The Data Act

The Data Act aims to maximize the value of data in the economy by ensuring a wider range of stakeholders gain control over their data – making more data available for innovative use – while preserving incentives to invest in data generation.

Affected businesses

The Data Act is a wide-ranging and sector-neutral legislation and applies to a wide range of companies – including product manufacturers, software-as-a-service (SaaS) providers, and business-to-business (B2B) and business-to-consumer (B2C) providers.

The Data Act has an extraterritorial effect, which means it also applies to manufacturers of ‘connected products’, providers of ‘related services’, data holders and providers of data processing services located outside the European Union, where they (respectively) place a ‘connected product’ on the market in the EU, provide a ‘related service’ in the EU, make data available to recipients in the EU or provide data processing services to customers in the EU.

Key impacts

The key features of the Data Act are:

• Data sharing obligations for ‘connected products’ and ‘related services’ data.
• Facilitating the switching between cloud service providers, removing any pre-commercial, commercial, technical, contractual or organisational obstacles inhibiting customers from switching or terminating their agreements.
• Restrictions applicable to data sharing agreements in case of data sharing obligations and unfair unilaterally imposed terms.
• Data sharing obligations to share data with public bodies in cases of exceptional need.
• Nonpersonal data transfers by providers of cloud services to countries outside the European Economic Area without sufficient protection.

Enforcement

Member States shall lay down their own rules on penalties for infringement of the Data Act, ensuring those penalties shall be ‘effective, proportionate and dissuasive’.

Key timings

The Data Act entered into force on 11 January 2024 and will apply as of 12 September 2025. However, certain provisions will become applicable at a different date, namely:

• The obligations resulting from Article 3(1) – dealing with requirements for simplified access to data for new products – shall apply to connected products and services related to them after 12 September 2026.
• Chapter IV (Unfair Contract Terms Related to Data Access and Use between Enterprises) shall apply from 12 September 2027 to contracts concluded on or before 12 September 2025, provided they are of indefinite duration or due to expire at least 10 years from 11 January 2024.