Data Exchange Legal Questions and Answers About the EU Data Act

What exactly does the Data Act regulate, how does it relate to GDPR, and what legal consequences arise from violations? Experts from the law firm Gleiss Lutz have summarized answers to these and other questions in this article for you.

The EU Data Act came into force on January 11, 2024. Since then, an implementation period has been underway. Starting September 12, 2025, it will be applied in all EU member states. The EU Data Regulation is intended to ensure that data generated in the EU is more easily accessible and usable to promote innovation and growth.

The idea behind the Data Act is to create a legal framework that encourages both companies and consumers to share their data, thereby enhancing competition and efficiency across various sectors. In particular, the Data Act aims to remove barriers to widespread data usage, laying the foundation for new business models in the context of Industry 4.0. Another focus is on ensuring data security and protecting personal information. Overall, the EU Data Act is considered a key element of Europe's digital transformation, designed to strengthen the EU's competitiveness in the global market.

What does the Data Act regulate? When does it apply?

The Data Act has several regulatory areas. The most important are:

• Access rights of users of so-called ‘connected products’ (in particular IoT products) or associated services to the data generated by such connected products or associated services¹;
• Product design obligations of manufacturers of connected products and associated services;
• Specifications for data-related terms and conditions—these apply to contracts concerning any type of private sector data that is accessed, shared or used on a contractual basis;
• Regulations to simplify switching between cloud services and other data processing services (including gradual abolition of switching fees and interoperability requirements). 

The Data Act will generally apply from September 12, 2025. However, the design obligations for manufacturers of connected products and related services will only apply to products placed on the market after September 12, 2026. For already concluded data contracts with an indefinite term or a minimum contract term of at least ten years, the Data Act will apply from September 12, 2027.

For which companies is the Data Act relevant? Who can assert access claims against whom under the Data Act? Are there other data access claims that apply alongside the Data Act, for example, from antitrust law?

The Data Act is relevant across all industries for companies that hold, license, voluntarily provide, or are required to provide any kind of data. It is especially relevant for companies that develop, manufacture, and offer connected products or related services, as well as those that have (de facto) control over the data generated by connected products or related services (so-called "product data" and "connected service data"). Exceptions apply to SMEs, such as exemptions from the obligation to provide data.

The Data Act grants the user of a connected product or a related service—but not other third parties—a right against the data holder to access data generated through the use of such a connected product or service. The user can request the release of the data either to themselves or to third parties. However, a right to data access by the user themselves is excluded if the user can already directly access the data from the connected product or service (e.g., download from the device). This does not exclude the right to have the data provided to a third party.

The refusal of access to data by dominant companies or companies with relative market power can also be relevant under antitrust law and establish access claims that go beyond the scope of the Data Act ("user-generated data"). However, these are associated with high hurdles for the party requesting access.

What is the relationship between the Data Act and the General Data Protection Regulation (GDPR)?

The Data Act covers both personal data and purely machine data that has no personal reference. While the purpose of the Data Act is to enable extensive data access and fair data use, the GDPR aims to ensure comprehensive protection for natural persons in the processing of personal data. The provisions of the GDPR apply alongside the Data Act.

How are the interests of data holders protected? Are there exceptions to the data provision obligation? Can I contractually exclude user claims?

Exceptions to the obligation to provide data only exist under narrowly defined conditions. Data holders are generally also required to disclose trade secrets. However, to safeguard confidentiality, technical and organizational measures (TOM) may and should be required from the user, such as adherence to confidentiality agreements, implementation of strict access protocols, and codes of conduct.

A contractual exclusion of the user's claims is generally inadmissible. However, according to the EU Commission, it should be possible to agree on restrictions regarding the use or sharing of data with third parties, provided the user receives appropriate compensation for this (for example, in the case of joint industrial projects).

What should companies consider in contracts with other companies regarding data access and data usage?

The data holder is generally not allowed to charge the user for providing product data and connected service data. However, if a user requests the provision of data to a third party, compensation may be charged. This compensation must be fair, reasonable, and non-discriminatory. Factors such as the costs of provision, investments made in data generation, the scope, format, and type of the data can be taken into account. These so-called "FRAND" criteria are already known from other areas of patent and antitrust law but regularly raise questions in their application due to their ambiguity. If the data is provided to an SME, the compensation cannot exceed the costs of provision, meaning no margin may be charged. The calculation of the specific fee must be disclosed to the data recipient.

Contract clauses in B2B transactions that regulate data access and data usage are subject to a new standard terms review (Art. 13 Data Act). Exceptions only apply to clauses that determine the main subject of the contract or the appropriateness of the price.

For which purposes may the provided data be used?

The user is generally allowed to use the data made available to them for any lawful purpose and may also share it with third parties. However, they are not permitted to develop a competing connected product; the development of a competing related service, on the other hand, is allowed. The data may also not be used to gain insights into the economic situation, assets, or production methods of the manufacturer of the connected product or the data holder.

What restrictions exist for data holders on using data generated by a connected product or associated service themselves?

Data holders may only use this data if there is a legal basis for doing so: If the data is personal data, it may only be used if and to the extent permitted by the GDPR. If it is non-personal data, it may only be used if and to the extent contractually permitted by the user.

The use of non-personal data that does not solely serve to fulfill the contract with the user (e.g., to improve existing products or develop new products) must be contractually agreed upon in the future. The right to share data with third parties must also be contractually agreed upon (possibly only in exchange for appropriate compensation to the user).

Prohibited in any case:

• The use of the data to gain insights into the economic situation, assets, or production methods of the user (or of a third party to whom the user has disclosed the data).
• The use of the data for the development of a product that competes with the connected product or the associated service from which the data originates.

What legal consequences arise from violations of the Data Act?

Fines can be imposed for violations of the Data Act. The amount depends on the nature, severity, scope, and duration of the violation, as well as the financial advantages gained, and can amount to up to 4 percent of the global (group-wide) annual revenue. In some cases, civil law consequences are also specified, for example, contractual clauses on data may be invalid (see the question "What should companies consider in contracts with other companies regarding data access and usage?"). Affected parties can file complaints with the competent national authority and seek legal remedies in court.

¹The Data Act contains a multitude of specific terms that are defined within it but are not necessarily self-explanatory. These include terms such as “connected product,” “related service,” “data holder,” and “user.” A glossary that can help with this can be found, for example, here: www.gleisslutz.com/de/data-act-glossar.

Smart-Factory

Access solutions for the Smart Factory - Industry 4.0