The EU Data Act: Major Changes Ahead for Data-Driven Organizations
Data & Business Legal combines legal precision with practical insight: the EU Data Act will enter into full effect on 12 September 2025, bringing significant implications for anyone working with data.
The regulation grants users of connected products (such as IoT devices) greater control over their data. They have the right to access or transfer this data, including data held by third parties, free of charge, in a structured and machine-readable format, and under clear and reasonable conditions.
At the same time, the Act combats unfair contract terms, particularly those imposed by stronger parties. It introduces lists of prohibited and presumptively unfair clauses, aimed at restoring contractual balance in data-sharing arrangements.
Key Obligations for Data Service Providers
Providers of data processing services will soon face stricter requirements to facilitate switching between services. This includes:
-
Enabling user-friendly data portability
-
Providing transparent information about switching conditions
-
Offering free and practical support during transitions
Global Reach and Heavy Penalties
The Data Act has extraterritorial scope: non-EU companies offering products or services to EU users also fall under its provisions. In case of violations, particularly those involving personal data, fines may reach GDPR-level penalties: up to €20 million or 4% of global annual turnover.
Time to Act
In practical terms, organizations should already be reviewing their technical infrastructure, as well as their legal documents and internal procedures. This includes data governance frameworks, exit strategies, contract transparency, and risk assessments.
With the EU Data Act entering full force on 12 September 2025, now is the time to prepare.
Data & Business Legal can support you throughout this process, from risk analysis to full compliance implementation.
