Welcome to data-act-law.eu. Here you will find the PDF of the Data Act in a clearly structured format. The final text of the regulation is available in German and English. Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data will apply from 12 September 2025 with some exceptions.
Quick Access
Table of contents
What is the Data Act and why is it important?
The Data Act is a central component of the European data strategy and for the first time lays down standardised rules for fair access to and use of data within the EU. The aim is to promote the creation of a competitive internal market for data and to eliminate imbalances in access to data. The legal basis for the objective and scope are set out in Article 1 and Recitals 1 to 10.
When does the Data Act come into force and who does it apply to?
The Data Act came into force on 11 January 2024 and, in accordance with Article 50, will apply from 12 September 2025, subject to certain transitional arrangements. The Regulation applies to data holders, data recipients, users, manufacturers of connected products and providers of digital services based in the EU or outside the EU, provided that their activities have an impact on the EU internal market (see Article 2 on territorial and material scope).
What rights do users get under the Data Act?
Users of connected products, like smart home devices or industrial machines, get an explicit right to access the data generated during use. They can use this data themselves or share it with others. This right to use is set out in Article 4 and is backed up by Articles 5 and 6, which lay out the requirements for data access and sharing. The rights apply regardless of whether the data is personal or non-personal.
What does the Data Act mean for companies in the EU?
Companies that generate, process or control data must in future ensure that user data is made available in a structured, standardised and machine-readable format. In addition, unfair contractual clauses on data access or use are prohibited in relation to SMEs (see Article 13). Data controllers must cooperate with data requests from authorised third parties, provided that the conditions in Articles 8 to 12 are met. This applies in particular to transparency obligations and appropriate remuneration.
The Data Act introduces new obligations for companies in the EU when handling data. The aim is to ensure fair access to data and to promote innovation and competition. Important requirements:
- Enable data access:
Companies must enable users to access the data they generate (see Articles 4 and 5). The data must be provided in a structured, machine-readable format. - Comply with transparency obligations:
Clear information about the type, scope and use of the data must be provided before the contract is concluded (Article 3(2)). - Ensure contractual fairness:
Unfair contractual terms vis-à-vis SMEs – for example, regarding liability, use or refusal of data access – are prohibited (Art. 13). - Support public authorities:
In exceptional cases (e.g. emergencies), data must be transferred to public authorities upon request if the conditions are met (Art. 14–22). - Ensuring data portability:
Providers of cloud and data processing services must enable easy switching between services and avoid vendor lock-in (Art. 23–26).
How does the Data Act relate to the GDPR?
While the GDPR only applies to personal data, the Data Act regulates access to and use of both personal and non-personal data (see Article 1(2)). While the GDPR aims to protect personal data, the Data Act regulates the availability of data in the internal market. However, the two sets of rules are complementary: in the event of overlap, the GDPR takes precedence (see Article 1(5)).
What data is affected by the Data Act?
All data generated when using connected products and related services is covered – i.e. both personal and non-personal data, provided it is technically accessible. This is defined in Article 2(1) and (2). However, data that is specifically protected by intellectual property rights is excluded, unless there is legitimate access (see Article 4(6)).
What do manufacturers of connected devices need to consider with regard to the Data Act?
Manufacturers are obliged to design their products and services in such a way that user data can be made accessible by default. The technical design must promote data portability and interoperability (see Articles 3 and 4). In addition, manufacturers must provide clear information on data collection and use before the contract is concluded (see Article 3(2,3)).
What penalties are imposed for violations of the Data Act?
The Regulation leaves the specific design of sanctions to the Member States (see Article 40). They are required to empower authorities to impose ‘effective, proportionate and dissuasive’ measures (Article 37(5)). These may include fines, injunctions or other supervisory measures.