The IT director of a manufacturing company reviews a cloud contract before renewal: three months’ notice, data export “on agreed terms”, a transfer fee charged per gigabyte. The same week, the maintenance manager asks for raw sensor data from the compressors so the team can predict failures itself. The manufacturer replies that the data is available only in its own portal.
One regulation covers both situations. The EU Data Act gives users of connected devices a right to the data those devices generate, and gives cloud customers a right to switch providers within a defined timeframe. For a CISO this is not a topic for lawyers alone: every right to data opens a new interface, and every migration changes the risk map, so the act also touches cybersecurity.
What is the EU Data Act and when does it apply?
The Data Act is Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data. It was published in the Official Journal of the EU on 22 December 2023 and entered into force on the twentieth day after publication, that is on 11 January 2024. As a regulation it applies directly, without a national implementing act.
As of 13 September 2026. The timetable in Article 50 has four dates:
- 12 September 2025 — the regulation applies in full, including the rules on switching cloud providers;
- 12 September 2026 — the design obligation in Article 3(1) covers connected products placed on the market after that date;
- 12 January 2027 — the end of charges for the switching process itself (Article 29(1));
- 12 September 2027 — the rules on unfair contractual terms (Chapter IV) also cover contracts concluded on or before 12 September 2025, if they were concluded for an indefinite period or expire at least 10 years after 11 January 2024.
The text has not been amended so far: the CELLAR database holds a single consolidated version of it, dated 22 December 2023.
Who does the Data Act apply to?
For a company that uses cloud services and devices, the key roles are those in Article 1(3): manufacturer of a connected product, provider of a related service, data holder, user, and provider of data processing services, that is, the cloud. One organisation often holds several of them at once. The company in our example is a user of compressors and a cloud customer, and by selling its own devices with telemetry it also becomes a manufacturer.
A connected product (Article 2(5)) is an item that generates data about its use or environment and can communicate it, and whose primary function is not storing or transmitting data on someone else’s behalf. Recital 14 gives examples: vehicles, home equipment, medical devices, agricultural and industrial machinery, that is, devices known as the Internet of Things (IoT). A related service (Article 2(6)) is software without which the device could not perform one of its functions, such as a control app.
A data processing service (Article 2(8)) provides on-demand network access to scalable computing resources, and Recital 81 names three models: IaaS, PaaS and SaaS. The switching rules therefore also cover the SaaS applications a company uses every day.
Article 7 excludes the data-sharing obligations of Chapter II for products and related services of micro and small enterprises, as long as they have no partner or linked enterprises outside that category. The exemption protects the small manufacturer, not the small customer.
What does the Data Act change for companies using IoT devices?
Device data stops being the manufacturer’s exclusive domain. Article 3(1) requires connected products to be designed so that product data and related service data, together with the metadata needed to interpret it, are by default easily, securely and free of charge accessible to the user in a machine-readable format. The obligation covers products placed on the market after 12 September 2026.
For devices already running in your plant, two other provisions matter. Article 4(1) requires the data holder to make readily available data accessible to the user without undue delay, free of charge and of the same quality it has itself, where the user cannot access it directly. Article 5(1) lets the user request that the data be shared with a designated third party, for example a service company.
The moment of purchase changes too. Before a sale, rental or lease contract is concluded, the seller must disclose, among other things, the type, format and estimated volume of data the device generates and how to retrieve or erase it (Article 3(2)). It is worth adding this information to your purchasing criteria.
Key points:
- The Data Act has applied since 12 September 2025; the “data accessible by default” rule covers products placed on the market after 12 September 2026.
- A user can request data for itself (Article 4) or for a designated third party (Article 5).
- Before the purchase, the seller describes what data the device generates and how to retrieve it (Article 3(2)).
How does switching cloud providers work under the Data Act?
Switching follows a path that the contract must set out in writing (Article 25). The notice period that starts the process may not exceed two months, it is followed by a transitional period of at most 30 calendar days, and then the customer has at least 30 days to retrieve its data. Only after that does the provider erase the customer’s exportable data and digital assets.
During the transitional period the contract remains applicable, and the provider assists the customer and third parties it authorises, maintains business continuity and informs about known risks to that continuity (Article 25(2)(a)). If 30 days is technically unfeasible, the provider has 14 working days to justify this and indicate an alternative period, which may not exceed seven months (Article 25(4)). The customer may extend the transitional period once, as it sees fit (Article 25(5)).
The contract must also specify the data and assets that can be ported and the data excluded as internal provider data (Article 25(2)(e) and (f)), and Article 26 adds information on switching procedures and formats. These documents are the starting point of an exit plan, because they show what the provider has committed to hand over. The procedure also covers moving back to your own server room, which the act calls on-premises ICT infrastructure (Article 2(33)).
Can a cloud provider charge for switching?
Until 12 January 2027 a provider may impose only reduced charges, and from that date none at all. Article 29(2) and (3) allow, from 11 January 2024, switching charges that do not exceed the costs directly linked to the switching process concerned. Article 29(1) prohibits such charges from 12 January 2027.
The ban covers charges for the switching process itself. Article 29(4) lists three separate items that the provider must clearly disclose before the contract is signed: standard service fees, early termination penalties and reduced switching charges. When renewing a contract, ask for them separately.
Article 29(5) also requires information on services whose switching is highly complex, costly or impossible without significant interference in the data or architecture. That list points to the services you depend on most, which are the ones whose exit plan has to be prepared first.
What is functional equivalence and who must provide it?
Functional equivalence means re-establishing, in a new service of the same type, a minimum level of functionality that produces a comparable outcome in response to the same input (Article 2(37)). The duty to facilitate it applies only to providers of services limited to infrastructure elements such as servers, networks and virtual resources (Article 30(1)). Recital 86 states plainly that it does not apply to providers other than IaaS.
PaaS and SaaS providers must make open interfaces available free of charge and to an equal extent to all customers and destination providers (Article 30(2)), and until common interoperability specifications are published they export exportable data on request in a machine-readable format (Article 30(5)). Exporting data does not, however, guarantee that rules and automations will work at the new provider without rework.
Two exemptions are easy to miss. Article 31(1) releases services custom-built for an individual customer and not offered broadly through a catalogue from part of the obligations, including Article 29. Article 31(2) excludes the whole chapter for non-production test versions provided for a limited period.
How does the Data Act relate to cybersecurity?
The act builds security into the mechanisms for data access and switching, but it does not relieve companies of the duty to assess risk. Device data must be accessible “securely” (Article 3(1)), the data holder may contractually restrict access where it would undermine the product’s security requirements and could seriously affect the health or safety of people (Article 4(2)), and the user must not obtain data by abusing gaps in the data holder’s infrastructure (Article 4(11)).
When switching cloud providers, Article 25(2)(a)(iv) requires a high level of security throughout the process, including data security during transfer and during the retention period. Article 30(6) adds that providers are not required to take steps that would compromise the security and integrity of services.
From a CISO’s point of view, what the rules leave unsaid matters more. Every right to data creates a new interface: an account in the manufacturer’s portal, an API key for an integrator, an export file saved to someone’s drive. Add these points to your threat model before the first request reaches the manufacturer, because a fake “integrator” asking for compressor data has to be told apart from a real one. A migration between clouds opens a window in which the same data sits in two places and administrative privileges are broader than usual.
How does the Data Act relate to the GDPR?
Where the two acts conflict, the GDPR prevails. Article 1(5) of the Data Act provides that in the event of conflict, Union or national law on the protection of personal data or privacy takes precedence. The Data Act covers personal and non-personal data, so data from a company car falls under both regimes at once.
A right to device data does not create a legal basis for processing personal data. Where the user is not the data subject, the data holder makes personal data available only if there is a valid legal basis under Article 6 GDPR and, for special categories, the conditions of Article 9 are also met (Article 4(12)). For data subjects, the Chapter II rights complement the rights of access and data portability under Articles 15 and 20 GDPR.
What penalties apply for breaching the Data Act?
Each Member State lays down the type and level of penalties (Article 40(1)), which must be effective, proportionate and dissuasive. Article 40(3) lists criteria for setting them, including the gravity of the infringement, remedial action and the infringer’s annual turnover in the Union.
The regulation itself settles one case. For infringements of Chapters II, III and V, the supervisory authorities responsible for the GDPR may, within their scope of competence, impose fines in line with Article 83 GDPR up to the amount in Article 83(5), that is up to EUR 20 000 000 or up to 4% of the undertaking’s total worldwide annual turnover, whichever is higher (Article 40(4)).
Watch out for a naming trap in Poland. The Polish Act of 27 March 2026 on data governance (Journal of Laws 2026, item 548) sounds like a Polish counterpart of the Data Act, but it implements a different regulation: (EU) 2022/868, the Data Governance Act (DGA), and does not refer to the Data Act. The competent authority and the sanctions for Data Act breaches must be checked in the current national law of each Member State.
Where should your company start preparing for the Data Act?
Start by establishing which roles your company holds, because obligations and rights depend on the role. The table sets out first steps for four roles and the evidence that each step was done.
| Company role | What to check first | Provision | Evidence of completion |
|---|---|---|---|
| User of connected devices | Devices whose data you cannot access directly, and the channel for requests to manufacturers | Art. 3(2), Art. 4(1), Art. 5(1) | Device register with a column “data access: direct / on request / none” |
| Manufacturer or related service provider | Whether products placed on the market after 12 September 2026 make data accessible by default and securely; whether Article 7 applies | Art. 3(1), Art. 7 | Data interface specification with a threat model and authentication description |
| Cloud customer (IaaS, PaaS, SaaS) | Notice period, transitional period, specification of exportable data, switching charges | Art. 25, Art. 26, Art. 29 | Exit plan for each critical service with an export format and a migration owner |
| Customer of custom-built services | Whether the service uses the Article 31 exemptions and what that means for charges | Art. 31(1) and (3) | Provider’s notice of obligations that do not apply |
An inventory of data and privileges links all the rows: it serves both compliance and security, so do it once, together with the data protection team. An exit plan proves itself only in a test: moving one less important service shows whether the specification in the contract matches what the provider actually exports.
How can nFlo help prepare your cloud for switching providers?
nFlo helps translate the rights in the Data Act into architecture and configuration. We leave contracts and compliance to lawyers, and on the infrastructure side we start with the technical picture: which workloads, data and privileges need to move, where they are and who has access to them.
As part of our Hybrid Cloud service we inventory and classify workloads and design an architecture connecting the cloud with on-premises infrastructure, connectivity (VPN, Direct Connect, ExpressRoute) and the migration of selected workloads. Cloud Security Audit and Protection covers a review of IAM permissions, storage, networking and logging against CIS Benchmarks, which helps both before and after a migration. You will find more on securing cloud environments in our cloud security knowledge base.
Preparing a cloud contract renewal or an exit plan? Let’s talk about your first migration test.
What else should you know about the Data Act?
Does the Data Act apply to small companies?
Partly. Article 7 excludes the data-sharing obligations of Chapter II for products and related services of micro and small enterprises. A small company acting as a device user or a cloud customer, however, has the same rights as a large one.
Will switching cloud providers be completely free after 12 January 2027?
Not entirely. From that date Article 29(1) prohibits charges for the switching process itself. Standard service fees and early termination penalties are listed separately in Article 29(4).
Does the Data Act cover SaaS?
Yes. Recital 81 names IaaS, PaaS and SaaS as delivery models of data processing services. The duty to facilitate functional equivalence, however, applies only to infrastructure services (Article 30(1)).
Can a manufacturer refuse to share device data?
In limited cases: on grounds of the product’s security requirements (Article 4(2)) or, exceptionally, to protect trade secrets (Article 4(8)). The data holder must notify the competent authority of the refusal.
Does the Polish Act on data governance implement the Data Act?
No. The Polish Act of 27 March 2026 on data governance (Journal of Laws 2026, item 548) implements Regulation (EU) 2022/868 (the DGA) and does not refer to the Data Act, which as a regulation applies directly.
