Data Act (DA)

The Data Act establishes the European Union’s first comprehensive legal framework for accessing and using data generated by connected products and related services. Its objective is to foster innovation and competition in the European data economy while granting users clear rights regarding data access, data use, and data portability.

At the core of the regulation is the obligation for manufacturers of connected products and providers of related services to make certain data available. Users—whether individuals, businesses, or public authorities—are granted extensive rights to access data generated through the use of these products and services.

A key element of the Data Act is the requirement for data holders to provide relevant data to users and third parties designated by them in a simple, secure, and generally free-of-charge manner. The regulation also introduces rules for fair data sharing between businesses, the protection of trade secrets, and the promotion of new data-driven business models.

The Data Act entered into force on 11 January 2024 and has been applicable since 12 September 2025.

The Data Act primarily affects manufacturers of connected products and providers of related digital services. At the same time, it has significant implications for companies that use such products and may benefit from—or be subject to—new rights and obligations regarding data access and use.

The regulation is particularly relevant for businesses operating in data-intensive industries. These include manufacturing and industrial companies, the automotive and mobility sector, the energy and healthcare industries, as well as providers and users of smart devices and IoT solutions. The Data Act not only governs access to data but also impacts existing business models, contractual arrangements, and value chains.

In short, the Data Act is relevant if your company develops, offers, or uses connected products or related services, or if it commercially leverages data generated by such products.

The Data Act introduces a wide range of new legal, organizational, and technical requirements for companies. In particular, businesses should address the following areas at an early stage:

• Assess applicability: Analyze whether the company falls within the material and personal scope of the Data Act and identify the roles it assumes (e.g., data holder, user, or data recipient).
• Data Act-compliant product design: Consider the requirements for data accessibility and data portability already during the development and design of connected products and services.
• Review and adapt contracts and documentation: Review and amend existing contractual arrangements, particularly with regard to data access rights, data use, FRAND principles (Fair, Reasonable and Non-Discriminatory), and cooperation with third parties.
• Implement appropriate governance structures: Establish technical and organizational processes for managing, providing, and tracking data access requests.
• Protect trade secrets and personal data: Develop appropriate measures to protect sensitive information and ensure compliance with data protection requirements when sharing data.
• Cooperate with authorities: Prepare for potential requests from competent authorities and implement regulatory requirements related to the enforcement of users’ rights.