EU Data Act
Also known as: Data Act, Regulation (EU) 2023/2854, EU data sharing regulation
The EU Data Act is a regulation that gives users of connected products, such as cars, appliances, and industrial machines, the right to access and share the data those products generate.
It also makes it easier to switch between cloud providers. While GDPR protects personal data, the Data Act deals with who gets to use data in general, including non-personal machine data, and that's a very different fight.
EU Data Act, explained at three levels
At home
Think of the EU Data Act as giving you the keys to the data your devices generate. Your car, smart fridge, or fitness tracker records how you use it, and often only the manufacturer could read that data. If you're in the EU, the Data Act lets you get that data and share it with someone you choose, such as an independent repair shop.
At work
The EU Data Act is a regulation on who may access and use data generated by connected products and related services, including non-personal machine data. It requires manufacturers to share that data with users and their chosen third parties, restricts unfair data-sharing contract terms, and makes switching cloud providers easier. Businesses care because it reshapes data rights in contracts and opens aftermarket competition.
At home
The Data Act works through roles. You are the 'user' of a connected product, the manufacturer or service provider is the 'data holder,' and anyone you choose, such as a mechanic or insurer, can become a 'data recipient.' On request, the data holder must give you or your recipient the product data, free of charge to you, in a usable format. For products placed on the market from September 2026, access must be built in by design.
At work
Key obligations include giving users and their chosen third parties access to product and related service data, on fair, reasonable, and non-discriminatory terms for recipients; a test that voids unfair data-sharing terms one business imposes on another; public sector access in cases of exceptional need; and cloud switching rules covering notice periods of no more than two months, data export, and functional equivalence. Gatekeepers under the Digital Markets Act cannot be data recipients.
At home
The Data Act overlaps with GDPR whenever product data is personal, and in those cases GDPR still governs the personal side. That raises tricky questions about mixed data, such as a shared household device or a car with several drivers, where the data is personal to someone other than the user making the request. In my view, the interaction will be messy at first, and regulators will need to issue guidance to sort it out.
At work
Manufacturers can withhold trade secrets in limited cases, with confidentiality measures, but they can't use that as a blanket refusal. Cloud and data processing providers must remove contractual, commercial, and technical barriers to switching, support interoperability, and phase out switching and egress charges entirely by January 2027. The Commission's late 2025 'digital omnibus' proposal would fold other EU data rules into the Data Act. For cloud buyers, the law strengthens leverage on exit terms.
Real-world examples
At home
Lena owns a connected e-bike in Vienna. When it needed repairs, she used her Data Act rights to get the diagnostic data from the manufacturer's app and shared it with an independent repair shop, which fixed it faster and more cheaply than the official dealer.
At work
Thomas negotiates cloud contracts for a German manufacturer. Citing the Data Act, he secured clearer exit provisions and a commitment to waive data egress charges when switching providers, terms the vendor had previously refused.
How it compares
| feature | EU Data Act | GDPR |
|---|---|---|
| Main focus | Access to and sharing of product and service data | Protection of personal data |
| Data covered | Personal and non-personal data | Personal data only |
| Key right | Users can access and share data from connected products | Individuals can access, correct, and delete their data |
| Cloud rules | Switching and interoperability requirements | None specific |
| Applies from | September 2025 (main provisions) | May 2018 |
GDPR protects individuals' personal data; the Data Act decides who can use data from products and services.
For analysts
The Data Act's cloud switching rules are a negotiating tool. I'd revisit cloud contracts at renewal and ask for exit terms that match the regulation, since many vendors will concede them more easily than in the past.
History & origin
The European Commission proposed the Data Act in February 2022 as part of its data strategy, aiming to unlock data held by manufacturers and platforms. It was adopted in late 2023, entered into force in January 2024, and most provisions applied from September 12, 2025. Obligations to design new connected products for data access by default apply from September 2026, and cloud switching charges must be phased out entirely by January 2027. In late 2025, the Commission also proposed a 'digital omnibus' package that would simplify and consolidate some EU data rules. In my opinion, the Data Act takes aim at a real problem: manufacturers quietly treating data from products you bought as their own.