The scope of the EU Data Act: what’s in, what’s out?

In this blog, we explain the material scope of the Data Act:

• which products and services fall under the regulation?
• who is covered (from manufacturers to cloud providers)?
• what is not covered and the key exclusions,
• the transition periods and exemptions for SMEs, and
• practical steps your organisation can take now to prepare for compliance.

By the end, you’ll know whether the Data Act applies to your organisation and what you should be doing to turn compliance into an opportunity…

What falls under the Data Act?

I. Connected products

Under the Data Act, a “connected product” is defined in Article 2(5) as any item that obtains, generates or collects data about its use or environment and can communicate that data via an electronic communications service, physical connection or on-device access, provided that its primary function is not simply to store, process or transmit data on behalf of another party.

In practice, this is a very broad definition. A product does not need to be “smart” in the sense of being internet-enabled. As long as it generates data and can send that data onward—whether through Wi-Fi, Bluetooth, NFC, a mesh network or even a local wired connection—it falls under the Act. Crucially, full internet access is not required; even local or point-to-point communication is enough, as long as the device can share data beyond itself.

The only notable exclusion is for pure IT infrastructure, such as servers or network routers, whose sole purpose is to transmit or store data for others. These are considered intermediaries, not genuine sources of user-generated data. Apart from this narrow carve-out, connected products are everywhere: from household appliances and consumer electronics to vehicles, medical devices, agricultural equipment and industrial machinery.

To make this more concrete, here are a few examples of what counts as a connected product in different sectors:

• Retail: Shops increasingly rely on smart devices such as connected point-of-sale terminals or IoT sensors for inventory. “Smart shelves” with weight sensors or cameras that monitor stock levels are clear examples of connected products. They collect data (sales, inventory, temperature) and transmit it to a back-end system, whether via Wi-Fi, Bluetooth or a local network.
• Agriculture: Modern tractors and harvesters are packed with sensors tracking location, fuel use, engine performance or soil moisture. Under the Data Act, farmers gain the right to access and share this data, for example with an independent mechanic or a specialist software platform, rather than leaving it locked in the manufacturer’s cloud.
• Industry: From oil drilling rigs to packaging machines, almost every industrial machine today is internet-connected and streams operational data back to the manufacturer. The Data Act ensures that operators can access this data themselves and share it with third parties, for maintenance, optimisation or analytics, instead of being tied to the supplier’s ecosystem.

II. Related services

In addition to physical devices, the Data Act is also applicable to related services that are linked to the use of a connected product. Under the Data Act, a “related service” is defined in Article 2(6) as “a digital service, other than an electronic communications service, which is incorporated in, or inter-connected with, a connected product in such a way that its absence would prevent the connected product from performing one of its functions, or which is used to adapt, supplement or extend the functions of that connected product.”

To qualify as a related service, two conditions must be met:

1. the service must exchange data two ways with the product; and
2. the service must influence or control the product’s functions, features or behaviour.

This implies that a simple app which only reads data from a device (but doesn’t send any commands or affect how the device operates) would not count as a related service. There needs to be genuine interaction. For instance, sending settings or instructions back to the device via the app would satisfy this requirement.

If your company provides a digital service that is integrated with a physical product in this manner, it will fall under the same obligations as the product’s manufacturer in terms of data access. Some examples of related services include:

• A smartphone app to control smart home devices (e.g. an app that not only displays your smart thermostat’s readings but also lets you remotely adjust the temperature).
• A cloud platform that monitors and optimises machine performance (for instance, an analytics dashboard provided by the maker of an industrial pump, which receives sensor data and can send back optimisation settings or firmware updates to that pump).
• An ongoing maintenance or tuning service for a smart appliance (for example, a “smart maintenance” programme for a complex manufacturing robot, where the service provider receives operational data and can remotely adjust the robot’s parameters).

In all these cases, the absence of the service would limit the product’s functionality, and there is active data sharing and control. That means these related services are firmly within the Data Act’s scope.

III. Cloud and other data processing services

Last but not least, the Data Act also covers data processing services, which include cloud computing in all its forms: infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS) and software-as-a-service (SaaS). In essence, any service that provides customers with access to computing resources, platforms or software over a network falls within this category, whether delivered via a public cloud, a private cloud or at the edge.

This means that providers hosting or processing data on behalf of users are also within scope. The logic is clear: just as users should not be locked into a single manufacturer or related service, they should not be tied to one cloud provider either.

Examples of cloud and data processing services under the Act include:

• Retail: an e-commerce company running its webshop on a cloud infrastructure service.
• Industry: a manufacturer using a cloud-based IoT dashboard to analyse machine performance.
• Healthcare: a hospital storing and processing patient scans in a cloud environment.

In all these cases, the service forms part of the digital ecosystem in which data is generated, processed and used. The Data Act brings such services explicitly within its material scope.’

Who is in scope of the Data Act?

1. Manufacturers and suppliers of smart (“connected”) products: Does your company make or sell a device that digitally gathers information about its usage or environment and can communicate that data (for example via the internet or other networks)? If so, that device is a “connected product” under the Data Act, and you as its manufacturer or provider have duties under the law. Manufacturers of such devices will be required to ensure that, going forward, their products are designed to allow user access to the data generated during use.
2. Providers of digital services linked to a connected product (“related services”): This includes cloud or software services that are necessary for the product to function, or that have been added (by the manufacturer or even by third parties) to extend or modify a product’s functionality. If your business provides such a service, you are subject to the same data-access obligations as the device’s manufacturer. In practice, that means you must make available to the user any data your service generates or collects from the product, upon their request (just as a device maker must).
3. Data holders controlling the data: The Data Act introduces the role of “data holder” for the entity that actually has access to and control over the data coming from the device or related service. In many cases, this will be the manufacturer or the software provider itself, but it could also be a platform or cloud provider that hosts the data on their behalf. If you are the party in possession of the usage data, then you have a duty to share those data whenever the user (or a user-authorised third party) asks for them. You must provide the data without undue delay, in a secure way, in a common usable format and at no charge to the user. If the user has designated a third party to receive the data, you can only charge that third party a reasonable fee that reflects the cost of making the data available (and nothing more). Demanding excessive fees or dragging your feet would violate the Act’s requirement that conditions be fair and non-discriminatory.
4. Providers of data storage and processing services (cloud/edge providers): The Act also regulates providers of infrastructure (IaaS), platforms (PaaS) and software-as-a-service (SaaS). If you operate in the EU or serve EU customers, you will face new rules on portability and interoperability. Customers must be able to switch providers without undue barriers. That means no unreasonable notice periods or contractual restrictions: the Act limits termination notice for switching to roughly two months, and all switching charges must be phased out completely by 12 January 2027.
   Technical compatibility is also required. Your systems should either be interoperable or at least allow data export in common formats. For example, a company using your analytics platform must be able to move its datasets and configurations to another provider easily, without data loss or prohibitive costs.
5. Third parties: The Data Act is not just about manufacturers and their direct customers. It also sets rules for what happens when data flows to third parties. Think of a software company that doesn’t build devices but offers an app or service powered by data from someone else’s smart product. Once that company receives device data at a user’s request, it falls under the Act’s framework. Take logistics as an example. A transport company runs a fleet of smart lorries with telematics sensors recording GPS locations, trip logs, driver behaviour and fuel use. The company wants to share these data streams with an external analytics platform to optimise routes and efficiency. Under the Data Act, the transport company – as the user – can instruct the truck manufacturer or fleet management provider (the data holder) to share the data directly with that analytics platform. The data holder must comply, provided the chosen recipient is based in the EU. The handover must be fair, reasonable and non-discriminatory (FRAND): no excessive fees, no artificial delays, and no hidden restrictions. The EU-only rule ensures proper oversight of how data is used downstream. Third-party recipients also face strict conditions. They may only use the data for the agreed purpose, must delete it once no longer needed, and cannot pass it on without permission. Crucially, they are barred from using the data to build or improve a competing product or service – unless the original provider consents. In our example, the analytics company could help optimise routes, but it cannot develop its own fleet management system in competition with the truck manufacturer. These guardrails are designed to build trust. They ensure that users can benefit from sharing data with third parties, without opening the door to unfair competition or misuse.

Exceptions; what is not covered by the Data Act?

It’s equally important to understand what data and products are outside the scope of this law. Key exclusions and limits to the material scope include:

• Purely static or descriptive data: The Data Act focuses on usage data arising from the use of a product or service. Information that is not generated by use (for example, a device’s instruction manual, an ingredient list, or static technical specifications) is not covered by the Act. Such non-usage data (like a PDF manual or a fixed product description) does not need to be shared under this law.
• Derived or heavily processed data: You are not required to share insights or outputs that your company has created through significant processing or analysis of raw data. The law is intended to ensure access to the raw and directly observed data (or data that has only undergone minimal processing). Complex analytics, proprietary algorithms, or any information that amounts to your company’s secret sauce do not fall under the user’s access right. Recital 15 of the Data Act clarifies that data resulting from “complex processing” or algorithmic analysis is outside the scope. In practical terms: you must make sensor readings, usage logs and basic metadata available, but not the deep analysis or predictions you derive from them. For example, a smart thermostat will produce temperature measurements and on/off timings (those would have to be shared if requested), but a sophisticated prediction of next month’s energy usage that you compute from those measurements would be considered an added-value insight, and the Act does not force you to hand over that kind of derived information.
• Non-connected products and pure IT infrastructure: If you don’t produce any products that digitally collect or transmit data, then the IoT data-sharing requirements in Chapter II of the Act don’t apply to you. A traditional “dumb” appliance with no connectivity generates no usage data for the Act to cover. Additionally, certain devices whose primary function is to store or transport data for others are not treated as “connected products” in the sense of the law. Classic examples are networking equipment like routers or pure data storage servers, which typically just shuttle or hold data that belongs to others. (Note: this exclusion is interpreted narrowly. If such a device is directly operated by an end user and generates data about that user’s own activities, it could still be considered a connected product according to the European Commission’s guidance. However, in most cases, ordinary servers and routers remain outside the Act’s scope.)
• Personal data vs. non-personal data: The Data Act makes no distinction here: it applies to any data generated by the product or service, whether it’s personal or not. This is worth noting because it’s sometimes mistakenly assumed the Act only concerns “industrial” (non-personal) data. In reality, many use cases will involve a mix (for instance, a smart car generates technical performance data and location data tied to an individual driver). However, existing privacy laws (like the GDPR) still fully apply alongside the Data Act. The Data Act does not create a new legal permission to hand out personal data. If the requested dataset includes personal information, you must have a valid legal basis under GDPR to disclose it (for example, the user’s consent, or because it’s necessary to perform a contract with them). In practice, the Data Act obliges you to share data when a user asks, but only as far as it is legally permissible under privacy rules. You will need to comply with both sets of laws simultaneously. In other words, you should make data available as required, but in a way that doesn’t breach your data protection obligations. This dual compliance is achievable but requires careful planning (for instance, you might need to filter or anonymise certain personal elements before sharing, or secure explicit consent from the user).

Exemptions and transition periods

The EU legislators recognised that the impact of these new rules will differ depending on a company’s size and situation. Therefore, the Data Act provides a few exceptions and phased timelines:

• Micro and small enterprises exempt: If your organisation has fewer than 50 employees and less than €10 million in annual turnover, it is exempt from the connected product data-sharing obligations (the requirements in Chapter II of the Act). In other words, the smallest manufacturers or service providers do not have to provide data access under the Data Act. However, this exemption doesn’t apply if your small business is part of a larger group that would otherwise fall under the rules, or if a large firm is essentially using you as an outsourced producer specifically to dodge the law. The Act is designed to prevent abuse of the SME exemption.
• Medium-sized businesses get more time: Medium enterprises (with under 250 employees and under €50 million turnover) aren’t exempt, but they do receive a bit of extra breathing room. For these companies, data generated by their existing products (those already on the market before the Act kicks in) doesn’t have to be made accessible until September 2026 (roughly 12 months after the main effective date). This grace period gives mid-sized firms an additional year beyond larger companies to adapt their devices and systems to the new requirements.
• Existing products on the market: Separate from company size considerations, there is a general transition period for products that were already in circulation before the Data Act’s start date. Manufacturers have until September 2026 to bring those pre-2025 devices into compliance with the data access requirements. In contrast, any new connected products placed on the EU market after 12 September 2025 must comply with the Data Act from day one.
• Unfair contract terms in data sharing (B2B contracts): Be aware that the Data Act will invalidate certain contractual clauses. Article 13 of the Act (in the final text) effectively says that any provision which seeks to limit the Act’s mandatory data access rights for users is null and void. Moreover, the Act provides examples of contract terms that are automatically considered unfair or are presumed unfair in B2B data-sharing agreements (similar to “black” and “grey” lists familiar from consumer protection law). For instance, a clause that completely forbids the user from accessing or using any data generated, or a clause that waives all liability for a provider who fails to supply data, would not be enforceable. If your business enters into contracts involving data exchange, even if you’re not an IoT device maker, you should review those agreements and remove or revise any terms that conflict with the new law’s fairness standards.

Practical tips to prepare for Data Act compliance

Adapting to the Data Act will take time and planning. Here are some practical steps and considerations you can start on now:

• Map your data flows and holdings: Begin with a thorough inventory of what data your products and services currently generate and collect. Identify where that data is stored and who has access to it as well as whether it is personal or non personal data. Crucially, distinguish between data that would fall under the Data Act’s sharing mandate (essentially, raw or minimally processed usage data) and other information that might be considered derived or out-of-scope or where GDPR would deny sharing/acces. Having a clear map of your data landscape will help you determine what exactly you would need to make available and what not, once the law applies.
• Evaluate product design and IT systems (build in “access by design”): Check whether your existing products and digital services have a means for users to retrieve usage data easily. Going forward, the Data Act effectively requires that connected devices and their related services be designed with data accessibility in mind. You may need to update firmware, software interfaces, or back-end systems to enable a secure data export or API that users can tap into. Plan and budget for these technical upgrades now, especially for any new products slated to launch after mid-2025. Ensure that data can be provided in real-time or near-real-time and in a standard format that users or third-party services can readily use.
• Review contracts and terms of service: Examine your existing customer contracts, licence agreements, and terms & conditions for any clauses that restrict data sharing or users’ rights regarding data. Under the Data Act, such clauses will be unenforceable (and some might even be illegal), so you’ll want to remove or amend them. Conversely, you might want to add provisions that clarify how and in what format you will provide data to users or third parties, and any safeguards or nominal fees that will apply. Also be mindful of liability and confidentiality sections. Ensure they align with the Act’s requirements (for example, you can’t make the user waive all liability for your failure to supply data). It’s a good idea to start updating these documents sooner rather than later, to be in line with the law by 2025.
• Develop a strategy to protect trade secrets: When you’re obliged to share data, some of that information might be sensitive or part of your intellectual know-how. The Data Act does allow you to take measures to safeguard confidentiality and trade secrets, but you need a plan for how to do this while still complying. Begin by identifying which data (or combinations of data) in your ecosystem might reveal proprietary insights. Then consider protective steps: for example, using non-disclosure agreements when sharing data with third parties; limiting the scope of use (the Act already imposes purpose limitations on third-party use, as discussed, but you might reinforce these in contracts); and providing access via secure, controlled channels (such as a secure API or portal with authentication and encryption). In extreme cases, if you believe sharing a particular dataset would inevitably expose a core trade secret, the Act allows you to refuse disclosure, but only if no safeguard could realistically prevent the harm. Even then, you would need to justify this refusal to the regulators. The bottom line is to be proactive: figure out how you can comply with data sharing requests in a way that doesn’t give away your “secret sauce.” Document these decisions and protocols.
• Prepare your customer communications: The Data Act requires transparency with users from the point of sale or contract. That means you should be ready to inform customers (for example, in user manuals, product information sheets, or online) about what data the product or service generates and how they can request access to it. Consider creating a user-friendly guide or updating your FAQs to explain, for instance, the types of data logged, the format it’s available in, and the process for getting it (e.g. “Contact our support team or visit your account dashboard to download your data”). Training your sales and customer support teams will also be important. They need to understand these new user rights so that they handle inquiries correctly and help users exercise their data access without friction. Being transparent and helpful about data access not only ensures compliance but can also build trust with your customers. Also remember to create a specific portal and procedure for receiving and handling data access and sharing request.
• If you provide cloud or software services, facilitate easy switching: If you are a provider of any data processing service (cloud hosting, SaaS platform, etc.), audit your service terms and technical setup for barriers to customer portability. Long-term contracts with rigid lock-ins, high termination penalties, or proprietary data formats that make export difficult should all be rethought. The Data Act will require you to enable customers to move their data and workloads out without undue burden. Start by implementing (or improving) data export tools that allow clients to download all their data in a commonly used format. Plan to reduce any switching fees to only what is justified by actual transition costs. Remember that by January 2027 you won’t be allowed to charge anything for switching. Also, explore ways to make your system more interoperable with others, perhaps by adopting industry standards or APIs for data exchange. Showing customers that they can leave if they want to (and making that process smooth) may seem counter-intuitive, but it will soon be a legal necessity and could even be a selling point if handled gracefully.
• Keep an eye on the calendar (deadlines and penalties): As of 12 September 2025, most of the Data Act’s provisions are now in force. Medium-sized firms have until 2026 for existing products, as noted, but in general it’s better to aim for full compliance by 2025 to be safe. Regulators in each EU country will be appointed to enforce the Act, and while exact fines will depend on national implementation, the law calls for “effective, proportionate and dissuasive” penalties. As a point of reference, the GDPR allows fines up to 4% of worldwide annual turnover for serious infringements, and the Data Act explicitly mentions a similar ceiling. In short, non-compliance could be very costly. Beyond fines, you also risk reputational damage if you’re seen as dragging your feet on user data rights. Therefore, treat the timeline seriously: make someone in your organisation responsible for Data Act readiness, set internal milestones for the coming months, and consider seeking legal advice or external expertise if needed to ensure you cover all bases.

Conclusion

The EU Data Act reshapes the balance of power over data. Where manufacturers and service providers once controlled access, users now gain a clear right to retrieve and share the data they generate. For businesses, this shift brings both opportunity and obligation. You may benefit from new streams of accessible data, but you may also need to redesign products, update contracts, and adapt your services to meet the Act’s requirements.
Compliance should not be seen as a box-ticking exercise. Done well, it can build customer trust, open the door to partnerships, and spark new business models built on shared data. The key is to act early: map your data, adjust your systems, and prepare your teams. Companies that move now will not only avoid penalties but also secure a competitive edge in Europe’s emerging data economy.