Data Act — Regulation (EU) 2023/2854

Overview

This Regulation lays down harmonised rules on making data generated by the use of connected products and related services available to users. It also establishes rules for data holders making data available to data recipients and public bodies, facilitates switching between data processing services, and introduces safeguards against unlawful data access. (Art. 1)

This Regulation applies to manufacturers and users of connected products and related services in the Union, data holders making data available to recipients in the Union, providers of data processing services to customers in the Union, and public sector bodies requesting data for exceptional needs. It covers both personal and non-personal data. (Art. 1)

Key points

• Connected products must be designed so that data generated by their use is, by default, easily, securely, and freely accessible to the user in a machine-readable format. (Art. 3)
• Upon a user's request, a data holder must make readily available data available to a third party without undue delay, free of charge to the user, and under fair, reasonable, and non-discriminatory terms. (Art. 5 Art. 8)
• A contractual term concerning data access and use that is unilaterally imposed by one enterprise on another is not binding if it is unfair, meaning it grossly deviates from good commercial practice. (Art. 13)
• Data holders must make data available to public sector bodies, the Commission, the European Central Bank, or Union bodies upon a duly reasoned request demonstrating an exceptional need, such as responding to a public emergency. (Art. 14 Art. 15)
• Providers of data processing services must remove commercial, technical, and organisational obstacles to enable customers to switch to another provider or to an on-premises infrastructure. (Art. 23)
• Providers of data processing services must take all adequate measures to prevent international governmental access to or transfer of non-personal data held in the Union where this would conflict with EU or national law. (Art. 32)

Structure

The Regulation begins with general provisions, including scope and definitions. Chapter II establishes the user's right to access and share data from connected products. Chapter III sets out general conditions for data holders obliged to make data available. Chapter IV addresses unfair contractual terms in data sharing agreements. Chapter V creates an obligation for data holders to provide data to public bodies in cases of exceptional need. Chapter VI facilitates switching between data processing services. Chapter VII provides rules on unlawful international data access. Chapter VIII covers interoperability. The final chapters concern implementation, enforcement, and final provisions.

Related instruments

• Regulation (EU) 2016/679 (32016R0679) — This Regulation complements the GDPR, which prevails in case of conflict. The rights of users who are data subjects complement their rights under the GDPR, and GDPR supervisory authorities are responsible for monitoring this Regulation's application concerning personal data.
• Regulation (EU) 2022/868 — This Regulation (the Data Act) builds on the Data Governance Act, particularly concerning the role of the European Data Innovation Board (EDIB) and definitions for data intermediation services.
• Directive 2002/58/EC (32002L0058) — The ePrivacy Directive applies to personal data processed in connection with the rights and obligations under this Regulation, particularly regarding access to data stored on terminal equipment.
• Article 3 of Regulation (EU) 2022/1925 (32022R1925) — Undertakings designated as 'gatekeepers' under the Digital Markets Act are prohibited from being eligible third-party data recipients under certain provisions of this Regulation.