Short Briefing: Data Act

The Data Act (Regulation (EU) 2023/2854) forms a central pillar of the European data strategy. Its objective is to ensure fair, transparent and competitive access to and use of data generated by connected products and related digital services.

As of 12 September 2025, sseveral new obligations under the Data Act will apply to manufacturers, sellers, lessors and providers of digital services that place products with data-generation or data-transmission functions on the EU market. Where the legal requirements are met, companies must ensure that users (whether individuals or businesses) are informed about the data generated, can obtain it, and can request that it be shared with third parties.

This short briefing in FAQ format summarises several key aspects of the Data Act in a concise way to provide an accessible introduction. The focus of this briefing is on connected products. Upon request, a similar short briefing can be prepared for providers of data spaces or cloud services, who are also subject to new obligations under the Data Act.

1. What are connected products and related services?

To understand which products and services fall under the definitions of “connected product” and “related service”, the legal definitions in Article 2(5) and (6) of the Data Act should be consulted:

A “connected product” means

“an item that obtains, generates or collects data concerning its use or environment and that is able to communicate product data via an electronic communications service, a physical connection or on-device access, and whose principal function is not the storage, processing or transmission of data on behalf of a party other than the user.”

A “related service” means a digital

“service, other than an electronic communications service - including software - that, at the time of purchase, rental or lease, is connected with the product in such a way that the connected product cannot perform one or more of its functions without it, or that is subsequently connected with the product by the manufacturer or by a third party to supplement, update or adapt the functions of the connected product.”

2. What is the core idea behind the Data Act?

The Data Act aims to ensure that data from connected products (such as machines, vehicles, devices or sensors) no longer remain exclusively with the manufacturer or de facto data holder, but can, under certain conditions, also be used by users and their business partners. The goal is to promote greater fairness and transparency in the handling of usage data.

Companies offering products or digital services will be required to:

• inform users about the data being generated,
• under some circumstances grant them access to this data upon request,
• and enable sharing with third parties if the user so requests.

Main innovations include:

• User rights to data transparency and access for connected products,
• obligations for manufacturers and service providers to ensure access both technically and contractually,
• and rules for fair data-sharing to reduce market imbalances.

In addition, the Data Act introduces new rules for cloud and data-processing services: providers must facilitate switching between cloud platforms and ensure data portability to reduce lock-in effects and foster competition.

3. Does the Data Act also apply to sellers, lessors or distributors?

The Data Act applies not only to manufacturers but also to those who sell, lease or rent connected products. For the purpose of information obligations, what matters is not necessarily who technically owns or holds the data, but who sells, leases or rents the products to users or provides the related service.

When a company provides a connected product to customers (for example a vehicle, machine or smart device) it must ensure that customers are clearly informed before concluding the contract. This information must in particular specify what data are generated during use, who can access them, and for what purposes they may be used.

Sellers, lessors and rental providers are therefore also part of the legal information chain. They are responsible for ensuring that their contracts and processes meet the new transparency requirements, even if they never see the data themselves.

4. Which data fall under the scope of the Data Act?

The Data Act governs access to data generated by connected products and digital services, that is, by machines, vehicles, devices or sensors that produce or exchange information during operation. Its aim is to make such usage data more accessible to users and businesses while safeguarding innovation and trade secrets.

Product data

This includes all data generated directly by the product or its sensors during use such as temperature, speed, position, energy consumption or error messages. These data reveal how a product is actually used.

Data from related services

Digital services that interact with a product (e.g. apps, cloud platforms or remote-maintenance systems) generate additional information about the product's use and condition. These data may also fall within the scope of the Data Act.

Exclusions. Which data are not covered?

Data that result only from substantial processing steps, proprietary algorithms or significant investment (such as forecasts, automated decisions or AI-generated analyses) are not covered. The Act also provides exceptions for data that can only be made accessible with disproportionate effort.

The delineation between usage data to be made available and protected trade secrets is complex in individual cases. The invocation of trade secrets must be duly substantiated by the data holder; blanket refusals are inadmissible. A prior legal classification of data categories is therefore indicated to avoid competitive disadvantages or regulatory sanctions.

5. What about product series?

A connected product falls within the scope of the Data Act once it is placed on the EU market, meaning when it is sold, leased, or rented for the first time after manufacture.

The EU Blue Guide helps interpret this concept: it clarifies that “placing on the market” refers to each individual product, not to a product type or series.

6. Who qualifies as a “user”?

Unlike the GDPR, the term “user” in the Data Act applies to both individuals and businesses. According to Article 2(12) of the Data Act, a user is

“a natural or legal person that owns, rents or leases a connected product or to whom temporary rights to use the connected product have been granted, or that receives a related service.”

7. Who is the “data holder”?

Under Article 2(13) of the Data Act, a data holder is

“a natural or legal person that, in accordance with this Regulation, Union law or national law, is entitled or obliged to use and make available data (including product or related-service data as contractually agreed) that it has retrieved or generated in the course of providing a related service.”

In many cases this will be the manufacturer of a connected product or provider of a related service, as they technically determine which data are generated and stored and retain control over them. What matters is the actual control over the data.

8. Does the Data Act also apply to manufacturers or service providers outside the EU?

Yes. The Data Act also applies to companies established outside the EU if they offer or make available their connected products or related services on the EU market. The determining factor is not the company's place of establishment but the offering on the EU market.

Note:

Practical conclusion: The Data Act has a profound impact on product development and contract drafting. To avoid legal disadvantages or risks, a review of existing contract templates and an analysis of data flows is recommended.

This short briefing is for general informational purposes only and does not constitute a comprehensive statement of all provisions of the Data Act. It does not replace individual legal advice and cannot substitute an assessment of a specific case.

While every effort has been made to ensure accuracy, completeness and timeliness, no liability is accepted for any errors or omissions. For specific legal assessments or implementation guidance, professional legal advice should be sought.