The EU Data Act applies to connected-product data, data sharing, unfair data terms and cloud switching. Article 3 design duties now apply to products placed on the market after 12 September 2026.
Vassilev & Chisuse Law Firm · 2026-10-11 · Legal review: 12 October 2026
The EU Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025. It changes how businesses design connected products and related services, give users access to generated data, share data with third parties, contract for data access and switch between cloud and other data-processing services.
A further milestone was reached after 12 September 2026: the design obligation in Article 3(1) applies to connected products and related services placed on the market after that date. Manufacturers and providers launching new connected products should therefore treat data access as a product-design and contract issue, not only as a response process after a customer asks for data.
The Data Act can affect manufacturers of connected products, providers of related services, data holders, users of connected products, third parties receiving data at a user's request, providers of data-processing services and public-sector bodies requesting data in situations of exceptional need.
Its practical reach extends beyond traditional technology companies. Connected industrial machinery, vehicles, medical and health devices, smart-home equipment, energy systems and other products that generate retrievable data can fall within the framework, as can software or services that are connected to the operation of those products.
A connected product is a product that obtains, generates or collects data concerning its use or environment and that is able to communicate product data through an electronic communications service, physical connection or on-device access, where its primary function is not storing, processing or transmitting data on behalf of another party.
The classification therefore depends on what the product does and what data it generates, not on whether it is marketed using terminology such as smart, digital or Internet of Things. Product and service teams should map the data generated during use and identify which data is retrievable within the meaning of the Regulation.
For connected products and related services placed on the market after 12 September 2026, Article 3(1) requires design and manufacture to make product data and related service data, together with relevant metadata, easily, securely and free of charge accessible to the user by default in a comprehensive, structured, commonly used and machine-readable format. Where relevant and technically feasible, the data must be directly accessible to the user.
This requirement affects product architecture, interfaces, authentication and data export. A manufacturer cannot address it only through terms and conditions if the technical design makes the relevant data practically inaccessible.
Before the contract is concluded, the seller, rentor or lessor must provide specified information about the data that the connected product can generate and how the user can access, retrieve or erase data where applicable. Related-service providers have corresponding pre-contractual information duties under the Regulation.
Product descriptions, sales contracts and service terms should therefore be coordinated with the technical reality of the product. Statements about data volume, real-time generation, storage, access and intended use should be accurate and capable of being implemented.
Yes. The Data Act gives users rights to access data generated by the use of connected products and related services and, subject to the Regulation's conditions, to require the data holder to make that data available to a third party designated by the user.
This can support independent maintenance, repair, analytics and other data-driven services. Data holders should establish a process for verifying requests, identifying the data covered, protecting security and trade secrets and applying the statutory conditions for making data available.
The Data Act does not abolish trade-secret protection. Where data to be shared contains trade secrets, the Regulation provides safeguards and allows appropriate technical and organisational measures to preserve confidentiality. In defined exceptional situations, a trade-secret holder may refuse or suspend data sharing where the statutory conditions concerning serious economic damage are satisfied.
Businesses should avoid using a generic trade-secret label as a reason to reject every request. At the same time, they should identify genuinely confidential elements in advance and establish proportionate safeguards, contractual protections and escalation procedures.
Chapter IV of the Data Act addresses unfair contractual terms concerning access to and use of data when those terms have been unilaterally imposed on another business. The Regulation contains a framework for terms that are unfair or presumed unfair, with particular relevance to bargaining imbalances in data-sharing relationships.
The chapter applies to contracts concluded after 12 September 2025. From 12 September 2027 it also applies to specified older contracts of indefinite duration or with a very long remaining term. Businesses should therefore review long-term data clauses rather than assuming legacy agreements remain outside the regime indefinitely.
The Data Act contains a business-to-government mechanism allowing public-sector bodies, the Commission, the European Central Bank and specified Union bodies to request certain data held by businesses where there is an exceptional need and the conditions in the Regulation are met.
This is not a general right for authorities to demand any commercial dataset. Requests must satisfy the statutory grounds and procedural safeguards. Businesses receiving such a request should verify its legal basis, scope, necessity, security requirements and any compensation or confidentiality issues that apply.
Providers of data-processing services must remove contractual, commercial, technical and organisational obstacles that prevent customers from switching to another provider or using several providers at the same time. The Regulation also imposes minimum contractual requirements intended to make switching more transparent and workable.
Providers of platform and software services must support export in commonly used and machine-readable formats and provide open interfaces where the statutory conditions apply. Infrastructure providers have obligations aimed at functional equivalence when customers switch between services of the same type.
From 12 January 2027, providers of data-processing services must not impose switching charges on customers for the switching process. Until that date, the Regulation allows reduced switching charges during the transitional period, limited in accordance with the Data Act.
Cloud providers and customers negotiating contracts in late 2026 should therefore avoid pricing structures that will become incompatible within months. Exit clauses, data export, migration support, transition periods and technical assistance should be reviewed together.
The Data Act does not replace data-protection law. Where product or service data contains personal data, the General Data Protection Regulation remains applicable, including requirements concerning lawful basis, transparency, purpose limitation, data minimisation and data-subject rights.
A right to obtain or share data under the Data Act does not automatically create a lawful basis for every processing activity involving personal data. Businesses should classify datasets and distinguish non-personal data, personal data and mixed datasets before building access and sharing processes. VC Law's Data Protection practice advises on this interaction.
Data access must be provided securely. Businesses subject to cybersecurity regulation should align Data Act access mechanisms with access controls, authentication, incident management and supplier-risk measures under their wider security framework.
For organisations within the Bulgarian NIS2 regime, see our NIS2 guide. The two regimes pursue different objectives but can apply simultaneously to the same product, service or data architecture.
Manufacturers and related-service providers should identify connected products placed on the market after 12 September 2026 and assess whether Article 3(1) is reflected in their technical design. They should also review pre-contractual information, user access procedures, third-party data-sharing workflows and trade-secret protections.
Data-processing providers should review switching and exit clauses before the complete removal of switching charges on 12 January 2027. Businesses across sectors should also identify unilateral data-contract clauses that may fall within Chapter IV and prepare an internal process for public-sector data requests.
Vassilev & Chisuse Law Firm advises manufacturers, technology companies, data holders and customers on Data Act applicability, connected-product data access, contractual terms, third-party sharing, trade secrets, cloud switching and interaction with the GDPR and cybersecurity legislation.
This article reflects Regulation (EU) 2023/2854 and the EU guidance reviewed as of 12 October 2026 and is provided for general information only. It does not constitute individual legal advice. The applicable duties depend on the product, service, data, contractual role, company size and other relevant legislation.