Business & IT Consultant
The EU Data Act governs access to data from networked products and connected services. This guide explains who is affected, what obligations apply, and what measures companies should prioritize now.
The EU Data Act has been in effect since September 12, 2025, and regulates access to data from networked products and connected services.
Those affected include manufacturers, digital service providers, data owners, user companies, and cloud and edge providers.
Companies must provide users with easy, free, and timely access to relevant product and usage data.
At the user’s request, data must also be transferable to third parties. Contracts, technical interfaces, and internal processes must be adapted accordingly.
Of particular importance are the protection of trade secrets, fair access conditions, clear responsibilities, and comprehensive documentation of implementation.
Companies should first assess their role, their data holdings, and the extent to which they are affected, and then prioritize technical, legal, and organizational measures.
The Data Act is an EU regulation that establishes uniform rules for access to data, its use, and its sharing. The goal is to make data more accessible in a way that is fairer, promotes competition, and fosters innovation, while at the same time protecting the rights of businesses, consumers, and public authorities. The Data Act is intended to give both consumers and businesses more control over the data generated by their connected devices. The Data Act is thus a central component of the European Commission’s European Data Strategy.
The Data Act has been directly applicable since September 12, 2025. A transition period until September 12, 2026, applies to certain obligations. However, some provisions will take effect later. In particular, the obligation under Article 3(1) applies to networked products and associated services placed on the market after September 12, 2026
It is currently planned that the Federal Network Agency will play a central role in the implementation of the Data Act in Germany. The Federal Network Agency is to become the central point of contact for questions regarding implementation, supervision, and enforcement.
Since May 30, 2026, the Federal Network Agency has been the competent German authority for the application and enforcement of the Data Act and serves as the central point of contact (source).
The checklist helps companies prioritize the implementation of the Data Act. It provides initial guidance on the company’s role, the data affected, and the necessary measures. It’s free and requires no data entry!
The checklist helps companies prioritize the implementation of the Data Act. It provides initial guidance on the company’s role, the data affected, and the necessary measures. It’s free and requires no data entry!
The scope of the Data Act extends to connected products as well as related services.
Connected products are defined as physical objects capable of collecting information about their use, performance, or environment. This specifically includes products typically classified as part ofthe “Internet of Things”that exchange data with other systems. Connected products can be found in numerous market segments, including, in particular, connected vehicles, smart home devices, consumer electronics, industrial machinery, energy and agricultural equipment, and medical devices.
In addition to connected products, the Data Act also covers connected services. A connected service exists when a digital service is functionally linked to a connected product and influences its operation or use. A key characteristic of this is a two-way exchange of data, in which information is transmitted from the product to the service, and control or configuration commands are transmitted from the service to the product. Examples of connected services include applications that allow for the targeted control or configuration of connected products. These include, for example, apps for controlling the lighting or temperature of smart home appliances, or software solutions for smartwatches that collect, analyze, and process health and activity data.
In particular, IT infrastructure products whose primary purpose is the storage, processing, or transmission of data (e.g., servers or network components), as well as products that have not yet been placed on the market or put into service (e.g., prototypes).
The Data Act applies to manufacturers of connected products, providers of connected services, data owners, data users, and cloud and edge providers in the EU, as well as, in some cases, providers outside the EU that are connected to the single market.
Digitalization, new market demands, and changing regulatory requirements are forcing companies to continually rethink their business models, processes, and structures. We support you in this process with strategic foresight, methodological clarity, and the ability to put ideas into practice.
Companies that manufacture connected products or offer connected services must ensure that the product and usage data generated through the use of these products or services are accessible. They are required to provide users with free, easy, and timely access to this data. The data must be provided in a structured, commonly used, and machine-readable format. To the extent technically feasible, access must be provided while the product or service is in use.
In addition, they must enable users, upon request, to have the data transferred directly to a third party of their choice. No artificial technical or contractual barriers may be erected in this regard.
Companies that are considered data owners have additional obligations. They must make data available to other authorized parties under fair, reasonable, and non-discriminatory (FRAND) terms. Any agreed-upon consideration for the provision of data in a B2B relationship must be non-discriminatory and reasonable; it may, in principle, also include a margin. Additional restrictions apply to certain recipients, particularly SMEs and non-profit research institutions. Data holders must also ensure that access to data is not restricted by unfair contractual terms. In particular, no unilaterally onerous conditions may be imposed on small and medium-sized enterprises. Trade secrets may be protected, but only through appropriate safeguards. A blanket refusal of data access based solely on trade secrets is not permitted.
Providers ofcloud,edge, or other data processing services must take measures to facilitate switching to other providers. They are required to remove technical, contractual, and commercial barriers to switching providers and to establish transparent rules regarding data portability. The goal is to prevent so-called lock-in effects.
Depending on their role, manufacturers, sellers/lessors, and providers of related services must provide the required information in a clear and understandable manner before the contract is concluded. This means explaining what data is generated, who can access it, and for what purposes it is used. This information must be available before or, at the latest, at the time the contract is concluded. Finally, companies must document the measures they take to comply with the Data Act. This includes, in particular, processes related to data access, data sharing, pricing, and the protection of sensitive information.
In certain situations of exceptional need, such as public emergencies, companies may be required to provide data to public authorities. These obligations are strictly limited: The data may only be used for a specific purpose, for a limited time, and to the extent necessary. Companies must be organizationally capable of lawfully complying with such requests.
1. Clarify Roles and Data Sets
Companies should first determine whether and in what capacity they fall under the Data Act—for example, as manufacturers, providers of related services, data owners, users, or providers of data processing services. Based on this, they must systematically identify what data is generated through the use of these products or services. In doing so, a clear distinction must be made between which product and usage data is covered by the Data Act and which internal company data is not subject to the regulation’s provisions.
2. Unambiguously identify users
In the next step, data owners must ensure that they can lawfully determine who qualifies as a user under the Data Act. This includes clarifying whether the users are consumers or business users and on what basis these individuals or companies are authorized to use the product or service. Unambiguous user identification is a prerequisite for correctly granting data access rights.
3. Establish Technical Access Mechanisms
Data owners are required to implement appropriate technical solutions that enable users to access the data they have generated. This access must be easy, free of charge, timely, and provided in a structured, commonly used, and machine-readable format. To the extent relevant and technically feasible, data should be directly accessible during use, for example via digital interfaces or user interfaces.
4. Enable Transfer to Third Parties
In addition, data controllers must be organizationally and technically capable of transferring data to a third party designated by the user upon the user’s request. The transfer must take place without undue delay and must strictly adhere to the purpose specified by the user. The data owner remains responsible for ensuring that the transfer is carried out lawfully.
The Data Act includes an exception for micro and small businesses. These businesses are exempt from certain data-sharing obligations, in particular the obligation to provide data upon request from other companies. This exception applies only if they are not part of a corporate group that, as a whole, exceeds the thresholds. The regulation aims to prevent very small market participants from being overwhelmed by extensive data provision obligations.
5. Defining Fair Terms of Access
The conditions under which data is made available or disclosed must be fair, reasonable, and non-discriminatory. Data holders should establish transparent criteria for data access and ensure that any consideration complies with the requirements of Article 9 of the Data Act, in particular that it is reasonable and non-discriminatory; special limitations apply to certain recipients.
6. Protect trade secrets
If the data in question contains trade secrets, data owners are required to take appropriate protective measures. These include, in particular, contractual and technical safeguards that prevent unauthorized reuse. However, merely citing trade secrets does not justify a complete denial of access to the data; rather, it requires a balanced solution between protection interests and access rights.
7. Review and Amend Contracts and Terms and Conditions
Existing contracts and terms and conditions should be reviewed to ensure they comply with the requirements of the Data Act. Clauses that unreasonably restrict access to data or disadvantage users must be amended or removed. The goal is to establish balanced and legally compliant contractual provisions for handling data.
8. Establish processes for requests from public authorities
Data controllers should prepare internal procedures for handling requests from public authorities. In particular, for situations involving exceptional needs, it must be specified how data will be provided lawfully, for a specific purpose, and for a limited period of time. A structured approach increases legal certainty and ensures compliance with statutory requirements.
9. Comply with Switching and Portability Requirements
Data processing service providers must comply with the Data Act’s switching and portability requirements and remove existing barriers to switching providers (including the ability to take their data with them), concurrent use, or migration to their own IT infrastructure.
10. Ensure Documentation and Record-Keeping
Finally, all measures related to data access, data disclosure, fee structures, and the protection of sensitive information should be documented. Comprehensive record-keeping not only facilitates internal management but also helps prepare for potential audits by the relevant authorities.
Under Section 15 of Germany’s DADG, fines of up to 50,000 euros, 100,000 euros, 500,000 euros, or five million euros may be imposed, depending on the violation. For certain violations, companies with global annual revenue exceeding 250 million euros may also be subject to a fine of up to two percent of their total global revenue. The specific amount of the fine depends on the nature of the violation and the circumstances of the individual case.
The EU Data Act establishes clear rules for access to data from networked products and connected services. For companies, this primarily means assessing their own role, identifying relevant data sets, and adapting technical, contractual, and organizational processes.
Those who clarify responsibilities early on and take a structured approach to implementation reduce legal risks while also laying the groundwork for transparent and economically sound data use.
The checklist helps companies prioritize the implementation of the Data Act. It provides initial guidance on the company’s role, the data affected, and the necessary measures. It’s free and requires no data entry!
The checklist helps companies prioritize the implementation of the Data Act. It provides initial guidance on the company’s role, the data affected, and the necessary measures. It’s free and requires no data entry!
The EU Data Act regulates access to data from networked products and connected services, as well as the use and sharing of such data.
The Data Act has been in effect since September 12, 2025. Certain provisions will not take effect until later; in particular , Article 3(1) applies to products and related services placed on the market after September 12, 2026.
Those affected include, among others, manufacturers of connected products, providers of connected services, data owners, data users, and cloud and edge providers.
These include, for example, connected vehicles, smart home devices, industrial machinery, medical devices, and other products that generate data when in use.
Users must be able to access relevant product and usage data easily, free of charge, and in a timely manner. The data should be provided, whenever possible, in a structured and machine-readable format.
Yes. At the user’s request, relevant data must also be able to be disclosed to a third party designated by the user, provided that the legal requirements are met.
Trade secrets remain protected. Companies may implement appropriate technical and contractual safeguards without denying access to data across the board.
Companies should first clarify their role and the data sets involved. They should then adapt their technical access procedures, contracts, internal processes, and areas of responsibility to meet the requirements of the Data Act.
Our Data Act Checklist helps you set the right priorities for the next steps.
Sandra von König answers your personal questions, provides guidance, and gives you a clear overview of the options and added value.
Sandra von König will answer your personal questions, provide guidance, and give you a clear overview of the options and added value.
Laden Sie sich jetzt kostenfrei das E-Paper Potenzialanalyse: Daten & KI herunter und machen Sie den 5-Minuten-Check:
✔️ 10 Fragen zur Einordnung des digitalen Reifegrads
✔️ individuelle Erfolgschancen und Ableitungen für Ihr Unternehmen
✔️ konkrete, priorisierte Maßnahmen je Reifegradstufe
Klingt spannend? Mehr erfahren.
