Data Act

The Data Act (EU Regulation 2023/2854) introduces new rules on access, sharing and portability of data. If you manufacture connected devices, offer cloud services or handle industrial data, you need Data Act consulting.

Data Act: what changes

The Data Act is the European regulation on fair access to data and its use. Entered into force in January 2024, the main Data Act obligations become applicable from September 2025 (data access) and September 2026 (design obligations for connected products).

It is a cross-cutting regulation affecting IoT manufacturers, cloud providers, holders of industrial data and business users. Its interaction with the GDPR and trade secret law creates complexities that require specialized consulting.

Areas of practice

• IoT data access – Obligations for manufacturers to make data generated by connected products accessible
• B2B data sharing – Rules for fair sharing of data between businesses, including contractual clauses
• Cloud switching – New portability rights and requirements for changing cloud providers
• Data sharing with public authorities – Obligations to share data with public authorities in cases of exceptional need
• Interoperability – Technical requirements to ensure interoperability of data and services
• Data Act and GDPR – Coordination between data access obligations and personal data protection

Data Act 2026 deadlines

• September 2025 – Data access obligations for connected products and related services
• September 2026 – Design obligations: new connected products must be designed to allow data access
• January 2027 – Switching obligations for cloud services

Data Act and GDPR: interaction

The Data Act does not derogate from the GDPR. When data generated by connected products contains personal data, both regulations apply. The right of access to data provided by the Data Act must be exercised in compliance with the principles of personal data protection. Coordinating the two regimes is essential.

Who is it for

Data Act consulting is aimed at manufacturers of IoT devices and connected products, providers of cloud and SaaS services, companies managing large volumes of industrial data, and any organization that must comply with the new data access and sharing obligations.