Why does this matter?
The Data Act is often mentioned when people actually mean privacy. As a result, businesses miss what the law does do for them. It gives you rights towards the manufacturer of your machines and towards your cloud provider. And anyone who sells connected devices or offers software in the cloud themselves gets obligations.
Which law covers what?
| Law | Covers | Example |
|---|---|---|
| GDPR | Personal data | Customer data, emails, recorded conversations |
| AI Act | AI systems, according to their risk | A chatbot must say that it is AI |
| Data Act | Data from connected devices, and switching in the cloud | Requesting the measurement data of your heat pump from the manufacturer |
The Data Act does not replace the GDPR. If the data from a device contains something that can be traced back to a person, both apply.
What does the Data Act regulate?
- Data from connected devices also belongs to the user. Anyone who uses a car or a heat pump with an internet connection has a right to the data the device generates. You may also have it shared with a third party, for example an independent repairer or a software partner.
- Switching cloud or software provider. The notice period for switching is no more than two months, the provider must cooperate in transferring your data, and technical or contractual obstacles are not allowed. That applies to infrastructure and also to software in the cloud.
- No one-sided contracts about data. Unfair terms on access to and use of data, unilaterally imposed on another business, are not binding.
- Protection of business data without personal data. Cloud providers must take measures against unlawful access by governments from outside the EU.
- Access for governments in emergencies. In exceptional cases, such as a disaster, a government can request data from businesses.
The key dates
| Date | What |
|---|---|
| 11 January 2024 | The Data Act enters into force |
| 12 September 2025 | Most rules apply, including the right to your data and the switching rules |
| 12 September 2026 | New connected devices must be designed so that the user can access their data directly |
| 12 January 2027 | Providers may no longer charge costs for the switching itself. Until then they may only pass on their actual costs |
| 12 September 2027 | The rules on unfair terms also apply to older long-term contracts |
When does it matter for you?
- You use connected devices (machines, vehicles, installations). You can request the data from the manufacturer and use it in your own systems.
- You sell or install such devices. Your customer has a right to their data, and that belongs in your contract and your documentation. Small enterprises that make devices themselves are exempt from part of the obligations.
- You work with software in the cloud. You can leave with your data. Check in your contract how export and termination are arranged.
- You offer software in the cloud yourself. Then the switching rules apply to you as a provider.
What is still to come?
On 19 November 2025 the European Commission proposed a Digital Omnibus that aims to simplify a series of digital laws. The part on AI has since become law. The part on data, which among other things aims to bring some existing data laws together in the Data Act and to amend the GDPR on a few points, was still under negotiation in October 2026. Until that is settled, the rules apply as described above.
The Data Act is not about privacy, but about who may access your data and whether you can take it with you.
Related terms
- AI Act: the European rules for AI systems.
- CLOUD Act: a US law, despite the similar name.
- EU hosting and zero retention: where your data is and what happens to it.
- Recording conversations: falls under the GDPR, not under the Data Act.
Sources: Data Act (Regulation 2023/2854) · GDPR (Regulation 2016/679) · AI Act (Regulation 2024/1689)
This article is not legal advice. The rules were checked on 6 October 2026. For a specific situation, it is best to consult a lawyer.