Turning data rules into something you can actually use
A quick backdrop
The Data Act, published in December 2023 and enforceable from 12 September 2025, establishes new obligations for manufacturers of connected products and providers of related services (including cloud platforms) to make “use-data” available to eligible users, subject to defined conditions and exceptions. As the European Commission puts it:
“The Data Act will enable a fair distribution of the value of data by establishing clear and fair rules for accessing and using data within the European data economy, a necessity heightened by the growing prevalence of the Internet of Things (IoT). Thanks to this regulation, connected products will have to be designed and manufactured in a way that empowers users (businesses or consumers) to easily and securely access, use and share the generated data.”
Key ideas:
- User rights – The person or firm using the product have the right to access and receive certain data generated by the product or service, in a standard format and, in most cases, free of charge, subject to lawful exceptions.
- Data holders – If you are a data holder, you may be required to share data with users or third parties under fair, reasonable, and non-discriminatory (FRAND) terms, subject to permitted exceptions such as protection of trade secrets or security.
- Third parties – Data holders must not obstruct data sharing with third parties designated by the user, except where justified by legitimate interests such as trade secrets or security.
- Cloud switching – Providers of cloud and edge services must facilitate switching between providers and significantly reduce switching charges by 2027, as required by the Act.
The Data Act has broad territorial scope. If you operate in the EU market, you may be subject to its requirements, regardless of your headquarters’ location.
Data Act Gap Assessment
- Data Inventory Analysis: We review your current data processing workflows, catalogue data sources, map data flows, and identify gaps or redundancies. This analysis highlights where existing practices may need to be adjusted to align with the EU Data Act’s requirements.
- Risk Assessment: We assess risks linked to your data collection, storage, and use. By analysing potential vulnerabilities – such as unauthorized access, non-compliant sharing, or excess retention – we outline a risk profile and offer practical recommendations.