- Assess trade-secret, cybersecurity, privacy and sector-specific constraints before setting disclosure procedures.
- Review contracts with customers, distributors, repairers and service partners, and apply the September 12, 2026 design milestone to relevant products placed on the EU market after that date.
Businesses using connected equipment
- List suppliers that control operational data and review contracts for access, use and onward-sharing terms.
- Ask what data is available, how it can be obtained and whether its format and timeliness support the intended use.
- Assess GDPR and other legal requirements if personal data is involved, and identify trade-secret or security restrictions.
- Consider whether repair, maintenance, fleet-management or analytics providers could make useful use of the data.
- Bring Data Act requirements into procurement and supplier negotiations rather than treating them as an afterthought.
Cloud customers
- Inventory cloud and other data-processing services, including applications, data, configurations and technical dependencies that would need to move.
- Request the provider’s switching process, formats, interfaces, cooperation commitments and exit documentation.
- Test exports and migration routes; do not infer portability from a contractual promise alone.
- Separate provider switching charges from internal engineering, migration, testing and continuity costs.
- Plan a rollback and business-continuity approach, and review contracts for service continuity and exit assistance ahead of the January 12, 2027 charge phaseout.
Enforcement and implementation support
Member States must designate competent authorities. The regulation’s enforcement provisions do not create one blanket fine that automatically applies to every breach across the EU. For certain infringements involving Chapters II, III and V, data-protection supervisory authorities may impose administrative fines under the GDPR framework within their competence, including the ceiling referenced in GDPR Article 83(5). The relevant authority and penalty depend on the obligation and jurisdiction. See the regulation’s enforcement provisions.
Implementation materials available from the Commission include the FAQs, Data Act explanation, model contractual terms, draft cloud contractual clauses, vehicle-data guidance and a Data Act Legal Helpdesk. These resources are starting points; companies still need to confirm how the rules apply to their circumstances.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
