EU Data Act Compliance Timeline & FAQ

Key dates

1. 2023-12-22
   Published in the Official Journal
   Regulation (EU) 2023/2854 is published; every later deadline counts from here.
   Key provisionsArt 50
2. 2024-01-11
   Entry into force; reduced switching charges begin
   Twenty days after publication. From this date providers of data processing services must limit switching charges, including data egress, to the costs they actually incur.
   Key provisionsArt 50·Art 29(2)
3. 2025-09-12
   General application
   User access and sharing rights, B2B fairness rules, the unfair-terms test for new contracts, B2G requests, cloud switching, international safeguards and interoperability apply. The Commission publishes FAQ v1.3 and the vehicle-data guidance C(2025) 6119 the same day.
   Key provisionsArt 4·Art 5·Art 13·Art 23·Art 32·Art 50
4. 2025-11-19
   Model contractual terms and cloud SCCs adopted
   Commission Recommendation C(2025) 7750: non-binding model contractual terms for data sharing and standard contractual clauses for cloud computing contracts.
   Key provisionsArt 41
5. 2026-01-22
   Commission FAQ updated to v1.4
   Living document, non-binding; in practice the reference point national authorities work from.
6. 2026-02-20
   Compensation-guidelines consultation closes
   The Commission's draft guidelines on reasonable compensation, published in February 2026; adoption expected later in 2026 after EDIB consultation.
   Key provisionsArt 9(5)
7. 2026-05-30
   Germany: DADG enters into force
   The German Data Act implementation law takes effect. The Bundesnetzagentur becomes the competent authority and single point of contact, licenses dispute settlement bodies and supervises cloud switching; the BfDI stays responsible for personal data.
   Key provisionsArt 37·Art 40
8. 2026-09-12
   Access by design
   Connected products and related services placed on the market from this date must make their data accessible to the user by default; the one remaining product-design obligation.
   Key provisionsArt 3(1)·Art 50
9. 2027-01-12
   Switching charges abolished
   Providers of data processing services may no longer charge for switching at all, data egress included. Costs of parallel (multi-cloud) use may still be billed.
   Key provisionsArt 29(1)
10. 2027-09-12
    Unfair-terms control reaches legacy contracts
    The Art 13 test extends to data-sharing contracts concluded on or before 12 September 2025 that are indefinite or run at least ten years from 11 January 2024.
    Key provisionsArt 13·Art 50
11. 2028-09-12
    Commission evaluation
    The Commission must evaluate the Data Act and report to the European Parliament and the Council.
    Key provisionsArt 49

Frequently asked

Which products and services does the Data Act cover?

Three groups. Connected products: items that obtain, generate or collect data on their use or environment and can communicate it, provided their primary function is not storing or processing data for others (Article 2(5)). Related services: digital services connected with the product at purchase or added later, whose absence would prevent the product from performing one of its functions (Article 2(6)). Data processing services: cloud and edge services such as IaaS, PaaS and many SaaS offerings (Article 2(8)). Chapter II covers the first two; Chapter VI covers the third.

Is a smartphone or laptop a “connected product”?

Contested. The definition excludes items whose primary function is storing, processing or transmitting data on behalf of others (Article 2(5)), and the recitals point to IoT devices from smart appliances to industrial machinery (Recital 14). Data protection and consumer bodies have argued against sweeping personal devices into scope; the Commission has not issued a specific clarification. Manufacturers should assess each product against the definition and document the reasoning.

Does the Data Act apply to companies and users outside the EU?

Manufacturers and data holders are covered irrespective of their place of establishment once a connected product is placed on the EU market or a related service is offered there (Article 1(3)). Data generated by such a product while it is used abroad still falls under the access rights. Users outside the EU do not benefit from the rights; the decisive factor for mobile products such as vehicles, ships or aircraft is whether they were placed on the EU market, for which registration in a Member State is an indicator.

Which data are in scope: raw, pre-processed or derived?

Raw and pre-processed data generated by the use of a connected product or related service, including the metadata needed to interpret them. Data resulting from substantial investment in cleaning, transformation or proprietary algorithms are inferred or derived and fall outside the access rights (Recital 15). Content, meaning textual, audio or audiovisual material created for human consumption and typically protected by intellectual property, is excluded (Recital 16); sensor imagery from a vehicle camera is not content in that sense. Applying pseudonymisation or other privacy-enhancing techniques does not by itself turn data into derived data.

Does the Data Act apply to connected products sold before 12 September 2025?

Yes for the access rights: users of products already on the market can request their data under Articles 4 and 5, and data holders need a contract with the user before using non-personal product data themselves (Article 4(13)). Where a data holder cannot identify the user despite reasonable efforts, the Commission accepts continued use of the data. The design obligation of Article 3(1) is different: it applies only to products and related services placed on the market from 12 September 2026.

What is the EU Data Act?

A horizontal EU regulation (2023/2854) on fair access to and use of data. It gives users of connected products and related services rights to the data they generate, sets fairness and compensation rules for business-to-business data sharing, allows public bodies to request data in exceptional need, and imposes switching, interoperability and safeguard duties on cloud and other data processing services.

Who is the “data holder”?

The natural or legal person that has the right or obligation to use and make available data, including product or related-service data it has retrieved or generated (Article 2(13)). Control over access decides, not who built the hardware or software: a manufacturer is not automatically the data holder, the role can be contracted to another entity, and where only the user can access the data there may be no data holder at all. A company cannot be user and data holder for the same data at the same time.

Who is the “user”?

Whoever owns a connected product or has been granted temporary rights to use it under a contract, or receives a related service: consumers as well as businesses (Article 2(12)). A single product can have several users, for instance a leased vehicle, in which case each user holds the access rights for the data generated during its use.

What is a “related service”?

A digital service, including software, that is connected with the product at purchase, rent or lease in such a way that its absence would prevent the product from performing a function, or that is later connected to add to, update or adapt functions (Article 2(6)). The Commission points to replaceability, user expectations and the marketing accompanying the product as indicators, while acknowledging that the decisive criterion, impact on the product's functions, will need clarification by the courts.

What does “readily available data” mean?

Product and related-service data that a data holder lawfully obtains or can lawfully obtain from the product or service without disproportionate effort going beyond a simple operation (Article 2(17)). Data a manufacturer chooses not to retrieve or store on its servers are not readily available; only data designed to be retrievable must be made available.

When does the Data Act apply?

In stages: it entered into force on 11 January 2024 and applies in general since 12 September 2025. The access-by-design obligation of Article 3(1) applies to products and related services placed on the market from 12 September 2026. The unfair-terms test applies to contracts concluded after 12 September 2025, and from 12 September 2027 to older indefinite or long-term contracts (Article 50).

What changed on 12 September 2026?

Connected products and related services placed on the market from that date must be designed so that their data, with the metadata needed to interpret them, are accessible to the user by default: easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly (Article 3(1)). Direct on-device access is not mandatory in every case; manufacturers may provide indirect access through the data holder where direct access is not relevant or feasible, taking account of cost, trade secrets and product security.

When do cloud switching charges end?

Since 11 January 2024 providers of data processing services may charge only the costs they actually incur for a switching operation, including egress. From 12 January 2027 no switching charges may be levied at all (Article 29). Costs of data egress caused by parallel use of several providers, as in a multi-cloud set-up, are not switching charges and may still be billed after that date.

When does the unfair-terms test reach existing contracts?

Article 13 applies to data-sharing contracts between enterprises concluded after 12 September 2025. From 12 September 2027 it also applies to contracts concluded on or before 12 September 2025 that are of indefinite duration or due to expire at least ten years after 11 January 2024. Contracts concluded before 11 January 2024 and expiring earlier remain unaffected.

What must a data holder do when a user requests data?

Make readily available product and related-service data, with the metadata needed to interpret them, available without undue delay, easily, securely, free of charge to the user, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real time (Article 4(1)). The data holder may verify that the requester is a user through proportionate means and may agree on protections for trade secrets, but may not make access unduly difficult. Its own use of non-personal product data requires a contract with the user, and it may not use the data to derive insights into the user's economic situation, assets or production methods (Article 4(13)).

How must data access be provided: directly or indirectly, by push or by pull?

The regulation leaves the technical route to the manufacturer and data holder but fixes the outcome. Access is direct where the user can retrieve, stream or download the data without any intervention by the data holder, for example through an on-device interface or an API to the manufacturer's server; the storage location does not matter (Article 3(1), Recital 22). Access is indirect where the product or service is designed so that the user must ask the data holder, typically through a portal or request process, and the data holder then makes the data available without undue delay (Article 4(1)). Mixed configurations are allowed: part of the data can be direct, the rest indirect, and the user must be told which route applies before contracting (Article 3(2), Article 3(3)). Direct access is only required where relevant and technically feasible, so the manufacturer may weigh the cost of redesign, trade secret and security exposure and the usefulness of direct access for the product in question, and may attach contractual conditions to direct access. In delivery terms, both routes can be served by pull or by push. Pull means the user or the third party retrieves the data on demand, through an API call, a download or a self-service portal; push means the data holder transmits the data as it is generated, through streaming or event-driven architectures that trigger updates. The Commission's FAQ expects APIs for automated retrieval and event-driven designs wherever low latency matters, as in IoT systems, connected mobility and industrial monitoring, because the data must be available continuously and in real time where relevant and technically feasible, in a comprehensive, structured, commonly used and machine-readable format such as JSON, XML or CSV, of the same quality as the data holder uses itself, easily and securely (Article 4(1), Article 5(1), Recital 30, Recital 35). Which mix fits depends on the product architecture, on whether the data are readily available on the device or only on the back-end, on industry latency needs and on the security and trade secret exposure of each route; feasibility is assessed objectively against industry standards. For vehicles the Commission treats remote back-end access, on-board access and data intermediation services as equally legitimate means.

Must data be shared with third parties, and can gatekeepers receive it?

On the user's request, the data holder must make readily available data available to a third party of the user's choice, on the same terms as to the user (Article 5). Undertakings designated as gatekeepers under the Digital Markets Act are not eligible third parties and cannot request or receive the data, nor may they solicit users to share it (Article 5(3)). Recipients in third countries can receive data, subject to the safeguards of Chapter VII and to the GDPR for personal data. Recipients may not use the data to develop a competing connected product or to profile individuals beyond what the requested service needs (Article 6).

Can a data holder refuse for trade secrets or safety reasons?

Trade secrets are protected but not a general ground for refusal: the holder identifies the secrets, agrees proportionate protective measures with the user or third party and may withhold or suspend sharing only where it can demonstrate, on a case-by-case basis, that it is highly likely to suffer serious economic damage despite those measures, notifying the competent authority (Article 4(6)–(8), Article 5(9)–(11)). Access may also be restricted where it would undermine security requirements laid down in EU or national law, again with notification of the authority (Article 4(2)).

How much can a data holder charge for making data available?

Between businesses, compensation must be non-discriminatory and reasonable and may include a margin (Article 9). The Commission's draft guidelines of February 2026 limit chargeable amounts to incremental, necessary costs directly linked to the request, such as specific formatting, sub-set selection, anonymisation or confidentiality measures, and exclude overhead, sunk costs and ordinary business expenses; any margin must reflect investment in generating the data. SMEs and not-for-profit research organisations may be charged only the costs directly attributable to their request, with no margin (Article 9(4)). On request, the data holder must explain the basis of its calculation in sufficient detail (Article 9(7)). Data must be provided to the user free of charge.

What must a business do when a public body requests data?

Public sector bodies and EU institutions may request data only in cases of exceptional need: a public emergency, or a specific public-interest task they cannot fulfil without the data after exhausting other means, including purchase (Articles 14 and 15). The request must be written, specific and justified (Article 17). The data holder must comply without undue delay but may refuse or seek modification within 30 working days, or five working days in a public emergency, if it does not control the data, has already supplied it to another body, or the request is deficient (Article 18). Personal data may be requested only in a public emergency and only where non-personal data would not suffice. Law-enforcement requests remain outside Chapter V.

What do vehicle manufacturers specifically have to do?

The Commission's vehicle-data guidance applies the general rules to cars: OEMs and other data holders must give users and, on request, third parties such as independent repairers or insurers access to readily available vehicle data of the same quality as they use themselves, either directly from the vehicle or indirectly through a back-end interface. Article 3(1) does not force direct on-board access; making data available through the OBD-II port or an API are both legitimate routes. Only data designed to be retrievable are in scope, so data points an OEM chooses not to retrieve or store are not readily available. The guidance also encourages sector standards and dialogue between OEMs, aftermarket operators and authorities.

What must cloud and other data processing services do?

Providers of data processing services (IaaS, PaaS, SaaS and other cloud and edge services) must remove commercial, technical, contractual and organisational obstacles to switching (Article 23), set the switching rights and obligations out in a written contract with the minimum content of Article 25, inform customers about switching procedures, formats and known limitations and keep an online register of data structures and formats (Article 26), cooperate in good faith with the customer and the destination provider (Article 27), publish the jurisdiction their infrastructure is subject to (Article 28), limit and from 12 January 2027 abolish switching charges (Article 29), and meet the technical requirements of Article 30: functional equivalence for IaaS, open interfaces and interoperability specifications for PaaS and SaaS, and data export in a structured, commonly used, machine-readable format. Parallel use of several providers is treated separately (Article 34). Under Chapter VII they must also take technical, organisational and legal measures against unlawful third-country government access to non-personal data (Article 32). All of this has applied since 12 September 2025; unlike the unfair-terms rules of Chapter IV, Chapter VI has no transitional period for existing contracts (Article 50).

Do existing cloud contracts have to be changed, and are there standard clauses?

Yes. Article 25(1) requires the customer's switching rights and the provider's obligations to be clearly set out in a written contract made available before signature, and Article 25(2) prescribes the minimum content: the switching and porting clause with the 30-day transitional period, support for the customer's exit strategy, the termination clause, the maximum notice period of two months, an exhaustive list of portable data and digital assets, any trade secret exemptions, the retrieval period, the erasure clause and the switching charges. Because Chapter VI applies to all contracts since 12 September 2025, contracts concluded before that date must be brought into line as well; the Commission's FAQ lists bringing service contracts in line with Article 25 as the first compliance step for any in-scope provider. For the drafting, Article 41 tasked the Commission with non-binding standard contractual clauses, adopted on 19 November 2025 (Recommendation C(2025) 7750): SCC Switching & Exit, SCC Termination and SCC Security & Business Continuity translate Chapter VI into contract text, and SCC Non-Dispersion, SCC Non-Amendment and SCC Liability address the contractual imbalances that could undermine those rights. Their use is voluntary and they may be adapted, but a provider that deviates from them should be able to show that its own wording still meets Article 25.

What happens after a customer exercises the switching right, and which periods apply?

The sequence is fixed by Article 25. The customer notifies the provider of its decision to switch to another provider, to move to on-premises infrastructure or to erase its data (Article 25(3)). A notice period then runs which the contract may not set longer than two months (Article 25(2)(d)); the service contract remains in force throughout. After the notice period, the transitional period starts, in which the provider must complete the switch without undue delay and at the latest within 30 calendar days, assist the customer and its authorised third parties, maintain business continuity, flag known continuity risks and keep the data secure during transfer (Article 25(2)(a)). If 30 days are technically unfeasible, the provider must say so within 14 working days of the request, justify it and propose an alternative period of at most seven months, with service continuity guaranteed throughout (Article 25(4)); the customer may also extend the transitional period once for a period it considers appropriate (Article 25(5)). After the transitional period the customer has a retrieval period of at least 30 calendar days to fetch remaining data (Article 25(2)(g)); once it expires, or a later agreed date passes, the provider must fully erase the customer's exportable data and digital assets (Article 25(2)(h)). The contract terminates on successful completion of the switch, or at the end of the notice period where the customer only wants erasure (Article 25(2)(c)). Charges during the process follow Article 29: limited to cost now, none from 12 January 2027; the provider must also state in advance what the switching will involve and in which formats (Article 26).

Who enforces the Data Act, and what are the penalties?

Each Member State designates one or more competent authorities and, where there are several, a data coordinator as single point of contact (Article 37). Penalties are set nationally and must be effective, proportionate and dissuasive (Article 40); for infringements involving personal data, the data protection authorities can impose GDPR-level fines of up to EUR 20 million or 4% of worldwide annual turnover. Non-EU data holders and providers offering services in the EU must designate a legal representative in a Member State. National penalty frameworks differ between Member States and are still being completed in some; the applicable national law should be checked. In Germany the DADG has been in force since 30 May 2026 and designates the Bundesnetzagentur as competent authority and single point of contact, with the BfDI responsible for personal data.

Are there model contracts for Data Act compliance?

Yes. By Recommendation C(2025) 7750 of 19 November 2025 the Commission published non-binding model contractual terms for data access and use, covering the relationships between data holders, users and data recipients plus a template for voluntary data sharing, and six standard contractual clauses for cloud computing contracts covering switching and exit, termination, security and business continuity, non-dispersion, non-amendment and liability (Article 41). Both can be adapted to the parties' needs and are meant to support fair, reasonable and non-discriminatory terms; in practice they require tailoring to the specific service. Translations into all EU languages were announced to follow.