Data Act

Article 1 Subject matter and scope

The Regulation establishes harmonised rules on making product and service data available to users, enabling data sharing between private parties and public authorities where there is exceptional public interest need, facilitating switching between data processing services, protecting non-personal data from unlawful access, and developing data interoperability standards, with different chapters applying to connected products, statutory data sharing obligations, contractual data arrangements, non-personal data, data processing services, and virtual assistants interacting with connected products. Data protection law including Regulation 2016/679, Regulation 2018/1725 and Directive 2002/58/EC applies to personal data processed under this Regulation and prevails in case of conflict. The Regulation does not apply to voluntary data sharing between public and private entities, law enforcement, criminal prosecution, customs, taxation, international cooperation, areas outside Union competence, or matters concerning Member State public security, defence, national security or health and safety.

Article 2 Definitions

The section defines key terms including data, metadata, connected products, related services, and data processing services; product data and related service data; readily available data; profiling; various actor categories from consumers to public sector bodies; public emergency situations; customers, virtual assistants, digital assets, and on-premises ICT infrastructure; exportable data as input, output and metadata excluding provider or third-party intellectual property or trade secrets; smart contracts, interoperability, open interoperability specifications, common specifications, and harmonised standards as defined in EU Regulation 1025/2012.

Article 3 Obligation to make product data and related service data accessible to the user

Requires connected products and related services to be designed so that product and related service data, with necessary metadata, are provided to users by default in an accessible, secure, costless, structured, standardised and machine-readable manner, and directly accessible where technically feasible. Before purchase, rental or lease, sellers or lessors must disclose data type, format, volume, generation frequency, storage location and retention periods, and how users may access or erase data. Before providing a related service, the service provider must disclose the nature and volume of data to be collected, user access arrangements, storage and retention details, any third-party data use, provider identity and contact information, data sharing request procedures, complaint rights, trade secret ownership, and contract terms.

Article 4 The rights and obligations of users and data holders with regard to access, use and making available product data and related service data

Data holders must provide readily available data and relevant metadata to users without delay in accessible format at no cost, subject to contractual limitations for security reasons affecting health or safety with authority notification; users may lodge complaints about restrictions and data holders must not make access unreasonably difficult or collect unnecessary verification information. Trade secrets must be disclosed only with agreed confidentiality safeguards including technical and organisational measures; if no agreement is reached or measures are not implemented, the data holder may withhold or suspend data sharing or refuse case-by-case requests with substantiated written notice to the competent authority. Users must not use obtained data to develop competing products, share data with that intent, understand manufacturers' economic situation or assets, or use coercion or exploit infrastructure gaps; data holders may share personal data not belonging to the requesting user only if a valid GDPR Article 6 legal basis exists.

Article 5 Right of the user to share data with third parties

Upon user request, data holders must make readily available data and relevant metadata available to third parties without undue delay in the same quality, easily, securely, free of charge, in a comprehensive structured machine-readable format, and continuously in real-time where relevant and technically feasible, except for data for testing new products or processes not yet on the market unless contractually permitted, and gatekeepers under DMA Regulation 2022/1925 cannot be eligible third parties and must not solicit or incentivise users to make such data available to them. Trade secrets must be protected and disclosed to third parties only when strictly necessary, with the data holder identifying protected information and establishing technical and organisational safeguards such as confidentiality agreements and access protocols; the data holder may withhold or suspend data sharing and must notify the competent authority if necessary measures are not agreed or implemented by a third party or if the third party compromises trade secret confidentiality. The user's right to share data does not restrict data subject rights under GDPR or affect rights under applicable Union and national personal data protection law.

Article 6 Obligations of third parties receiving data at the request of the user

A third party must process received data only for agreed purposes and under data protection law, and must delete data when it no longer serves that purpose unless the user has agreed otherwise for non-personal data. Third parties must not hinder user choices through unfair interface design, manipulative practices or deception; must not profile the data unless necessary to provide the requested service; must not share data with other third parties or gatekeepers unless permitted by the user's contract; must not use the data to compete with the original connected product or derive insights into the data holder's economic situation; must not compromise the product's security or breach confidentiality measures; and must allow consumer users to share data with others.

Article 7 Scope of business-to-consumer and business-to-business data sharing obligations

Obligations do not apply to data from connected products manufactured by microenterprises or small enterprises, provided they have no partner or linked enterprises exceeding that size and are not subcontracted to manufacture or provide related services; the same applies to data from products by newly medium-sized enterprises for one year after market placement. Contractual terms that exclude, derogate from or vary user rights under this Chapter are not binding on the user.

Article 8 Conditions under which data holders make data available to data recipients

When required to share data with other businesses under the regulation or other Union law, data holders must arrange sharing on fair, reasonable and non-discriminatory terms and in a transparent manner. Unfair contract terms or those excluding user rights are not binding, and data holders must treat comparable recipient categories equally without exclusive sharing unless the user requests it.

Article 9 Compensation for making data available

Compensation between businesses for data sharing must be reasonable, non-discriminatory and may include profit margins, calculated based on costs of making data available and investment in collecting it. For small enterprises and non-profit research organisations without larger affiliated entities, compensation cannot exceed the direct costs of making data available, and data holders must explain the compensation calculation in detail.

Article 10 Dispute settlement

Users, data holders, data recipients, customers and data processing service providers can access certified dispute settlement bodies to resolve disputes about data sharing terms, transparency, fairness, and data processing rights and obligations, with certified bodies required to be impartial, expert in data access issues, electronically accessible and able to decide within 90 days. Dispute settlement bodies must give all parties reasonable time to present views, share submissions and expert statements, and allow comment on them; decisions must be issued within 90 days in writing with reasons. Decisions are binding only if parties agreed in advance, court remedies remain available, and bodies must publish annual reports on dispute outcomes, average resolution time and common dispute reasons.

Article 11 Technical protection measures on the unauthorised use or disclosure of data

Data holders may use technical protections like encryption and smart contracts to prevent unauthorised access and enforce data sharing rules, provided these do not discriminate between recipients or prevent users' rights to copy or share data. Data recipients and third parties must comply promptly with requests to delete data, cease unauthorised use, destroy infringing goods, inform the user of breaches and provide compensation when they obtained data through deception, used it unlawfully, failed to maintain security measures, or removed the data holder's protections.

Article 12 Scope of obligations for data holders obliged pursuant to Union law to make data available

This chapter applies when data holders are required to share data with other businesses under the regulation or other Union law, and contract terms that exclude, reduce or modify the chapter's protections are not binding on the affected party.

Article 13 Unfair contractual terms unilaterally imposed on another enterprise

Terms on data access, use, liability or remedies that one enterprise unilaterally imposes on another are not binding if unfair, meaning they grossly deviate from good commercial practice contrary to good faith and fair dealing. Unfair terms include those excluding or limiting liability for intentional acts or gross negligence, excluding remedies for non-performance, giving exclusive rights to determine conformity or interpret terms, inappropriately limiting remedies or liability, allowing access to commercially sensitive or trade secret data contrary to the other party's interests, preventing use of the other party's own data, preventing termination within reasonable time, preventing obtaining a copy of data after contract end, enabling termination on unreasonably short notice, or allowing unilateral price or condition changes without cause or termination rights; however, unilateral price or condition changes for indefinite contracts are permitted if specified with valid reasons, requiring reasonable notice and cost-free termination rights for the other party. The supplier bears the burden of proving non-imposition and that terms are not unfair; unfair terms are severable.

Article 14 Obligation to make data available on the basis of an exceptional need

Non-public enterprises must provide data, including relevant metadata, to public sector bodies, the Commission, the European Central Bank or Union bodies that demonstrate an exceptional need as defined in Article 15, upon a duly reasoned request, to enable them to carry out statutory duties in the public interest.

Article 15 Exceptional need to use data

An exceptional need is limited in time and scope and exists where data is required to address a public emergency and alternative means cannot obtain it timely and effectively, or where a public authority has a specific legal public interest task, has identified necessary non-personal data it lacks, and has exhausted all other acquisition means including market purchase. This does not apply to microenterprises and small enterprises, and the requirement to demonstrate unsuccessful market purchase does not apply when the public interest task is official statistics production and national law prohibits such purchase.

Article 16 Relationship with other obligations to make data available to public sector bodies, the Commission, the European Central Bank and Union bodies

This chapter does not affect existing Union or national law obligations for reporting, information access requests or demonstrating legal compliance. It does not apply to public bodies or Union institutions carrying out criminal or administrative law enforcement, customs or taxation administration, and does not affect applicable law on these matters.

Article 17 Requests for data to be made available

Requesters must specify the data and metadata needed, demonstrate exceptional need conditions are met, explain the purpose and duration of use, justify the choice of data holder, identify other recipients, specify data protection measures if personal data is involved, cite the legal task basis, set deadlines, and make best efforts to prevent liability breaches; requests must be written in clear language, specific to data the holder controls, proportionate and justified, respect the holder's legitimate aims and trade secrets, primarily concern non-personal data, and inform of penalties. When a public sector body requests data, the request must be transmitted to that Member State's data coordinator who shall publish it online unless publication risks public security; Commission, European Central Bank and Union body requests must be published online; requests involving personal data must be notified to the data protection supervisory authority. Public sector bodies and Union institutions cannot reuse requested data under open data rules but may exchange data with each other for stated purposes or delegate functions to third parties subject to confidentiality safeguards and notification to the data holder.

Article 18 Compliance with requests for data

Data holders must provide requested data without undue delay; they may decline or modify requests within five working days for public emergencies or within 30 working days for other exceptional needs on grounds including lack of control over the data, previous identical requests, or non-compliance with request conditions. When personal data are involved, data holders must anonymise them unless the request requires disclosure, in which case they must pseudonymise them; disputes over refusals or requests are referred to the competent authority.

Article 19 Obligations of public sector bodies, the Commission, the European Central Bank and Union bodies

Public sector bodies and Union institutions receiving data must use it only for the stated purpose, implement technical and organisational security measures, and erase data when no longer needed unless archiving is legally required; they must not use received data to compete with the data holder's products or services, nor share it with third parties for competitive purposes. Trade secret disclosure requires strict necessity and advance technical and organisational safeguards; recipients are responsible for data security.

Article 20 Compensation in cases of an exceptional need

Data holders except microenterprises and small enterprises must provide emergency data free of charge; data holders are entitled to fair compensation for other exceptional-need requests covering technical and organisational costs including anonymisation and a reasonable margin. Microenterprises and small enterprises may claim compensation for exceptional-need requests; no compensation is due for requests related to official statistics production where purchasing data is prohibited by national law. Disagreements over compensation amounts are referred to the competent authority.

Article 21 Sharing of data obtained in the context of an exceptional need with research organisations or statistical bodies

Article 22 Mutual assistance and cross-border cooperation

Public sector bodies and Union institutions shall cooperate to implement this Chapter consistently; data exchanged must be used only for the stated purpose. When requesting data from another Member State, the requesting body must first notify the competent authority there, which examines the request and either transmits it to the data holder with advice on reducing administrative burden or rejects it on substantiated grounds; the requesting body must consider the competent authority's advice before taking further action.

Article 23 Removing obstacles to effective switching

Data processing service providers must eliminate both formal and practical barriers that prevent customers from ending contracts after notice periods and switching completion, signing agreements with other providers, transferring exportable data and assets to different providers or on-premises infrastructure, achieving equivalent functionality in a different provider's environment, or unbundling services where technically feasible.

Article 24 Scope of the technical obligations

The switching and porting obligations of data processing service providers apply only to the specific services, contracts and commercial practices offered directly by the source provider.

Article 25 Contractual terms concerning switching

Contracts must clearly set out in writing before signing customer rights to switch to other providers or port data to on-premises infrastructure within 30 calendar days maximum after a two-month notice period, during which providers must assist, maintain continuity, disclose risks, and ensure security; list all exportable data categories with exemptions only where trade secrets are at risk; specify switching charges under Article 29; and guarantee complete erasure of customer-generated data after retrieval period or agreed later date. Customers have the right to notify providers of switching decisions and erasure requests after notice period ends. If the 30-calendar-day period is technically unfeasible, providers must notify customers within 14 working days, justify the unfeasibility, and propose an alternative period not exceeding seven months with ensured continuity.

Article 26 Information obligation of providers of data processing services

Data processing service providers must inform customers about switching and porting procedures, methods, formats, limitations and technical restrictions, and must maintain a current online register describing all data structures, formats, standards and open interoperability specifications for exportable data.

Article 27 Obligation of good faith

All parties involved in switching, including destination providers, must cooperate in good faith to make the process effective, enable timely data transfer, and maintain service continuity.

Article 28 Contractual transparency obligations on international access and transfer

Data processing service providers must publish and regularly update their websites with information about the jurisdiction governing their infrastructure and the technical, organisational and contractual measures they use to block international governmental access to or transfer of union-held non-personal data that would violate union or member state law, and must reference these websites in their customer contracts.

Article 29 Gradual withdrawal of switching charges

Data processing service providers must eliminate all switching fees starting 12 January 2027, though between 11 January 2024 and 12 January 2027 they may charge reduced fees limited to direct costs of the switching process. Providers must disclose to prospective clients information on service fees, early termination penalties, and applicable reduced switching charges before contracting, and must publicly share information on complex, expensive or impossible switching scenarios, with the Commission empowered to establish a monitoring system for compliance.

Article 30 Technical aspects of switching

Infrastructure-only providers limited to servers, networks and virtual resources must take reasonable measures to help customers achieve functional equivalence after switching by providing capabilities, information, documentation, technical support and necessary tools. Other providers must offer open interfaces free of charge to all customers and destination providers with sufficient information for data portability and interoperability software development. Non-infrastructure providers must ensure compatibility with common or harmonised interoperability specifications at least 12 months after publication in the central Union standards repository.

Article 31 Specific regime for certain data processing services

Obligations on service quality, contracts, portability and interoperability do not apply to data processing services custom-built for one customer's specific needs or using components developed solely for that customer, unless offered commercially at scale. Obligations also do not apply to non-production services used for testing and evaluation for a limited period. Service providers must inform prospective customers before contract conclusion which obligations do not apply.

Article 32 International governmental access and transfer

The addressee may seek the opinion of the relevant national authority competent for international cooperation to assess whether conditions are met, particularly for trade secrets, sensitive data, intellectual property-protected content, or re-identification risks, or whether national security or defence interests are implicated. If no reply is received within one month or the opinion is negative, the addressee may reject the request. Service providers must provide only the minimum data necessary when conditions are met and must inform customers of access requests before complying, except when law enforcement purposes require secrecy.

Article 33 Essential requirements regarding interoperability of data, of data sharing mechanisms and services, as well as of common European data spaces

Data space participants offering data or services must implement interoperability requirements including sufficient machine-readable descriptions of dataset content, metadata and collection methods, public documentation of data structures and formats, detailed technical access specifications with usage terms, and where applicable, tools for automating data sharing agreements; participants complying with published harmonised standards are presumed compliant. The Commission may adopt delegated acts to refine these requirements and implementing acts with common specifications if standardisation organisations have not accepted requests, missed deadlines, or failed to comply and no harmonised standard is published or expected soon; before adopting implementing acts, the Commission must inform the standardisation committee and consider the Board's advice and stakeholder consultation.

Article 34 Interoperability for the purposes of in-parallel use of data processing services

Requirements on service quality, contract terms, portability, switching and interoperability also apply to facilitate concurrent use of multiple data processing services. Service providers may impose data egress charges only to recover egress costs without markup when services are used in parallel.

Article 35 Interoperability of data processing services

Specifications and standards for interoperability of data processing services must enable compatibility between services of the same type, improve portability of digital assets, and allow functional equivalence where technically feasible, while maintaining security and integrity and enabling innovation. They must address cloud interoperability aspects covering transport, syntactic, semantic, behavioural and policy interoperability; cloud data portability aspects of syntactic, semantic and policy portability; and cloud application aspects covering syntactic, instruction, metadata, behaviour and policy portability. The Commission may request European standardisation organisations to draft harmonised standards or adopt common specifications via implementing acts, considering competent authority views and consulting stakeholders; Member States may submit detailed explanations if specifications do not satisfy essential requirements.

Article 36 Essential requirements regarding smart contracts for executing data sharing agreements

Vendors or deployers of smart contracts for data sharing agreements must ensure they meet five essential requirements: strong robustness and access control mechanisms, safe termination and interruption functions, data archiving and record-keeping capabilities, rigorous access control at governance and contract layers, and consistency with the underlying agreement terms; they must assess conformity and issue an EU declaration of conformity, taking full responsibility. The Commission may adopt implementing acts establishing common technical specifications for these requirements when standard-setting organisations fail to deliver timely or adequate harmonised standards, and must repeal them when related harmonised standards are published; Member States may challenge implementing acts as inadequate.

Article 37 Competent authorities and data coordinators

Each Member State must designate one or more competent authorities to enforce this Regulation, and if multiple, appoint a data coordinator to facilitate cooperation and assist on compliance; data protection supervisory authorities monitor personal data protection aspects and the European Data Protection Supervisor monitors application concerning the Commission and Union bodies. Competent authorities must have expertise in data and electronic communications services and perform tasks including promoting data literacy, handling complaints and investigations, monitoring developments, and cooperating with other authorities and data coordinators, who serve as single points of contact, make public requests for data from public sector bodies, promote voluntary data sharing agreements, and annually inform the Commission of refusals. Entities not established in the Union but making connected products available or offering services there must designate a legal representative in a Member State to cooperate with competent authorities; such entities are subject to competence of the Member State where their representative is located, or all Member States until a representative is designated; competent authorities can request information from users, holders and recipients to verify compliance and must assist other authorities while protecting confidentiality and personal data.

Article 38 Right to lodge a complaint

Natural and legal persons may submit complaints to the relevant competent authority in their Member State if they believe their rights under this Regulation have been violated, either alone or collectively. The competent authority must inform the complainant of the case's progress and outcome according to national procedures, while authorities must work together to process and settle complaints quickly through electronic information exchange without delay.

Article 39 Right to an effective judicial remedy

Affected natural and legal persons have the right to seek judicial review against binding decisions of competent authorities. When a competent authority does not respond to a complaint, affected persons may bring court proceedings or access an independent review body with suitable knowledge, in accordance with national law and in the Member State where the competent authority is located.

Article 40 Penalties

Member States must establish effective, proportionate and dissuasive penalties for infringements and notify the Commission by 12 September 2025, considering gravity, duration, mitigation actions, prior violations, financial benefits, turnover and other circumstances. For breaches of Chapters II, III and V, supervisory authorities under the data protection regulation may impose administrative fines up to the amount in Article 83(5) of that regulation; for Chapter V breaches, the European Data Protection Supervisor may impose fines up to the amount in Article 66(3) of Regulation 2018/1725.

Article 41 Model contractual terms and standard contractual clauses

Before 12 September 2025, the Commission must prepare and publish suggested, non-binding model contractual terms for data access and use covering reasonable compensation and trade secret protection, plus non-binding standard clauses for cloud computing arrangements, to help parties create balanced contracts with fair terms.

Article 42 Role of the EDIB

The European Data Innovation Board, an expert group with competent authority representation, must advise the Commission on consistent enforcement practices, facilitate cross-border cooperation through information exchange and capacity-building, and assist with developing harmonised standards, implementing acts, delegated acts and guidelines for interoperable frameworks and common standards for European data spaces.

Article 43 Databases containing certain data

The sui generis database protection right under Directive 96/9/EC does not apply to data obtained from or generated by connected products or related services falling within this Regulation's scope, particularly regarding Articles 4 and 5.

Article 44 Other Union legal acts governing rights and obligations on data access and use

The Regulation does not alter existing obligations for making data available between businesses, between businesses and consumers, or between businesses and public bodies under Union legal acts that entered into force by 11 January 2024. It does not restrict Union law that sets sector-specific or data space requirements for data access and use, or Union and national law that permits data access for scientific research.

Article 45 Exercise of the delegation

The Commission holds delegated power from 11 January 2024 indefinitely under Articles 29(7) and 33(2), which either Parliament or the Council may revoke at any time. Before adopting delegated acts, the Commission must consult Member State experts. Delegated acts enter into force only if neither Parliament nor Council objects within three months of notification, or both inform the Commission they will not object; the period extends by three months if Parliament or Council initiates the extension.

Article 46 Committee procedure

The Commission is supported by the Committee established under Regulation (EU) 2022/868, which operates as a committee under Regulation (EU) No 182/2011, and Article 5 of that regulation applies when referenced in this Article.

Article 47 Amendment to Regulation (EU) 2017/2394

The Data Act is added as point 29 to the Annex to Regulation (EU) 2017/2394.

Article 48 Amendment to Directive (EU) 2020/1828

The Data Act is added as point 68 to Annex I to Directive (EU) 2020/1828.

Article 49 Evaluation and review

By 12 September 2028, the Commission must evaluate and report to Parliament and Council on multiple aspects: situations of exceptional need under Article 15 and enforcement of Chapter V; effects on data economy innovation and monetisation; accessibility of different data categories; exclusion of certain enterprises from beneficiary status; effects on intellectual property and trade secrets; fairness of the contractual terms list in Article 13; contractual practices of data processing service providers; reduction of switching charges; interplay with other Union laws; prevention of unlawful governmental access; enforcement effectiveness; and impacts on SME innovation capacity and service availability. By the same date, the Commission must also evaluate Articles 23 to 31 and 34 to 35 regarding pricing and diversity of data processing services, with focus on SME providers. Member States must provide necessary information, and the Commission may propose amendments based on the reports.

Article 50 Entry into force and application

This Regulation enters into force on the twentieth day after publication in the Official Journal and applies from 12 September 2025. The obligation to make data available from connected products applies to products put into circulation after 12 September 2026; Chapter III applies to new legal duties effective after 12 September 2025; Chapter IV applies to new contracts from 12 September 2025 and to existing contracts from 12 September 2027 if they have indefinite duration or expire at least 10 years after 11 January 2024. The Regulation is binding and directly applicable in all Member States.