Data is the key driver of value creation and innovation in the digital age. Those who control data shape business models and market power. Unsurprisingly, artificial intelligence also relies heavily on access to data.
Until now, the legal focus has primarily been on the protection of personal data and the rights of data subjects. With the new Data Act, the EU now complements this framework by introducing an independent right of access to data. The aim is to ensure that not only manufacturers and providers of digital services, but also users themselves and third parties designated by them, such as downstream service providers, can access data that is often essential. This is particularly important for functioning secondary markets, for example where independent repair shops require vehicle data from connected cars in order to carry out repairs. The Data Act also establishes new ground rules for fair competition and innovation in sectors such as agriculture (sensors in fields and machinery), energy (smart meters), and smart homes (connected devices and household applications).
The Data Act will, to a large extent, become applicable as of 12 September 2025. In particular, it introduces far-reaching requirements regarding access to, use of, and sharing of product data and related service data, as well as contractual arrangements. In addition, new transparency obligations will be introduced. Manufacturers of connected products and services (the Internet of Things (IoT)) as well as providers of cloud services, in particular, will need to review and adapt their contracts and internal processes to ensure compliance.
Our experts have summarized the key takeaways for you below.
Who is affected?
What are the key responsibilities?
- Data access: Users – both consumers and businesses – have a statutory right to (i) immediate access to their product and related service data by electronic means, and (ii) the disclosure of this data to third persons vis-à-vis the manufacturer or digital service provider that collects user data. Refusal is only possible in exceptional cases and must be justified to the future Data Act authority (e.g. risk to health or safety). However, third persons such as downstream providers have no direct right to demand the disclosure of data from the manufacturer or provider. They must always go via the user as the data subject.
- Transparency requirements: For example, regarding the type, format and scope of product data.
- Data use: If, conversely, the manufacturer or provider wishes to use the data generated, they must enter into a data use agreement with the user.
- Access by Design: Networked products and connected services must be designed in such a way that product and connected service data is directly accessible to the user.
- B2C: The requirements under consumer protection law also apply.
- Specific regulations for B2B:
- FRAND criteria: Data holders must make the relevant data available on fair, reasonable and non-discriminatory terms and in accordance with transparency obligations.
- Prohibition of unfair contract terms: Contractual provisions which unreasonably restrict third persons' access to or use of data, particularly where there is an imbalance in bargaining power, are deemed to be invalid.
- Cloud switching: Providers of (cloud-based) data processing services must remove technical, contractual and financial barriers to switching providers (e.g. the right to terminate contracts, the abolition of switching fees), in other words, make the data more accessible.
Digital Product Compliance
The Data Act supplements existing and future regulations. Consequently, numerous potential areas of tension and interactions must be taken into account as a whole. Where personal data is involved in addition to product-generated data, the GDPR also applies. In addition, the various cyber security and product liability regulations must also be taken into account. These too may give rise to interactions: in particular, data access (‘Access by Design’) must be designed to be (cyber) secure for the user and, in future, must, amongst other things, comply with the requirements of the Cyber Resilience Act.
How we can support you:
- Analysis of impact: An assessment of whether, and to what extent, the Data Act applies to your products, data flows and services.
- Impact Assessment: Identification of the obligations relevant to your organisation, including deadlines and necessary actions, as well as strategies to minimise the impact on your organisation.
- Enforcement of access rights for providers of downstream products and services. This usually requires an approach that involves the intermediary users to whom the Data Act grants the relevant access rights.
- Contract review and amendment: Revising your terms of use for connected products and associated services to ensure compliance with the Data Act.
- Product design & transparency requirements: Implementation of ‘Access by Design’ in development, production and information architecture.
- FRAND disputes: Support in establishing fair, reasonable and non-discriminatory terms and conditions, and in the event of a dispute.
- Advice on areas of conflict relating to the GDPR and other regulations: Taking into account the sometimes complex interrelationships.