The EU Data Act & Local Legislation… What the EU Member States need to cover in local legislation?

A Regulation - But Not the Whole Story

Unlike directives, EU regulations are directly applicable in all Member States without the need for transposition into national law. However, that does not mean that national legislators have no role. The Data Act contains several areas that require Member States to complement the regulation with national laws & regulations.

Areas Requiring National Implementation

1. Penalties
   Article 40 of the Data Act requires that Member States lay down rules on penalties applicable to infringements of the regulation. Member States should:
   • Ensure that penalties are effective, proportionate, and dissuasive
   • Follow the recommendations of the European Data Innovation Board (‘EDIB’) for the imposition of penalties to avoid substantial national fragmentation
   • Designate national authorities responsible for monitoring compliance and imposing penalties

   Member States are required to establish the rules on penalties and notify the European Commission thereof by 12 September 2025. As a result, the specific national penalty regimes—and any potential differences between them—are expected to become clear after that date.
   
   In addition to the core obligations under Article 40, Member States are encouraged to align their enforcement frameworks with the EDIB’s non-binding model recommendations. These frameworks aim to reduce fragmentation by promoting consistency in penalty structures, particularly in complex areas such as cloud services and B2B data sharing
   
   The European Commission’s September 2024 FAQs further clarify that penalties may apply not only to breaches of data access rights but also to failures in cloud switching and contractual transparency
   
   While the deadline for notifying the Commission remains 12 September 2025, internal commentary suggests that some Member States may adopt interim enforcement mechanisms or experience delays due to legislative bottlenecks
   
   In addition to all the above it’s also important to note the relevance of the European Data Protection Board’s Statement 4/2025, which highlights the need for coordinated enforcement across overlapping regulatory regimes

2. Competent Authorities
   
   Article 37 of the Data Act requires that Member States appoint one or more competent authorities to oversee different parts of the regulation, such as:• Ensuring fair data access obligations between businesses (B2B)
   • Handling user access rights (B2C or B2G)
   • Overseeing the switching of cloud services and interoperability obligations

   Member States may choose to appoint new bodies or rely on existing regulators. For example, in the Netherlands, the Personal Data Authority is proposed as the competent authority for personal data-related provisions, while the Consumer and Market Authority (ACM) is designated as the data coordinator. The ACM is also authorised to supervise compliance across multiple chapters and establish cooperation protocols with other regulators.

   In cases where multiple authorities are designated, one must be appointed as the ‘data coordinator’. This body is responsible for ensuring cooperation—particularly in cross-border situations—and serves as the main point of contact for businesses operating across several Member States. According to the Commission’s FAQs, the coordinator’s role includes streamlining enforcement and facilitating communication with stakeholders

3. Dispute Resolution Mechanisms

The Data Act encourages the use of out-of-court dispute resolution mechanisms. Member States may offer the option to engage in alternative dispute resolution (ADR) by establishing certified dispute settlement bodies to deal with:

• Disputes between data holders and data recipients
• Disagreements over compensation or contractual terms

This approach offers a way to resolve conflicts more quickly and cost-effectively than traditional court proceedings. It is particularly intended to support businesses, especially smaller companies, in enforcing their rights under the Data Act. According to the Commission’s FAQs, ADR mechanisms are especially encouraged for cross-border B2B disputes involving cloud switching and data access. Member States are invited to certify neutral bodies that meet minimum standards of independence, transparency, and procedural fairness

However, it is important to note that this is optional for Member States. Whether such mechanisms are available depends on whether a country has chosen to incorporate them into its national procedural law. As such, it is advisable to check whether the relevant Member State has introduced this option in its domestic legal framework.

Parties are free to bring their dispute before a dispute resolution body in either their own Member State or another Member State. Importantly, ADR mechanisms must not prejudice the right to judicial redress under national or EU law, as confirmed by EUR-Lex commentary on Regulation 2022/1925.

What Businesses Should Do Now

While the Data Act provides a uniform framework, local implementation will vary, especially when it comes to enforcement, penalties, and competent authorities. Businesses operating in multiple Member States should:

• Start monitoring national legislative developments
• Identify which national bodies will oversee enforcement in (your) key markets
• Prepare for differences in sanctions and supervisory approaches across jurisdictions

Beyond compliance, the Data Act presents a strategic opportunity to unlock value from data assets. Companies can leverage new access rights to improve product development, negotiate better supplier terms, and enhance customer experience. Sector-specific readiness is key: manufacturers of connected products must prepare for user access and cloud switching obligations, while healthcare and energy providers should anticipate public emergency data access requests.

Final Thoughts

The EU Data Act marks a major shift in how data is shared, accessed, and governed in the European Union. While the regulation is directly applicable, Member States still play a crucial role in shaping in its practical enforcement. Companies should adopt a pan-European compliance strategy that takes into account both the common EU rules and local legal procedural nuances.

If you have questions about how the Data Act will apply in your country or sector, our team of internationally skilled data and privacy lawyers is here to guide you in Data Act compliance.