For organizations asking what is Data Act, the European regulation sets rules on access, sharing, and use of data generated by connected products and digital services.
What Is Data Act?
The Data Act is the European regulation adopted to create a unified framework for access to, sharing, and use of data in the European Union.
Published in the Official Journal on 22 December 2023, the EU data regulation applies from 12 September 2025, establishing clear rules for a fairer, more competitive, and more innovative data ecosystem.
The regulation aims to facilitate access to data, especially data generated by connected products and related services, promote its use in the economy, and ensure transparency in relationships between manufacturers, users, and digital service providers. It is a central pillar of the European strategy for a single market for data.
Why Was the Data Act Created?
The rapid growth of connected devices (IoT) and digital services has generated massive amounts of data that are not fully used. The Data Act was designed to:
- clarify who can access certain data and under what conditions;
- ensure a fair distribution of the value generated by data;
- address situations where data is locked by manufacturers or service providers;
- stimulate innovation and competition in data-driven industries.
The new legislation complements other European regulations, such as the Data Governance Act, together creating a coherent framework for the data economy.
When Does the Data Act Apply?
The Data Act was published in the Official Journal of the European Union in December 2023 and applies from 12 September 2025. Organizations should prepare in advance for the new rules on access to data generated by connected products and related services.
Who Does the Data Act Apply To?
The regulation has broad coverage and applies to a diverse ecosystem of actors:
- manufacturers of connected products, such as smart appliances, medical devices, connected vehicles, agricultural or industrial machinery;
- providers of digital services related to connected products;
- users, whether consumers or companies, of these products and services;
- data holders of product-generated data;
- data recipients, where the user requests transmission of the data;
- providers of data processing services, including cloud, edge, SaaS, PaaS, and IaaS providers;
- public sector bodies, in situations of exceptional need.
Territorially, the Data Act applies regardless of where a company is established, as long as it offers products or services on the EU market or generates data in the EU.
What Is Data Act and What Obligations Does It Introduce?
The regulation establishes rights and obligations designed to ensure a functional and competitive data market.
1. Access to Data Generated by Connected Products
Users, whether consumers or companies, must be able to access the data generated by the products they use and may request that such data be transferred to third parties.
In practice, this means:
- the possibility to receive raw data from sensors;
- access to metadata necessary to interpret the data;
- prohibition of access blocking by the manufacturer;
- the user’s right to direct the transfer of data to another provider.
2. Rules for Business-to-Business Data Sharing
The regulation requires businesses to ensure fair conditions when they are legally required to share data. Abusive contracts or unilateral terms that disadvantage smaller companies are prohibited.
3. Rules for Public Sector Access
Public bodies may request access to certain data from companies only in exceptional situations, such as:
- public emergencies;
- natural disasters;
- prevention of or response to critical situations.
The regulation sets clear conditions under which such requests are permitted.
4. Limiting Access by Third-Country Governments
To protect European data sovereignty, the Data Act imposes strict rules on access requests from authorities in third countries when they concern non-personal data stored in the EU.
5. Rules for Cloud and Edge Service Providers
One of the most important changes is the obligation for cloud and edge service providers to facilitate data migration to other providers, without technical or contractual barriers.
Specifically, they must:
- allow provider switching in an easy and predictable manner;
- provide portability tools;
- remove fees or barriers that prevent data migration.
This provision has a major impact on the global cloud market.
6. Interoperability and Standardization
The Data Act introduces requirements so that systems and services can communicate with each other, including across cloud providers. Interoperability is essential for the functioning of the single market for data.
What Is Data Act and What Types of Data Does It Cover?
The regulation uses a very broad definition, including:
- raw sensor data;
- technical data generated through product use;
- non-personal and personal data, to the extent GDPR compliance is ensured;
- metadata necessary to interpret the data.
In practice, any digital representation relevant to a connected product may fall within the scope of the Data Act.
What Is Data Act and What Impact Does It Have on Companies?
To better understand what Data Act means for companies, organizations need to assess how they manage and share data generated by connected products.
The effects are significant and affect most organizations operating digital products or services:
- the need to review contracts related to data access and use;
- adaptation of connected products to allow easy access to data;
- assessment of data-sharing obligations;
- preparation for strict cloud data portability requirements;
- adjustment of data-based monetization strategies.
For many companies, the Data Act represents a fundamental change in how industrial and commercial data is managed.
The Data Act marks a major step toward a fairer and more competitive European data economy. By clarifying access rights, facilitating portability, imposing interoperability, and removing market barriers, the regulation lays the foundations for a single data market with significant benefits for consumers, companies, and innovators.
Organizations should prepare in advance, assess how they manage data, and adapt their processes to comply with the new requirements, turning compliance into a strategic advantage.
If your organization needs to prepare for the new rules on data access and use, explore our EU Data Act advisory services.
