The EU Data Act gives users of connected products and related services the right to access the data they generate, and to have that data shared with third parties. It has applied since 12 September 2025, but the obligation to design products so that data is directly accessible only applies to connected products placed on the market after 12 September 2026.
The Data Act, Regulation (EU) 2023/2854, also sets rules on unfair terms in data contracts between businesses, on switching between cloud providers and on access to data by public bodies in exceptional situations. If your business makes, imports or sells connected products, offers cloud services or uses data under contracts with other businesses, it is likely to be affected. Below we explain the main obligations and how the ACM and the AP enforce them in the Netherlands.
Table of contents
What does the Data Act regulate?
The Data Act sets out who may access data generated by the use of products and services, and on what terms that data must be shared. It does not create a general right to all data, but a framework for six specific areas.
The Regulation entered into force on 11 January 2024. It covers access by users to product and service data, fair terms for data sharing between businesses, access by public bodies in cases of exceptional need, switching between data processing services, safeguards against unlawful governmental access to non-personal data from outside the EU, and interoperability. The full text is available on EUR-Lex.
What must manufacturers of connected products do?
Connected products and related services must be designed so that the data they generate is, by default, easily, securely, free of charge and in a machine-readable format directly accessible to the user, where relevant and technically feasible (Article 3). Think of smart home devices, industrial machines, medical devices or vehicles.
This design obligation applies to connected products and related services placed on the market after 12 September 2026. Products already on the market before that date do not need to be redesigned. Before a contract is concluded, the user must also be informed about the type and volume of data the product generates and how the user can access it (Article 3(2) and (3)).
Where data is not directly accessible, the data holder must make it available to the user on request, without undue delay and free of charge (Article 4). The user can also ask the data holder to share the data with a third party of the user’s choosing (Article 5). Gatekeepers designated under the Digital Markets Act cannot be such a third party.
Can you protect your trade secrets?
Yes, to a degree. The data holder may require confidentiality measures before disclosing data that contains trade secrets, and may in exceptional cases refuse or suspend sharing if disclosure is highly likely to cause serious economic damage. Such a refusal must be substantiated in writing and notified to the competent authority, in the Netherlands the ACM.
The user may not use the data obtained to develop a product that competes with the connected product from which the data originates (Article 4(10)). The data holder, for its part, may only use non-personal product data on the basis of a contract with the user.
Which contract terms between businesses are unfair?
A contractual term on access to and use of data, or on liability and remedies for breach, does not bind the other business if it was unilaterally imposed and is unfair (Article 13). A term is unilaterally imposed if the other party could not influence its content despite an attempt to negotiate it, and the party that introduced the term must prove otherwise.
A term is unfair if it grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing. Article 13 contains two lists. Terms that are always unfair include those that exclude or limit liability for intentional acts or gross negligence, and those that give the party that imposed the term the exclusive right to interpret the contract. Terms that are presumed unfair include those that inappropriately restrict the other party’s use of data it has contributed, or that allow termination at unreasonably short notice.
An unfair term does not bind the other party, but the rest of the contract remains in force if the term can be separated from it. The rules apply to contracts concluded after 12 September 2025. From 12 September 2027, they also apply to older contracts that run for an indefinite period or expire at least ten years after 11 January 2024.
If a data holder must make data available to another business, it may ask for reasonable compensation (Article 9). For micro, small and medium-sized enterprises and certain research organisations, that compensation may not exceed the costs of making the data available.
How does the Data Act relate to the GDPR?
The Data Act does not replace the General Data Protection Regulation (GDPR). Where personal data is involved, the GDPR continues to apply in full, and in case of conflict the GDPR prevails.
If the user who asks for data is not the data subject, personal data may only be made available if there is a valid legal basis under Article 6 GDPR and, where relevant, Article 9 GDPR. The Data Act does not create such a basis itself, and the GDPR rules on purpose limitation, security and storage periods keep applying. Read more about the GDPR risks of sharing data and about how long you may keep customer data.
What changes for cloud providers and their customers?
Providers of data processing services, such as cloud and edge services, must make it easier for customers to switch to another provider or to their own infrastructure. They may not impose commercial, technical, contractual or organisational obstacles that hinder switching (Article 23).
The contract must allow the customer to switch with a maximum notice period of two months, after which the actual transfer of data and digital assets must be completed within a transitional period of at most thirty days. If that is technically not feasible, the provider must explain why and may extend the period, up to a maximum of seven months.
From 12 January 2027, providers may no longer charge any switching charges at all. Until that date, they may only charge reduced charges that do not exceed the costs directly linked to the switch. Check your existing cloud contracts for longer periods or switching fees before they are renewed.
When can public bodies demand your data?
Public sector bodies may, under strict conditions, require businesses to make data available in cases of exceptional need, such as a public emergency. The request must be specific, proportionate and justified.
In a public emergency, data holders must provide the data free of charge, except micro and small enterprises, which are entitled to compensation. In other cases of exceptional need, for example where the data is needed for a specific task in the public interest and cannot be obtained otherwise, the data holder may claim fair compensation.
Who enforces the Data Act in the Netherlands?
Supervision is regulated in the Data Act Implementation Act (Uitvoeringswet dataverordening), in force since 21 November 2025. The Authority for Consumers and Markets (ACM) supervises most of the Regulation, including the rules on product data, data sharing between businesses and cloud switching.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) is responsible where personal data is involved and for data requests by public bodies. Both authorities can impose an order subject to a penalty (last onder dwangsom) or an administrative fine within their own area, and they cooperate on overlapping issues.
If an authority takes a decision against your business, you can lodge an objection (bezwaar) with that authority within six weeks and then appeal to the court. A business can also enforce its rights under the Regulation in the civil courts, for example if a data holder refuses access to data.
Does the Data Act also apply to small businesses?
Largely, yes. There is no general exemption for small and medium-sized enterprises: the design obligation for connected products and the fairness test for contract terms apply regardless of the size of the business.
The data access and sharing obligations of Chapter II do not apply to data generated by products manufactured or services provided by micro and small enterprises, provided they have no larger partner or linked enterprise (Article 7). Medium-sized enterprises benefit from a limited transitional exemption of one year. In a public emergency, micro and small enterprises are entitled to compensation.
What should you check as a manufacturer, data holder or cloud provider?
Start with the products and services you place on the market after 12 September 2026, as the design obligation applies to them in full.
- Does the product design give users direct access to their data where technically feasible (Article 3)?
- Does your pre-contract information state the type and volume of data and how users can access it?
- Is there a process to handle access and sharing requests without undue delay (Articles 4 and 5)?
- Have you identified trade secrets and the confidentiality measures you will require before sharing?
- Do your cloud contracts respect the two-month notice period, the thirty-day transfer period and the end of switching charges on 12 January 2027?
What should you check as a user or business customer?
As a user you can claim data that a manufacturer or service provider would otherwise keep to itself, and you can challenge unfair data terms under Article 13.
- Which connected products and services in your business generate data you could request under Article 4?
- Do your supplier contracts contain unilaterally imposed terms on data use or liability that may be unfair?
- Can you switch cloud provider within two months’ notice, and what switching charges does the contract allow?
- Do you have a GDPR legal basis for each flow of personal data you receive or pass on?
- Have you documented your requests, so you can file a complaint with the ACM or go to court if access is refused?
What can we do for you with the Data Act?
Our IT lawyers advise businesses on data contracts, cloud agreements and compliance with the Data Act and the GDPR.
- We map which of your products, services and contracts fall within the scope of the Data Act.
- We review your standard terms and supplier contracts against the unfair-terms lists of Article 13.
- We draft or revise data sharing agreements, including confidentiality measures for trade secrets.
- We check your cloud contracts for notice periods, transfer periods and switching charges.
- We align your Data Act processes with your GDPR obligations.
- We represent you in proceedings before the ACM, the AP or the civil courts.
Summary
- The Data Act has applied since 12 September 2025; the design obligation for connected products applies to products placed on the market after 12 September 2026.
- Users can access the data their connected products generate and have it shared with third parties, subject to protection of trade secrets.
- Unilaterally imposed unfair terms on data access, use and liability do not bind the other business.
- Cloud providers must facilitate switching and may no longer charge switching fees from 12 January 2027.
- In the Netherlands, the ACM and the AP supervise compliance and can impose fines.
Frequently asked questions
Does the Data Act already apply to my existing connected products?
The Regulation has applied since 12 September 2025, but the obligation to design connected products so that users can access the data directly only applies to products placed on the market after 12 September 2026. For products already on the market, users can still request access to the data from the data holder under Article 4.
What should I do if my data contract contains clauses that restrict access to data?
Have the contract reviewed. A unilaterally imposed term that inappropriately restricts the other party’s use of data it has contributed is presumed unfair under Article 13 and then does not bind that party. The party that introduced the term must prove that it was negotiated.
May I share personal data under the Data Act without a GDPR legal basis?
No. The Data Act does not provide a legal basis for disclosing personal data. If the user is not the data subject, personal data may only be made available if there is a valid basis under Article 6 GDPR. Data obtained under the Data Act may also not be retained or reused beyond what the GDPR allows.
Can I still charge switching fees as a cloud service provider?
Only until 12 January 2027, and only reduced charges that do not exceed the costs directly linked to the switch. From that date, switching charges are prohibited. The transfer itself must be completed within a transitional period of at most thirty days, unless this is technically not feasible.
Which supervisory authority enforces the Data Act in the Netherlands?
The Authority for Consumers and Markets (ACM) supervises most of the Regulation, including product data, data sharing between businesses and cloud switching. The Dutch Data Protection Authority (AP) is responsible where personal data is involved. Both can impose an order subject to a penalty or a fine, against which objection and appeal are available.
