Empowering Users with the European Data Act

Imagine you’re monitoring your company’s fleet of delivery trucks through IoT sensors. The vehicles generate millions of data points daily, fuel efficiency, route optimization, maintenance needs, driver behavior patterns. Yet despite paying for these connected devices, you discover that accessing your own operational data requires expensive third-party services, restrictive contracts, or technical workarounds that your IT team struggles to implement.

This scenario, repeated across industries and consumer products, illustrates the fundamental imbalance that has plagued the digital economy: those who generate data often cannot access or control it effectively. The European Union’s Data Act, represents the most significant legislative intervention to address this imbalance.

The Data Act establishes harmonized rules across the EU for fair access to and use of data, fundamentally reshaping the relationship between users, data holders, and connected devices. For data management professionals, this legislation creates both opportunities and obligations that will define competitive advantage in the years ahead.

Understanding the Scope: What the Data Act Covers

The European Data Act applies to a broad spectrum of digital interactions, but its core focus lies in connected products. So devices that obtain, generate, or collect data concerning their use or environment and can communicate this data via electronic communications services, physical connections, or on-device access.

Defining Connected Products in Practice

Connected products encompass everything from industrial IoT sensors and smart home devices to agricultural machinery and fleet vehicles. The regulation specifically covers:

• Industrial equipment: Manufacturing sensors, predictive maintenance systems, supply chain tracking devices
• Consumer devices: Smart appliances, wearable technology, connected vehicles
• Agricultural technology: Precision farming equipment, livestock monitoring systems
• Infrastructure systems: Smart grid components, environmental monitoring devices

The Act also extends to related services. These are digital services connected to products that are essential for their function or that enhance their capabilities through software updates or cloud connectivity.

Key Stakeholders and Their New Roles

The legislation identifies several key players with distinct rights and obligations:

Users are natural or legal persons who own connected products or have contractual rights to use them. This includes consumers purchasing smart home devices, farmers using precision agriculture equipment, or logistics companies deploying fleet management systems.

Data holders are entities with the legal right or obligation to use and make data available. This typically includes manufacturers who design connected products and service providers who collect data during service provision.

Data recipients are third parties, other than the user, who receive data from data holders, such as aftermarket service providers, analytics companies, or maintenance specialists.

Chapter II: Core User Rights – Access and Control

The Data Act’s most revolutionary provisions center on user rights to access and control data generated by their connected products. These rights fundamentally alter the traditional manufacturer-controlled data landscape.

The Right to Direct Access

Article 3 mandates that connected products must be designed and manufactured to make product data and related service data “easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format” accessible to users by default.

This requirement goes beyond simple data provision. Manufacturers must ensure that:

• Metadata is included: Context and timestamp information that makes data usable
• Technical interfaces are standardized: APIs or software development kits that enable automated access
• Quality of service is maintained: Reliable, consistent data availability

Pre-Purchase Transparency Requirements

Before consumers or businesses purchase connected products, sellers must provide comprehensive information about:

• The type, format, and estimated volume of data the product generates
• Whether data generation is continuous and real-time
• Storage arrangements (on-device vs. remote servers) and retention periods
• Technical means for users to access, retrieve, or erase data

For B2B relationships involving related services, additional disclosure requirements include:

• Identity and contact details of data holders
• Specific purposes for data use
• Processes for requesting third-party data sharing
• Duration and termination arrangements

Enforcement Through Technical Design

The Act requires that data accessibility be built into product design from the ground up. This “privacy by design” approach for data access means manufacturers cannot treat user data rights as an afterthought or add-on service.

Where direct access isn’t technically feasible, data holders must make readily available data accessible “without undue delay” through simple electronic requests. The legislation specifically prohibits making these requests unnecessarily complex or imposing unreasonable barriers.

The Right to Share: Empowering Third-Party Innovation

Article 5 establishes users’ fundamental right to share their data with third parties of their choice. This provision aims to foster innovation in aftermarket services, competitive maintenance providers, and data analytics services.

Practical Applications Across Industries

Manufacturing and Industrial IoT: A manufacturer using connected production equipment can share operational data with specialized analytics firms to optimize processes or with independent maintenance providers to reduce costs.

Smart Agriculture: Farmers can share data from precision agriculture equipment with independent agronomists, weather services, or yield optimization specialists, breaking dependence on single-vendor ecosystems.

Fleet Management: Transportation companies can share vehicle data with independent telematics providers, insurance companies for usage-based policies, or fuel efficiency consultants.

Technical Requirements for Data Holders

When users request third-party data sharing, data holders must:

• Provide data of the same quality available to themselves
• Ensure secure, real-time transmission where technically feasible
• Use comprehensive, structured, machine-readable formats
• Include relevant metadata for proper interpretation

Importantly, this sharing must be free of charge to the user, though data holders may negotiate reasonable compensation directly with third-party recipients.

Protection Against Platform Lock-in

The Act specifically prevents companies designated as “gatekeepers” under the Digital Markets Act from accessing user data through these provisions. This prevents dominant platform companies from leveraging the Data Act to expand their data collection beyond existing services.

Trade Secrets and Security: Balancing Innovation and Access

Recognizing legitimate business concerns, the Data Act includes robust protections for trade secrets and security requirements while preventing their abuse to deny data access.

Trade Secret Preservation Framework

Data holders can protect genuine trade secrets by:

• Identifying protected data elements in metadata
• Agreeing on technical and organizational measures with users or third parties
• Using model contractual terms, confidentiality agreements, or technical standards
• Implementing strict access protocols and codes of conduct

However, the Act prevents blanket trade secret claims. Data holders cannot simply refuse access by claiming trade secret protection without demonstrating specific risks and implementing appropriate safeguards.

The Exceptional Circumstances Provision

In rare cases where data holders can demonstrate that disclosure would likely cause “serious economic damage” despite protective measures, they may refuse access on a case-by-case basis. This decision must be:

• Objectively substantiated with evidence
• Provided in writing without undue delay
• Reported to competent authorities
• Subject to challenge by users through complaints or dispute resolution

Security-Based Access Restrictions

Users and data holders may contractually restrict data access where processing could undermine security requirements resulting in serious adverse effects on health, safety, or security. These restrictions must be:

• Based on legitimate security concerns
• Proportionate to the identified risks
• Subject to review by sectoral authorities
• Challengeable through formal complaint procedures

Competitive Dynamics: Preventing Data Misuse

The Act includes specific provisions preventing the misuse of accessed data for anti-competitive purposes while preserving legitimate business uses.

Restrictions on Users

Users cannot use accessed data to:

• Develop competing connected products
• Share data with third parties for competitive product development
• Derive insights about manufacturers’ economic situation, assets, or production methods

These restrictions aim to preserve innovation incentives for manufacturers while enabling legitimate aftermarket and service innovations.

Restrictions on Data Holders

Data holders face complementary restrictions, preventing them from:

• Using readily available non-personal data without user contracts
• Deriving competitive insights about users’ economic situations or production methods
• Making data available to third parties for purposes beyond contractual obligations

Third-Party Obligations

Third parties receiving data must:

• Process data only for agreed purposes
• Erase data when no longer necessary (unless otherwise agreed for non-personal data)
• Avoid anti-competitive uses such as developing competing products
• Refrain from profiling individuals unless strictly necessary for requested services
• Maintain agreed confidentiality measures for trade secrets

Small Business Considerations: Proportionate Implementation

Recognizing the burden on smaller enterprises, the Data Act includes specific exemptions and protections for microenterprises and small enterprises.

Design Obligation Exemptions

Microenterprises and small enterprises are exempt from the technical design obligations for data accessibility, provided they:

• Don’t have partner or linked enterprises that are larger
• Aren’t subcontracted by larger enterprises to manufacture products or provide services

Transitional Periods

Medium-sized enterprises receive transitional protection:

• One-year exemption for companies newly qualified as medium-sized
• One-year product exemption after market placement
• These periods allow adjustment time before facing data access competition

Enhanced Protection in Public Data Requests

When public sector bodies request data in exceptional circumstances, microenterprises and small enterprises:

• Are only obligated during public emergencies
• Cannot be required to provide data for non-emergency public needs
• Retain the right to claim compensation even during public emergencies

Cross-Border and International Implications

The Data Act addresses the global nature of data flows while protecting EU interests and values.

Jurisdictional Scope

The regulation applies to:

• Manufacturers placing connected products on the EU market regardless of establishment location
• Users in the EU of connected products or related services
• Data holders making data available to EU data recipients
• Service providers offering data processing services to EU customers

Protection Against Third-Country Access

Chapter VII establishes safeguards against unlawful international governmental access to non-personal data held in the EU. Providers of data processing services must:

• Take adequate technical, organizational, and legal measures to prevent unauthorized access
• Recognize only decisions based on international agreements like mutual legal assistance treaties
• Evaluate third-country legal systems for proportionality and review mechanisms
• Inform customers of data requests where possible

Legal Representative Requirements

Non-EU entities falling under the Act’s scope must designate legal representatives in EU Member States to:

• Serve as contact points for enforcement authorities
• Demonstrate compliance measures
• Cooperate with competent authorities
• Accept liability for regulatory violations

Public Interest Data Access: Exceptional Circumstances

Chapter V establishes a framework for public sector access to private sector data during exceptional circumstances, balancing public interest needs with business protection.

Defining Exceptional Need

Public sector bodies, the Commission, European Central Bank, or Union bodies can request data only in limited circumstances:

Public Emergencies: Health emergencies, natural disasters, major cybersecurity incidents, or other events negatively affecting populations with lasting repercussions.

Non-Emergency Public Interest: Specific tasks explicitly provided by law (like official statistics production) where:

• Alternative data sources are exhausted
• Market purchase options are explored
• Existing legal obligations are insufficient

Procedural Requirements

Data requests must be:

• Specific regarding required data and metadata
• Proportionate to the exceptional need
• Transparent about intended use and duration
• Protective of trade secrets and personal data
• Made through competent authorities with public disclosure

Compensation Framework

• Public emergencies: Large enterprises provide data free of charge; small enterprises may claim compensation
• Non-emergency needs: Fair compensation covering technical and organizational costs plus reasonable margins
• Official statistics: No compensation where national law prohibits data purchase

Switching Between Data Processing Services

Chapters VI addresses vendor lock-in in cloud and data processing services, establishing rights for customers to switch providers effectively.

Removing Switching Obstacles

Providers of data processing services must eliminate barriers to:

• Contract termination after reasonable notice periods
• Concluding new contracts with different providers
• Porting customer data and digital assets
• Achieving functional equivalence with new services
• Unbundling specific services where technically feasible

Technical Implementation Requirements

Service providers must:

• Provide clear contractual terms for switching rights
• Offer maximum 30-day transitional periods for switching completion
• Maintain service continuity and security during transitions
• Supply comprehensive information about exportable data categories
• Ensure data retrieval periods of at least 30 days after termination

Gradual Elimination of Switching Charges

The Act phases out switching charges:

• 2024-2027: Reduced switching charges limited to direct switching costs
• From January 2027: Complete prohibition of switching charges
• Ongoing: Charges for parallel use of multiple services remain permissible

Interoperability Standards

The regulation empowers the Commission to:

• Develop common specifications for data processing service interoperability
• Mandate harmonized standards through implementing acts
• Publish references in central EU standards repositories
• Ensure compatibility requirements 12 months after standard publication

Enforcement and Compliance Framework

Chapter IX establishes comprehensive enforcement mechanisms to ensure effective implementation across the EU.

Competent Authority Structure

Each Member State must designate competent authorities with powers to:

• Promote data literacy and regulatory awareness
• Handle complaints and conduct investigations
• Impose effective, proportionate, dissuasive penalties
• Monitor technological and commercial developments
• Cooperate across borders for consistent enforcement

Data Coordinator Role

Member States with multiple competent authorities must designate data coordinators to:

• Serve as single points of contact
• Facilitate cross-border cooperation
• Ensure public availability of exceptional need requests
• Promote voluntary data sharing agreements

Individual Rights and Remedies

Natural and legal persons have rights to:

• Lodge complaints with competent authorities
• Receive information about complaint progress and outcomes
• Access effective judicial remedies for binding authority decisions
• Participate in collective actions where relevant

Penalty Framework

Member States must establish penalty regimes that are:

• Effective, proportionate, and dissuasive
• Based on factors including infringement nature, scale, duration, and previous violations
• Informed by EDIB recommendations for consistency
• Capable of reaching annual turnover percentages for serious violations

Implementation Timeline and Practical Preparation

Understanding the Data Act’s implementation schedule is crucial for compliance planning:

Key Dates

• January 11, 2024: Regulation entered into force
• September 12, 2025: Full applicability begins
• September 12, 2026: Design obligations apply to newly placed products
• September 12, 2027: Chapter IV applies to existing indefinite duration or long-term contracts
• January 12, 2027: Complete elimination of data processing service switching charges

Immediate Action Items for Organizations

For Manufacturers and IoT Providers:

1. Audit current product designs for data accessibility compliance
2. Develop technical interfaces for user data access
3. Create transparent information frameworks for pre-purchase disclosure
4. Establish trade secret identification and protection procedures
5. Design contractual frameworks balancing user rights with business protection

For Data Processing Service Providers:

1. Review and revise customer contracts for switching rights compliance
2. Develop technical capabilities for data export and portability
3. Create transparent pricing structures eliminating unjustified switching charges
4. Implement interoperability standards as they become available
5. Establish procedures for lawful third-country data access requests

For Users (Businesses and Consumers):

1. Inventory connected products and related services for new rights opportunities
2. Evaluate third-party service providers for enhanced data-driven services
3. Review existing contracts for unfair terms that may become unenforceable
4. Develop internal procedures for exercising data portability rights
5. Consider competitive advantages available through enhanced data access

Strategic Implications for Data Management Professionals

The Data Act creates several strategic opportunities for data management professionals:

Enhanced Service Provider Competition

With mandatory data portability and switching rights, organizations can more effectively:

• Negotiate better terms with incumbent providers
• Explore specialized analytics and AI services
• Develop multi-vendor strategies reducing dependency risks
• Leverage competitive bidding for data processing services

New Business Model Opportunities

Data access rights enable innovative service models:

• Independent maintenance and optimization services for industrial IoT
• Specialized analytics services for previously locked-in data sources
• Competitive insurance and financial services based on product usage data
• Cross-platform data integration services for multi-vendor environments

Compliance as Competitive Advantage

Early compliance can create market advantages:

• Superior data accessibility attracting business customers
• Transparent practices building consumer trust
• Streamlined switching processes reducing customer acquisition costs
• Interoperability leadership capturing market share from locked-in competitors

Conclusion: Embracing the Data-Democratic Future

The European Data Act represents more than regulatory compliance, it embodies a fundamental shift toward data democracy in the connected economy. By establishing clear rights for users, obligations for data holders, and frameworks for fair competition, the legislation creates opportunities for innovation while protecting legitimate business interests.

For data management professionals, this transition period presents a unique window to reimagine data strategies, forge new partnerships, and build competitive advantages based on openness rather than lock-in. Organizations that embrace these changes early will be best positioned to thrive in the new data economy.

The path forward requires proactive preparation: auditing current practices, developing compliant technical capabilities, and building partnerships that leverage enhanced data mobility. The companies that view the Data Act as an opportunity rather than a burden will discover new ways to create value from data while building stronger, more transparent relationships with their customers.

Call to Action

Data management leaders should begin immediate preparation for Data Act compliance:

1. Conduct a comprehensive audit of your organization’s connected products, data handling practices, and contractual arrangements
2. Engage with legal and technical teams to develop compliant data access mechanisms and contractual frameworks
3. Explore new partnership opportunities enabled by enhanced data portability and third-party access rights
4. Monitor standardization developments in interoperability specifications and common frameworks
5. Participate in industry initiatives shaping best practices for Data Act implementation

The European Data Act doesn’t just regulate data, it democratizes it. The question for data management professionals isn’t whether to comply, but how to turn compliance into competitive advantage in the data-driven economy of the future.