Use cases / Data Act compliance
Data Act compliance for connected products.
The EU Data Act (Regulation (EU) 2023/2854) gives the users of a connected product the right to access the data it generates and to have it shared with a third party. Users have been able to request it since 12 September 2025; products placed on the EU market after 12 September 2026 must make it accessible by design. We build what that takes, in your own cloud: the data catalogue, user access in the app and by API, third-party sharing and the logs.
We build the technical side. Your counsel validates the legal reading. Last reviewed:
- Request received, from the appdone
- User verifieddone
- Product data and metadata, as JSONin progress
- Delivered by APIqueued
- Logged, retention setqueued
Every step timestamped, in your cloud · request logs kept no longer than needed
The dates that matter.
Article 50 sets them. The two that concern connected products are a year apart, and they are often mixed up.
| Date | What applies | Reference |
|---|---|---|
| Entry into force. | Art. 50 | |
| General application. Users can request their data and have it shared with a third party, for products placed on the market before or after that date. Sellers, rentors, lessors and related-service providers give the pre-contractual information. The unfair-terms rules cover contracts concluded after this date. | Art. 3(2)–(3), 4, 5, 13 | |
| Access by design: connected products and related services placed on the market after this date must make their data accessible to the user by default. | Art. 3(1) | |
| Cloud switching: no more switching charges, egress included. Egress for parallel or multi-cloud use may still be billed at cost. | Art. 29, 34 | |
| The unfair-terms rules extend to older contracts: concluded on or before 12 September 2025, of indefinite duration or expiring at least ten years from 11 January 2024. | Art. 13, 50 |
- The common mix-up
12 September 2026 is not when the right of access starts. Users have been able to request their data since 12 September 2025, for products already on the market too. What starts in 2026 is the design obligation, for products placed on the market after that date. Placing on the market is counted unit by unit, not model by model: a unit of a model launched earlier is covered if it is placed on the market after 12 September 2026.
- Proposed, not in force
The Commission’s Digital Omnibus proposal (COM(2025) 837, 19 November 2025) would amend parts of the Data Act, including refusals on trade-secret grounds. As of October 2026 it is still being negotiated between the Council and the Parliament and is not law. The proposal does not change Article 3(1) or its 12 September 2026 date.
What the Data Act asks of a connected product.
In plain words, for the manufacturer and for whoever holds the data.
- Art. 3(1)
Access by design
Product data, related-service data and the metadata needed to read them are accessible to the user by default: easily, securely, free of charge, in a structured, commonly used, machine-readable format, and directly where relevant and technically feasible. Directly can mean on the device or through a remote server, such as an API.
- Art. 3(2)–(3)
Information before the contract
Before a sale, rental or lease, the user learns what data the product generates, in what format and estimated volume, whether continuously and in real time, where it is stored and for how long, and how to access, retrieve or erase it. For a related service, also who holds the data and what it is used for.
- Art. 4
Access on request
Where the user cannot reach the data directly, the data holder makes the readily available data and its metadata available without undue delay, easily, securely and free of charge and, where relevant and technically feasible, of the same quality as the data holder has, continuously and in real time. No dark patterns; verification asks only for what is needed.
- Art. 5
Sharing with a third party
At the user’s request, the data holder makes the same data available to a third party the user chooses, free of charge for the user. The third party uses it only for the purposes agreed with the user, never to build a competing product; DMA gatekeepers are excluded.
- Art. 8–9
Fair terms, reasonable compensation
Third parties get the data on fair, reasonable and non-discriminatory terms. The data holder may ask them for reasonable compensation, which may include a margin; for SMEs and non-profit research organisations, at cost. The basis of the calculation is shared.
- Art. 4(2), 4(6)–(8)
Trade secrets and security
Trade secrets are identified, metadata included, and protected by agreed measures before disclosure. Without them, sharing can be withheld or suspended; outright refusal is for exceptional cases. Each such decision is written and notified to the competent authority. Access can also be restricted by contract where it would undermine security requirements set by law.
- Which data
- Readily available raw and pre-processed data, personal and non-personal, with its metadata. Not inferred or derived data, nor content such as text, audio or audiovisual works. Anonymising or encrypting data does not by itself take it out of scope.
- Who is exempt
- Products made or designed, and related services provided, by micro and small enterprises, unless they have a larger partner or linked enterprise or are subcontracted to make or design the product. The same applies to a company that has been medium-sized for less than a year, and to a medium-sized company’s products for one year after they are placed on the market (Art. 7).
Who is concerned.
One product can involve four roles, and one company can hold several of them.
| Role | Usually | What it means |
|---|---|---|
| Data holder | The manufacturer, but not always: whoever controls access to the readily available data, a related-service provider included (Art. 2(13)). | Makes the data available to the user and to the third parties the user designates (Art. 4, 5). |
| Seller, rentor, lessor | The retailer, the rental or leasing company, the manufacturer selling direct; second-hand sales too. | Gives the pre-contractual information before the contract (Art. 3(2)). |
| User | The owner, renter or lessee of the product, established in the EU: a household, a company, an operator that owns or leases its fleet (Art. 2(12)). | Requests its data from each data holder, free of charge (Art. 4), or has it sent to a third party (Art. 5). |
| Third party | A company the user chooses: installer, maintenance provider, service operator, retailer. | Receives the data on fair terms, may pay reasonable compensation, and may not use it to build a competing product (Art. 5, 6, 8, 9). |
What we build.
The data access, sharing and logging layer, in your cloud and in your name. No extra platform between you and your users’ data.
- 01
Data catalogue
Every data point your product and app produce: name, unit, format, frequency, estimated volume, where it is stored and for how long, the metadata needed to read it, and a trade-secret flag wherever your counsel sets one. The single source the rest is generated from.
Art. 2, 3 - 02
Pre-contractual information sheet
Generated from the catalogue, per product and per related service, so what you disclose matches what the backend really collects. Regenerated when the product changes, ready for your shop, packaging or contract.
Art. 3(2)–(3) - 03
User access
In the app, as an export in JSON or CSV, and through an API, continuous and real-time where that is relevant. Direct or indirect access is decided product by product at scoping.
Art. 3(1), 4 - 04
Third-party sharing
The user authorises a third party, chooses what and for how long, and revokes it at any time. The third party gets its own scoped credentials; nothing is shared beyond what was authorised.
Art. 5 - 05
Third-party portal
For installers, service providers and partners: registration, your terms, the compensation and the basis of its calculation, API keys and documentation.
Art. 8–9 - 06
Request and decision logs
Each request, verification, delivery, refusal or suspension, timestamped and kept no longer than needed. The written decisions and the notifications to the authority, ready when you need them.
Art. 4(5), 4(7)–(8) - 07
Secure APIs
Authentication, verification proportionate to the request, access scopes, rate limits and monitoring, in line with the security requirements your products already follow.
Art. 3(1), 4(2)
For operators and retailers.
The Data Act also works the other way: it opens a route to the data of the devices you install, run or sell.
Fleet operators
If you own or lease the devices, you are their user: you can ask each brand’s data holder for the readily available data, free of charge (Art. 4). If they belong to your customers, a customer can have the data sent to you as their third party (Art. 5). Some manufacturers already run a Data Act portal for these requests. We turn those accesses into one fleet: one data model, alerts in your tools.
Retailers
When you sell a connected product, you are its seller: the pre-contractual information is your duty too, new or second-hand (Art. 3(2)). And a customer can designate you as the third party who receives their device data (Art. 5), on fair terms, with possible compensation to the data holder. We build the app and the consent flow that make that request simple.
A typical project.
Example-
2 weeks
Scoping
Your products and services, the data each one produces, direct or indirect access, the gap list.
-
4 to 6 weeks later
Access and sharing in production
Catalogue, user access, third-party sharing and logs, on a first product.
-
Then
The slot, or a fixed price
The next products, the third-party portal, new data points with each firmware.
-
At the end
What you own
The code, the catalogue and the logs, in your cloud.
Data Act: frequently asked questions.
01What is the EU Data Act?
Regulation (EU) 2023/2854. It entered into force on 11 January 2024 and has applied since 12 September 2025. It gives users of connected products and related services the right to access the data those products generate and to share it with third parties. It also sets rules on B2B data-sharing terms, unfair contract terms and cloud switching.
02When does the Data Act apply to connected products?
Since 12 September 2025, users can request their data (Article 4) and have it shared with a third party (Article 5), for products placed on the market before or after that date, and sellers, rentors, lessors and related-service providers must give pre-contractual information (Article 3(2)–(3)). Connected products and related services placed on the EU market after 12 September 2026 must be designed so that data is accessible by default (Article 3(1)). Placing on the market is counted per unit, not per model, so units of a model launched earlier are covered too.
03What does “access by design” (Article 3(1)) require?
Products and related services must be designed so that product data, related-service data and the metadata needed to interpret them are accessible to the user by default: easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format. Where relevant and technically feasible, they must be directly accessible. The Commission’s FAQ says direct access may be on the device or through a remote server, such as an API, and that it does not require a redesign for direct access in every case.
04What counts as a connected product or a related service?
A connected product obtains, generates or collects data about its use or environment and can communicate it through a network, a physical connection or on-device access; its primary function is not storing or processing data for others. Examples: home appliances, industrial machines, vehicles, medical devices, smartphones; prototypes are out of scope. A related service is a digital service connected with the product at purchase or added later, without which the product could not perform one of its functions, such as an app that sets a fridge’s temperature. Connectivity, power supply, repair and analytics services are not related services.
05Which data must be shared?
“Readily available” raw and pre-processed product and related-service data, with its metadata, personal and non-personal, that the data holder can obtain without disproportionate effort. Inferred or derived data (from proprietary algorithms) and content (text, audio, audiovisual works) are excluded. Anonymising or encrypting data does not by itself take it out of scope.
06Who is the “data holder”: the manufacturer?
Usually, but not necessarily. The data holder is whoever controls access to the readily available data: the manufacturer, a company it delegates to, or a related-service provider. One product can have several data holders.
07What must be disclosed before the sale?
For the product (Article 3(2)): the type, format and estimated volume of data; whether it is generated continuously and in real time; where it is stored and for how long; how the user can access, retrieve or erase it. For a related service (Article 3(3)), in addition: the data holder’s identity and contact details, its intended uses of the data, how to share data with a third party, the right to complain, who holds the trade secrets, and the contract duration. The product information is due from the seller, rentor or lessor, second-hand products included; the related-service information from the service provider.
08Can a user ask for their data to be sent to another company?
Yes (Article 5). The data holder must make the data available to a third party chosen by the user, free of charge for the user, without undue delay and, where relevant, in real time. The third party may use it only for purposes agreed with the user and not to build a competing product. DMA gatekeepers cannot be recipients. The data holder may ask the third party for reasonable compensation (Article 9).
09Can a manufacturer charge for data access?
Not the user: access under Articles 3, 4 and 5 is free for the user. A third party can be charged reasonable, non-discriminatory compensation, which may include a margin; for SMEs and non-profit research organisations, it is capped at cost. The Commission published draft guidelines on calculating it in February 2026.
10Are SMEs exempt?
The Chapter II access and sharing obligations do not apply to products manufactured or designed, or related services provided, by micro and small enterprises, provided they have no larger partner or linked enterprise and are not subcontracted to make or design the product. The same applies to an enterprise that has qualified as medium-sized for less than a year, and to a medium-sized enterprise’s products for one year after they are placed on the market (Article 7).
11Who enforces the Data Act, and what are the penalties?
Each Member State designates competent authorities. In Germany, the Bundesnetzagentur, under the implementing law in force since 30 May 2026. In France, the Arcep is the designated authority in the implementing bill, still before Parliament in October 2026, with the CNIL for personal data. Penalties are set nationally and must be effective, proportionate and dissuasive. For infringements of Chapters II, III and V, data protection authorities can impose GDPR-level fines within their competence.
12How does the Data Act relate to the GDPR?
The GDPR prevails for personal data. The Data Act adds an access and portability right specific to connected products that also covers non-personal data and, where relevant, works in real time. Sharing other people’s personal data still requires a legal basis under the GDPR.
Sources.
- Regulation (EU) 2023/2854 (Data Act), official textEUR-Lex
- Data Act explainedEuropean Commission
- Frequently asked questions on the Data Act, v1.4 (22 January 2026)European Commission
- Data Act: guidance, model contractual terms and helpdeskEuropean Commission
- Draft guidelines on reasonable compensation (Art. 9)European Commission
- Right of access to connected-product data (in French)Arcep
- The Data Act, a new European framework for data sharing (in French)CNIL
This page explains the regulation to frame a technical project; it is not legal advice. Your counsel validates how it applies to your products. Last reviewed: .