What Is the EU Data Act?

The EU Data Act (Regulation (EU) 2023/2854) is a European law that sets the rules for who can access, use, and share the data generated by connected products and related services. It shifts control of that data toward the users who generate it, requires cloud providers to make switching easier, and sets fair terms for data sharing between businesses and, in defined cases, with public bodies. It has applied across the EU since 12 September 2025, with some provisions phasing in later.

It matters because connected products, industrial machines, vehicles, and smart devices generate large volumes of data, and in practice the manufacturer has often controlled access to it. The Data Act rebalances that: users gain the right to access the data their use generates, and the businesses that hold that data gain obligations to make it accessible and portable. For organizations that make or hold data from connected products in the EU, or that provide cloud services there, parts of data access and sharing become legal obligations rather than commercial choices.

What the EU Data Act Is

The Data Act is a horizontal regulation, meaning it applies across sectors rather than to one industry. Its central idea is that data generated by a connected product should be accessible to, and usable by, the people and businesses that generate it, not only the manufacturer. It addresses both personal and non-personal data, and it works alongside the GDPR rather than replacing it: where the data is personal, GDPR still applies in full, and where the two conflict, the data protection law prevails.

What It Covers

The regulation has a few main pillars:

• Access to connected-product data. Users of connected products (from smart home devices and wearables to connected vehicles and industrial machinery) have the right to access the data their use generates, and products placed on the market after 12 September 2026 must be designed so that this data is accessible to the user by default, easily, securely, and free of charge, and directly where that is relevant and technically feasible (Article 3(1)). Micro and small enterprises are largely exempt from these obligations.
• Business-to-business and business-to-government sharing. Where a data holder must make data available to a third party a user chooses, the Act requires fair, reasonable, and non-discriminatory terms, and it allows public bodies to request data in situations of exceptional need, such as a public emergency (Chapter V).
• Cloud switching. Cloud and other data-processing providers must remove technical and contractual obstacles to switching (Chapter VI), so customers are not locked in and can move their data and applications to another provider.
• Interoperability and safeguards. The Act sets interoperability requirements for data spaces and cloud services, makes unfair contractual terms on data access and use that one business imposes unilaterally on another non-binding (Chapter IV), and includes safeguards for trade secrets and against unlawful international governmental access to non-personal data held in the EU (Article 32).

Timeline

The Data Act was published in the Official Journal on 22 December 2023 and entered into force on 11 January 2024. Most of it has applied since 12 September 2025, and Article 50 sets later dates for some provisions: the by-design access duty of Article 3(1) covers connected products and related services placed on the market after 12 September 2026, and the unfair-terms rules of Chapter IV apply to contracts concluded after 12 September 2025 and, from 12 September 2027, also to older contracts that are of indefinite duration or due to expire at least ten years from 11 January 2024. Under Article 29, cloud providers may charge reduced switching charges until 12 January 2027 and none after that date. The direction is clear: access and portability are becoming defaults, not favors.

The rules may still change. On 19 November 2025 the European Commission proposed a digital omnibus that would amend the Data Act, among other things by merging several EU data laws into it. At the time of writing (October 2026) it is still a proposal before the European Parliament and the Council, so the dates above are the law in force.

EU Data Act vs. the Data Governance Act

These two laws are easy to confuse but do different jobs. The Data Governance Act (Regulation (EU) 2022/868) is about the mechanisms for voluntary data sharing: it regulates data intermediaries, sets rules for reusing certain public-sector data, and enables "data altruism." The Data Act is about rights and obligations: who can access and use the data connected products and services generate, and on what terms. In short, the Data Governance Act builds the plumbing for sharing; the Data Act decides who gets the water.

What It Means for Data Teams

The Data Act turns questions that were once optional into compliance obligations. To honor a user's right to access connected-product data, you have to know that data exists and where it lives. To share data on fair terms, or to move it between clouds, you need to know its structure, its sensitivity, and its dependencies. And to protect trade secrets and personal data while sharing the rest, you need classification you can trust. In other words, the Act is easier to meet for organizations that already have a clear, governed picture of their data estate than for those without one.

How Dawiso Fits

Dawiso does not file your compliance paperwork or decide what you must share, but it gives you part of the governed foundation the Data Act assumes you have: a documented map of the data you have catalogued, what it means, how sensitive it is, and where it moves.

• An inventory of your data estate. The data catalog gives you a governed view of the data in the systems you connect to it, which can include systems that store connected-product and service data, so access and sharing requests start from a documented inventory.
• Sensitivity you can act on. Classification in Dawiso is set by people in your organization: assets are labelled with a PII level and a confidentiality value from code lists your organization defines, and the most sensitive value rolls up automatically in data products. That record helps you decide what to share and what to protect, including trade secrets; Dawiso does not enforce those decisions itself.
• Flows you can trace. Interactive lineage shows where data comes from and goes, as far as lineage has been captured, supporting portability, data sharing, and audit.
• Consistent meaning for sharing. The business glossary keeps definitions consistent, so the parties to a data-sharing arrangement can work from the same documented meaning.

The Data Act joins GDPR and the EU AI Act in a growing body of EU rules that all reward the same thing: knowing and governing your data. Build that foundation once and you can reuse it for each new regulation instead of starting from scratch.

Conclusion

The EU Data Act rewrites who controls the data from connected products and cloud services, giving users access rights, setting fair sharing terms, and removing barriers to cloud switching, with most obligations live since September 2025 and further dates in 2026 and 2027. It is separate from the Data Governance Act, and it works alongside GDPR. Meeting it rests largely on a governed, current understanding of the data you hold, its sensitivity, and its flows. Get that foundation right and the Data Act, like the regulations around it, becomes manageable rather than daunting.

Sources

• EUR-Lex, Regulation (EU) 2023/2854, Data Act (Articles 1(5), 3(1), 7, 13, 29, 32 and 50).
• European Commission, Data Act explained.
• EUR-Lex, Regulation (EU) 2022/868, Data Governance Act.
• European Commission, Simpler EU digital rules and new digital wallets to save billions for businesses and boost innovation (19 November 2025).
• Dawiso Help, PII Level and Confidentiality.