EU Data Act 2026 – data access, contracts and cloud switching
Share
The EU Data Act, Regulation (EU) 2023/2854, has been applicable since September 12, 2025, and is changing how data from connected products, data sharing between companies, and switching between data processing services must be handled. During 2026, these requirements will become practically significant in contracts, product design, and cloud services.
The essentials in brief
- The Data Act began to apply on September 12, 2025.
- The rules cover, among other things, data from connected products and related services.
- The regulation contains rules regarding unfair contractual terms in certain B2B relationships.
- Cloud switching rules are intended to reduce barriers to switching between data processing services.
- Certain design/access requirements for connected products placed on the market apply from September 12, 2026.
| Product data | What data is generated and who can access it? |
| Contracts | Terms for data access, sharing, compensation, and usage. |
| Trade secrets | Protective measures for disclosure and usage. |
| Cloud switching | Exit, portability, transfer support, and fees. |
| Governance | Roles, registers, responsibility, and request processes. |
Data from connected products
The regulation grants users rights linked to data generated through the use of connected products and related services. Companies therefore need to map what data exists, in what form it can be made available, and what technical or legal limitations apply.
Contractual terms between companies
The Data Act restricts certain unfair contractual terms when data is made available between companies. Standard agreements should therefore be reviewed, especially when they unilaterally limit access, liability, or the use of data.
Trade secrets and security
The right to data does not mean that the protection for trade secrets disappears. Companies may need to implement appropriate technical and contractual safeguards before sensitive information is disclosed.
Cloud switching and exit
The Data Act contains rules designed to make it easier to switch providers of data processing services. Agreements for IaaS, PaaS, and SaaS should therefore be analyzed in terms of termination, export formats, technical support, continuity, interoperability, and any potential switching fees.
Common mistakes
- Believing that the Data Act only applies to IoT manufacturers.
- Lacking a map of which product data is generated.
- Assuming cloud-exit is only regulated in a general termination clause.
- Sharing data without protection for trade secrets.
- Failing to review standard terms against the rules on unfair B2B terms.
Common questions and answers
When did the Data Act start to apply?
The regulation began to apply on September 12, 2025, with certain provisions taking practical effect later.
Does the Data Act only apply to consumers?
No. The regulation contains several rules that are also important in B2B relationships.
What does cloud switching mean?
Rules aimed at reducing commercial, contractual, and technical barriers to switching between data processing service providers.
Do the design requirements apply to all old products?
The specific obligations under Article 3(1) apply, according to the transitional rules, to connected products and related services placed on the market after September 12, 2026.
Data Act Template Package 2026
The template package contains contractual and compliance documentation for data access, data sharing, cloud switching, exit, and internal mapping.
See also
Sources and further reading
Last updated: October 5, 2026. This article provides general information and does not replace individual legal advice.
