EU Data Act Enters Into Force, Opening Access to Connected Device Data

The Commission announced the entry into force as a key step for the European data economy. The regulation was proposed by the Commission in February 2022, and the European Parliament and the Council reached political agreement on the text on 28 June 2023.

What the rules require

The Data Act covers four main areas. First, users of connected products, from industrial machinery to household devices, will be able to access the data their devices generate and share it with third parties, such as a repair service, while manufacturers' trade secrets remain protected. Second, customers of cloud services will be able to switch between providers, eventually free of charge, which the Commission presents as a way to promote competition and prevent vendor lock-in.

Third, public sector bodies will be able to access and use data held by private companies where it is needed to respond to public emergencies, such as floods or wildfires, or to carry out a legal mandate when the data is not otherwise available. Fourth, businesses, and particularly small and medium-sized enterprises, gain protection against unfair contractual terms imposed unilaterally by a stronger party in data-sharing contracts.

Who is affected

Manufacturers of connected products and providers of related digital services sold in the EU are the most directly affected, because they will need to make data available to users and, at the user's request, to third parties. Cloud and other data processing service providers face switching and interoperability obligations. Businesses that receive data under data-sharing arrangements will need to review contract terms against the new unfairness test, and companies outside the EU are caught where they place products or provide services on the EU market.

What happens next

The 20-month transition runs to 12 September 2025. In that period, companies will need to map the data their products generate, decide how access requests will be handled and documented, and review standard terms for data licensing and cloud contracts. The Data Act sits alongside existing law, including the GDPR where personal data is involved, so data access processes will need to respect both regimes. Further guidance and model contractual terms are expected from the Commission before the rules apply.

Sources

• European Commission: European Data Act enters into force
• European Commission: Data Act, Commission welcomes political agreement