EU Data Act

1. 2026-10-29 Low
   Commission Recommendation (EU) 2026/2394 provides non-binding model contractual terms for data access and…

   The Commission adopted Recommendation (EU) 2026/2394, which introduces non-binding model contractual terms for data access and use agreements, and non-binding standard contractual clauses for cloud computing …

   Guidance

That is the last 90 days. Sign in to read further back.

1. 2027-01-12 in 64 days Cloud and other data processing providers may no longer charge switching fees
2. 2027-09-12 in 307 days Unfair-terms rules (Chapter IV) extend to long-running data-sharing contracts concluded on or before 12 September 2025
3. 2028-09-12 in 673 days Commission evaluation of the Data Act due (Article 49)
4. 2026-09-12 Data access by design (Article 3(1)) applies to connected products and related services placed on the market after this date
5. 2025-11-19 Commission proposes Data Act amendments in the Digital Omnibus, COM(2025) 837
6. 2025-09-12 The Data Act applies; Member States had to notify their penalty rules by this date
7. 2024-01-11 The Data Act enters into force; reduced, cost-based switching charges start

1. 2025-11-19
   Digital Omnibus proposal, COM(2025) 837 Draft

   Commission proposal whose Article 1 folds the Data Governance Act, open-data and free-flow rules into the Data Act and narrows several of its obligations. source

   More

   • Business-to-government data requests (Chapter V) would be limited to public emergencies (new Article 15a, Articles 14 and 15 deleted).
   • Cloud switching rules (Chapter VI, except the end of switching charges) would not apply to custom-made data processing services or to SME and small mid-cap providers' services, in both cases under contracts concluded on or before 12 September 2025 (new Article 31(1a) and (1b)).
   • The essential requirements for smart contracts (Article 36) would be deleted.
   • Not adopted; the European Parliament lists procedure 2025/0360(COD) as awaiting a committee decision.
2. 2024-12-09
   Regulation (EU) 2023/2854 (as corrected 2024) ErrataCurrent text

   Corrigendum to Article 48, which inserts the Data Act into the Annex to Directive (EU) 2020/1828: the entry is renumbered. source

3. 2023-12-13
   Regulation (EU) 2023/2854 Major version

   The Data Act, published in the Official Journal on 22 December 2023. source

   More

   • It entered into force on 11 January 2024 and has applied since 12 September 2025.

The Data Act gives users access to the data their connected products generate and makes cloud providers let customers switch.

Connected products

Manufacturers of connected products placed on the EU market and providers of related services, wherever they are established, and their users in the EU (Article 1(3)). source

Data access

Product and related service data must be accessible to the user by default, free of charge and in a machine-readable format (Article 3(1)). source

Small companies

The user data-sharing obligations of Chapter II do not apply to data from products or services of micro and small enterprises without larger partner or linked enterprises (Article 7(1)). source

Cloud switching

Chapter VI applies to any data and services processed by providers of data processing services; switching rights must be in a written contract (Articles 1(2) and 25). source

Foreign government access

Providers of data processing services must take measures against third-country government access to non-personal data held in the EU that would conflict with EU or national law (Article 32). source

Companies build the access, sharing and switching duties into their products and contracts themselves; only smart contract vendors run a formal conformity assessment.

Smart contracts

Vendors of smart contracts used to execute data-sharing agreements perform a conformity assessment against the essential requirements and draw up an EU declaration of conformity (Article 36(1)-(3)). source

Switching contracts

Contracts must give a notice period of at most two months to start switching and at least 30 calendar days to retrieve data after the transition (Article 25(2)). source

Switching charges

Until 12 January 2027 providers may charge only reduced, cost-based switching fees; from that date none (Article 29). source

National competent authorities enforce the Data Act under penalty rules each Member State sets; data protection authorities can fine at GDPR levels.

Competent authorities

Each Member State designates one or more competent authorities and, if more than one, a data coordinator (Article 37(1)-(2)). source

National penalties

Member States lay down effective, proportionate and dissuasive penalties and notified them by 12 September 2025; the Commission keeps a public register of those measures (Article 40(1)-(2)). source

1. Law text Regulation (EU) 2023/2854 (Data Act)
2. Law text Digital Omnibus proposal COM(2025) 837 (amends the Data Act; not adopted)

1. GDPR

   Governs personal data; the Data Act covers personal and non-personal product data, and data protection authorities enforce it where personal data is concerned.

2. NIS2

   Regulates the cybersecurity of cloud and data centre providers, while the Data Act regulates switching and data access.

3. Germany C5

   Germany's BSI catalogue of cloud security criteria, a national standard rather than an EU regulation.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to EU Data Act (RSS)