EU Data Act: Obligations, scope of application and your roadmap for implementation

The EU Data Act brings far-reaching changes for the handling of data in Europe. The aim is to make access to data fairer, strengthen users' rights and promote innovation. To give you a quick overview, you will find the most important content summarised here in an easy-to-understand format.

User rights to data access (Chapter II)

The Data Act centres on the right of users to the data that their devices generate. Anyone who buys or uses a networked product such as a machine, a vehicle or a smart home device will in future be entitled to the data generated in the process. This data may not only be used by users themselves, but may also be passed on to third parties - such as repair services or software providers who provide additional functions.

Manufacturers may not restrict or deny access, not even through hidden clauses in contracts. At the same time, a distinction is made between readily available data and data that is difficult to collect: the latter does not have to be provided to the same extent. One important restriction concerns large digital platforms that fall under the Digital Markets Act (DMA). These so-called „gatekeepers“ may not automatically act as third parties in order not to further expand their market power.

Exemptions for public authorities (Chapter III)

The Data Act provides for government agencies to be granted access to company data in exceptional cases. This „exceptional need“ regulation only applies if it is really necessary - for example in the event of natural disasters, pandemics or other crises in which data is crucial for the common good. Authorities such as health authorities or statistical offices can then request non-personal data.

The following applies: the protection of business secrets takes priority and every request must be strictly justified. Micro and small companies are often exempt from this obligation so that they are not unduly burdened.

Protection against unfair contractual clauses (Chapter IV)

Another key point is the protection of companies from unfair contractual conditions. In practice, it is often the case that large market players impose clauses on smaller partners that restrict their rights - for example by restricting access to data or only granting one-sided usage rights.

The Data Act declares such clauses invalid in future. It also contains a list of contractual terms that are considered unfair in general or in certain cases. This is primarily intended to strengthen the negotiating position of small and medium-sized companies.

Cloud services: Change and transparency (Chapter VI & VII)

The regulations for cloud services are particularly relevant in practice. Many companies today complain that they are practically „stuck“ when switching providers - be it due to unclear contractual conditions, technical hurdles or high switching fees. The Data Act aims to break through these lock-in effects.

Cloud providers will be obliged to make it easier and more transparent to switch to other services. This includes open interfaces, clear information on data processing and security measures as well as the gradual abolition of switching and transfer fees. Such costs are to be completely banned by 2027 at the latest. For companies, this means more flexibility, the ability to implement multi-cloud strategies and less dependence on individual providers.

Access for public bodies (summarised outlook)

Finally, the Data Act also opens up new opportunities for authorities to access data. However, this is strictly regulated and limited to truly exceptional situations. It is important that both the interests of the general public and the protection rights of companies are safeguarded.