The EU Data Act has entered into force

The EU Data Act, otherwise known as the Regulation on harmonised rules on fair access to and use of data entered into force on January 11th. Most of the Regulation will be applicable in all Member States as of September 12, 2025. So, there is about 18 months to get ready and comply. 

The Regulation is the last building block of the European strategy for data and aims to make Europe a leader in data economy by harnessing the potential of the ever-increasing amount of personal as well as industrial data, in order to benefit the European economy and create a Single market for data.

By 2028, the new rules are expected to create €270 billion of additional GDP by addressing the legal, economic and technical issues that lead to data being underused. For example, by reinforcing the portability right, i.e. granting customers the freedom to switch between various cloud data-processing service providers. Thereby the Act is expanding some of the GDPR provisions. 

More specifically, the Act gives device users the right to access their data, therefore it empowers consumers and companies by giving them greater control of the data their devices produce, thus hopefully boosting aftermarket services, such as predictive maintenance. The more information consumers have, the better decisions they can make.

Additionally, it promotes the development of interoperability standards for data-sharing and data processing, in line with the EU Standardisation Strategy, which shall enable customers to effectively switch between different providers of data-processing services to unlock the EU cloud market. Furthermore, it aims to empower EU SMEs to participate more confidently in the digital marketplace through fostering fair negotiations.  Last, but not least, it gives the public sector greater access to private data in order to respond to emergencies.

As it is often the case when implementing new regulatory mechanisms, there are still some grey areas, such as the essential requirements for interoperability and smart contracts where harmonised standards do not exist or are insufficient,  which shall be provided by the European Commission in the form of Implementing and Delegated Acts in due course. Nevertheless, the EU Data Act is a Regulation which means it will be applicable in all Member States at the same time, and country-specific amendments are not allowed. 

Thus, almost all of us will be affected by the EU Data Act. Regulation applies to personal as well as non-personal data, including those belonging to the private sector. It regulates manufacturers of connected products placed on the market in the Union and providers of related services, as well as users of these “connected products” i.e. a mobile phone. Furthermore, it applies to data holders and data recipients in the Union as well as public sector bodies. The place of establishment in this case is irrelevant.