The new “Data Act” has been in force in the EU since September 12, 2025. It is intended to make non-personal data from networked products more easily accessible, make cloud switching practicable and put a stop to unfair contractual clauses. The GDPR will also continue to apply to personal data.
Regulations of the Data Act
Since September 12, 2025, users of networked products – in both the B2C and B2B sectors – have been entitled to the (non-personal) product and service data generated during use. This includes raw and usage data (e.g. measured values, statuses, simple logs), but not further analyses or derived evaluations. This data must be provided quickly, free of charge and in a common, machine-readable format. From September 12, 2026, new networked products and connected services must technically enable direct access “ex works” and transparently explain what data is generated, how it is accessed and in what way. If disclosure leads to serious business damage, disclosure may be refused. As soon as personal data is affected, the GDPR also applies.
Cloud changeover without friction losses
There are also new regulations for switching cloud services: switching providers must no longer fail due to hidden hurdles or a lack of transparency. Contracts should contain clear exit rules, such as how long the handover takes, in which format data and configurations are exported and how data security and business continuity are guaranteed during the migration. The data must remain accessible for a reasonable period of time after the migration. Switching fees are prohibited from January 12, 2027.
Fair contracts
A new feature is an abuse control for B2B clauses relating to data access, data use, liability and legal remedies. Unilaterally imposed, grossly unbalanced conditions are invalid. These include, for example, de facto termination blocks, unilateral price or format changes without an exit option or the refusal of a data copy after the end of the contract.
How to implement the requirements in SMEs
- Start with a lean inventory: which networked products and services do you use, what data is actually generated and in what role. For each product or service, record which data should already be exportable today and in which format.
- Appoint a responsible person who brings together IT, legal, purchasing and the specialist department. This person should review cloud contracts with duration, exit options and technical export path.
- Update your contracts as a provider. Establish understandable exit rules, realistic deadlines, clear task distribution, export formats and deletion concepts.
- Take data protection into account: Where personal data is involved, refer to the GDPR requirements. Technical and organizational protective measures – from access rights to encryption – must be provided.
- Document interfaces, define export paths for data and necessary “digital assets” and test the export once in a secure environment.
- Think about new products in good time according to the principle of “Access by Design”. From September 12, 2026, it must be explained to users what data is generated and how they can access it.
- Provide team-specific training. Your purchasing department needs clear checkpoints for tenders, IT needs a feasible export procedure and sales and service need reliable statements for customers.
Conclusion
The Data Act is not a niche IT topic, but brings with it relevant changes: new rights and obligations regarding data access, the fairness of B2B contract clauses and cloud switching will apply from September 12, 2025. From September 12, 2026, product-related “access by design” requirements will be added.
Those who clarify the necessary measures now, tidy up contracts and establish a functioning export path will implement the legal requirements early on – and create space for new, data-driven offerings.
