While the GDPR protects personal data, the EU Data Act governs the sharing of non-personal, industrial, and IoT data. It aims to break up data silos held by manufacturers and empower users to control the data generated by the devices they own.

The Right to Access Data

The core principle is simple: Users (both B2C and B2B) have the right to access the data generated by their connected products (e.g., smart home devices, industrial machinery, connected cars, medical devices).

  • Accessibility by Design: Products must be designed so that generated data is, by default, easily and securely accessible to the user without undue delay.
  • Third-Party Sharing: Upon user request, the data holder must share the generated data with a third party. This allows users to switch repair services, analytics providers, or aftermarket parts suppliers, breaking vendor lock-in.

Gatekeepers designated under the Digital Markets Act (DMA) are explicitly excluded from receiving this data as third parties, preventing Big Tech from monopolizing IoT data flows.

B2B Data Sharing Obligations

When data holders are obliged to make data available to third parties under the Data Act, they must do so under Fair, Reasonable and Non-Discriminatory (FRAND) terms.

  • Compensation must be reasonable and can include margins, but cannot be extortionate.
  • For SMEs, compensation is strictly limited to the direct costs incurred in making the data available.

Protecting Trade Secrets

The Act balances data access with intellectual property protection. Data holders can withhold specific data if its disclosure would cause serious economic damage by exposing trade secrets, provided they demonstrate this risk. Data cannot be used by a third party to reverse-engineer the original product.

Cloud Switching

To reduce vendor lock-in in cloud infrastructure, the Data Act mandates that providers of data processing services (cloud/edge) must remove commercial, technical, and organizational obstacles allowing customers to switch providers within 30 days. Switching charges will be gradually phased out completely.

B2G Data Sharing in Emergencies

In cases of public emergency (e.g., pandemics, major natural disasters), public sector bodies have the right to request access to data held by private companies if the data is strictly necessary to respond to the emergency.