EU Data Act

What is the EU Data Act?

The EU Data Act is part of the Euro­pean Strategy for Data and aims to increase the data flow within the Euro­pean data economy. While the Data Gover­nance Act creates trust struc­tures for data sharing, the Data Act defines who may use data gener­ated by connected prod­ucts and under which condi­tions. The Euro­pean Commis­sion’s aim is a fair data economy: more data should flow and be used, without under­mining trade secrets or data protec­tion. The act aims to make data avail­able to the people and compa­nies who generate it through their use of a product.

Who is affected?

The Data Act affects manu­fac­turers of connected prod­ucts, providers of related services, data holders, users and providers of data processing services such as cloud services. A connected product is any item that obtains, gener­ates or collects data about its use or envi­ron­ment and can commu­ni­cate it, which includes indus­trial machines, vehi­cles, smart devices and much of today’s manu­fac­turing equip­ment. A related service is a digital service, such as an app or a remote main­te­nance service, without which the product could not perform one of its func­tions.

Key oblig­a­tions of the Data Act

Data access for users

Users have the right to access the data gener­ated by their use of a connected product or related service. The data holder must make data avail­able without undue delay, free of charge for the user, in a compre­hen­sive, struc­tured, commonly used and machine-read­able format, and where rele­vant contin­u­ously and in real time. Before a contract is concluded, users must be informed what data the product gener­ates and how they can access it.

Sharing data with third parties

At the user’s request, data holders must share data with a third party, for example a repair service or a soft­ware provider. Data holders can ask for reason­able compen­sa­tion from busi­nesses for this. Third parties may not use the data to develop a competing product, and very large online plat­forms desig­nated as gate­keepers cannot receive data under this mech­a­nism.

Access by design

Connected prod­ucts placed on the market after 12 September 2026 must be designed so that the data is directly acces­sible to the user by default, where rele­vant and tech­ni­cally feasible.

Protec­tion of trade secrets

Data holders can require confi­den­tiality measures before sharing data that contains trade secrets, and in excep­tional cases refuse to share it if serious economic damage is likely.

Further rules

The Data Act also prohibits unfair contrac­tual terms on data sharing imposed on smaller compa­nies, gives public bodies access to data in cases of excep­tional need, makes switching between data processing service providers easier, with switching charges abol­ished from 12 January 2027, and sets inter­op­er­ability require­ments for partic­i­pants in data spaces.

How does the EU Data Act relate to the GDPR?

The Data Act covers personal and non-personal data. Where data is personal data, the General Data Protec­tion Regu­la­tion continues to apply in full, and the Data Act does not create a new legal basis for processing. In indus­trial settings, much machine data is non-personal, but oper­ator logins, shift data or vehicle data can be personal. Compa­nies need a clear view of which data falls under which regime, and data protec­tion author­i­ties remain respon­sible for personal data. Compli­ance with data protec­tion regu­la­tions and with the Data Act there­fore goes hand in hand, and the use of data must respect both.

What the Data Act means for machine builders

For machine builders and compo­nent suppliers, the EU Data Act turns data access into a product feature. They need to know which data their prod­ucts generate, docu­ment it for customers and provide tech­nical inter­faces to access it. Open, stan­dard­ized inter­faces make this far easier than propri­etary formats. The Asset Admin­is­tra­tion Shell, OPC UA and MQTT are obvious candi­dates: they describe data in a machine-read­able way and are already supported by many automa­tion systems.

The Data Act also shifts busi­ness models. Services built on exclu­sive access to machine data face compe­ti­tion from third parties the customer can now autho­rize. At the same time, new services become possible for anyone who can work with stan­dard­ized data, which supports the idea of digital sover­eignty and reduces vendor lock-in.

How to prepare for EU Data Act compli­ance

1. Map the data your connected prod­ucts and related services generate.
2. Update product infor­ma­tion and contracts to describe the data and how users can access it.
3. Provide tech­nical access, ideally through stan­dard­ized, machine-read­able inter­faces.
4. Define processes for user requests and third-party sharing, including trade secret protec­tion.
5. Design new prod­ucts for access by design before the September 2026 dead­line.

Frequently asked ques­tions