Find a lawyerOur capabilitiesYour careerSearch
Locations
Our capabilities
News

Select language:

Locations
Our capabilities
News

Select language:

hamburger menu showcase image
  1. Our thinking
  2. Tech, data and AI: The digital frontier
  3. EU Digital Strategy
  4. Data Act
Data Act
Status: In force
  • In force since 11 January 2024, application from 12 September 2025 (with certain exceptions where individual provisions or chapters have a deviating application date)​

Summary

EU Regulation introducing rules for the sharing and use of data generated on the internet of things, and for cloud providers when it comes to interoperability, switching and international data transfers. Designed to improve access, exchange and use of valuable data generated by connected devices so that more public and private stakeholders can benefit from Big Data and Machine Learning.

Scope

  • Data sharing obligations apply to companies that manufacture / offer connected products or related services in the EU, those who make this data available to others
  • Interoperability obligations and obligations on international data transfers apply to providers of data processing services (including IaaS, PaaS, SaaS) offered to EU based customers
  • Applies to personal and non-personal data

Key elements

Connected products and related services

  • Obligation for companies to grant users, third companies or the public sector access to data. Implementation of fair, transparent and non-discriminatory regulation (standards) of access to data
  • Extensive information requirements on the generated data vis-à-vis end users before a contract for the purchase, rent, or lease of a connected product or a related digital service is concluded
  • Use of private data by government (B2G): fair, transparent access to privately held data for use in public interest (e.g. environmental protection, public health)
  • Promoting data access and use in B2B relationships (fairness test against unfair, unilateral contractual terms and transparency obligations)

Data processing services (in particular cloud services)

  • Obligation for cloud service providers to allow users to easily switch cloud services and to improve portability between cloud providers, and to implement safeguards against unlawful government access and for international transferof non-personal data

Enforcement

  • Fines of up to EUR 20 million or 4% of annual group turnover, whichever is higher

Challenges

Connected products and related services

  • Interplay with GDPR is unclear, specifically how to treat in practice mixed data sets which contain personal and non-personal data
  • Implementation of data access obligations poses a significant administrative burden
  • Data access rights might interfere with the protection of companies’ trade secrets
  • Requirements for the technical design of data portability might be onerous: Companies in scope must fulfil access and portability requirements for data for users of networked products

Data processing services

  • Compliance burden by imposing Schrems-II requirements for international transfer of non-personal data on data processing services
  • Limiting switching charges, not a clear cut which costs will be in scope
  • Scope of interoperability obligations is not completely clear and yet to be determined how the requirements will function regarding the practical challenges of IT migration

EU Digital Strategy Hub
Data Governance Act
Data Act
European Data Spaces
Cyber Resilience Act
Digital Markets Act
Digital Services Act
NIS2 Directive
AI Act
AI Liability Directive
DSM Directive
European Media Freedom Act
eIDAS 2.0
Political Advertising Regulation
Digital Operational Resilience Act (DORA)
Related capabilities
Artificial intelligence
Automotive
Data, privacy and cyber security
Fintech
Industrials
Life sciences
Technology
Blogs

Blogs

Blog
Feb 17 2025
Data Act: Commission issues updated FAQ
To aid in the implementation of the EU Data Act, the European Commission has released a set of frequently asked questions (FAQ). For a...
Blog
Feb 5 2025
German Election #2: Digital Policies in the 2025 Election Campaign – How Germany’s Political Parties Want Germany to Catch Up on Digitalisation
On 23 February 2025, almost 60 million German voters will elect a new federal parliament in snap elections after the collapse of the...
Blog
Oct 24 2024
Leading the Change: 2025 Data Law Trends report
We’re excited to share our latest report, Leading the Change: 2025 Data Law Trends.  Data now impacts all aspects of businesses, from...
Blog
Oct 1 2024
EU Commission publishes practical guide on an evolving EU digital economy
Aiming to encourage voluntary data sharing for business and citizen benefits through secure and trustworthy exchanges, the Data...
Blog
Sep 10 2024
Key insights for businesses from the EU Commission’s FAQ on the EU Data Act
To aid in its implementation, the European Commission has published frequently asked questions on the EU Data Act. Check out our earlier...
Blog
Jul 12 2024
Fairness in B2B relationships in the digital world
In the ever-evolving landscape of data regulation, the EU Data Act stands as a pivotal milestone. Beyond its wide-ranging data access...
Blog
Apr 9 2024
When GDPR and Data Act clash: what Businesses need to know
Like other parts of the EU Digital Strategy, also the Data Act reaffirms the supremacy of data protection laws, ensuring that the rights...

Contacts

Contacts

Düsseldorf, Frankfurt am Main
Theresa EhlenPartner
Düsseldorf
Christoph WerkmeisterPartner
Vienna, Düsseldorf
Lutz RiedePartner
Vienna
Ludwig HartenauPartner
London, Brussels
Jenny LeahyPartner
Vienna
Gernot FritzCounsel
Vienna
Estella DannhausenAssociate
Düsseldorf
Julia UtzerathSenior Knowledge Lawyer
Related capabilities
Artificial intelligenceAutomotiveData, privacy and cyber securityFintechIndustrialsLife sciencesTechnology
Related capabilities
FIND US IN
All locations
NAVIGATE TO
About usYour careerOur thinkingOur capabilitiesNews
CONNECT
Find a lawyerAlumniContact us
NEED HELP
Fraud and scamsComplaintsTerms and conditions
LEGAL
AccessibilityCookiesLegal noticesTransparency in supply chains statementResponsible procurementPrivacy

© 2025 Freshfields. Attorney Advertising: prior results do not guarantee a similar outcome

Select language: