Does the Data Act replace GDPR?

No. The Data Act adds to the GDPR. Where personal data are involved, the GDPR continues to apply in full, with all its safeguards and penalties. The Data Act extends the scope to non-personal data.

Am I affected if I do not manufacture connected devices?

Possibly. Providers of related services, cloud providers, third-party data recipients, and companies entering into data-sharing agreements are also in scope. The provisions governing unfair clauses potentially apply to all companies.

Does the Data Act really eliminate cloud switching fees?

It mandates the gradual elimination of switching fees and interoperability obligations, to prevent customer lock-in. The transition is governed within a defined timeframe.

What is 'access by design'?

This is the principle whereby a connected product must be designed so that users can access, by default and with ease, the data they generate. This often requires APIs or built-in export functionality from the design stage.

What is the difference with the Data Governance Act?

The Data Governance Act establishes the governance framework and trusted intermediaries for data sharing; the Data Act creates concrete access and sharing rights, particularly for data generated by connected devices. They are complementary. Turn data openness into an asset, not a constraint.

Data Act compliance guide: how to achieve compliance?

31 mai 2026 · Updated on 2026-10-19 · By Bertrand Bucelle · 6 min read

In brief

The Data Act changes the rules of the data economy: it gives users of connected devices the right to access the data they generate and to share it with third parties of their choice.

What is the Data Act?

The Data Act (European Data Regulation) aims to unlock the value of data by ensuring fairer access and better interoperability. It starts from a clear observation: a vast proportion of the data generated by connected devices remains captured solely by manufacturers, to the detriment of users and innovation.

It complements the Data Governance Act, but with a different logic: where the DGA creates a governance framework and trusted intermediaries, the Data Act creates concrete access rights that are immediately enforceable.

Three main pillars structure the text: the right of users to access and share data from their connected devices; rules to make switching cloud services simpler and less costly; and the protection of businesses — particularly SMEs — against unbalanced contractual terms.

Who is affected?

The Data Act affects a broad ecosystem around industrial data and connected objects. Many actors are subject to it without having anticipated it.

Manufacturers of connected objects: industry, automotive, home automation, medical devices, agriculture, household appliances.
Related service providers: predictive maintenance, companion applications, product-related data services.
Cloud and edge service providers: portability and interoperability obligations.
Any company that receives, holds or shares data under the regulation, including third-party recipients designated by the user.

The three pillars of the Data Act

Understanding the three pillars allows you to precisely identify your obligations based on your activity.

Pillar	What it requires	Who it targets
Product data access	Granting users access to generated data and the ability to share it	IoT manufacturers, related service providers
Cloud portability	Facilitating provider switching, interoperability, elimination of switching fees	Cloud and edge providers
Fair contracts	Neutralising unfair clauses imposed unilaterally	All businesses, with SME protection

What are the concrete obligations?

In practice, Data Act compliance translates into specific requirements to be integrated into your products and contracts.

Design products so that data is accessible to the user by default ("access by design").
Provide clear information, before purchase, on the nature, volume and frequency of data generated and on the conditions of access.
Make data available to the user or the third party they designate, without unjustified hindrance and in a usable format.
Facilitate migration between cloud providers and progressively eliminate switching fees.
Avoid unfair contractual terms towards SMEs.
Protect trade secrets through proportionate measures when sharing data.

What penalties apply in the event of non-compliance?

Penalties are set by each Member State and must be effective, proportionate and dissuasive. Where personal data are involved, the GDPR ceilings apply in addition.

Area	Penalty	Authority
Data Act infringements	Dissuasive and proportionate national penalties	Authorities designated by each Member State
Personal data	Up to €20 M or 4% of global turnover	Data protection authorities (CNIL in France)
Unfair clauses	Clause deemed unwritten / void	Competent courts

How to achieve compliance: the 7-step roadmap

Step 1 — Map your product data flows

Identify the connected devices you manufacture or operate and the data they generate: sensors, telematics, machine logs, usage data. Distinguish between personal and non-personal data, and identify which data falls under the user's right of access.

This mapping is the foundation: it determines what you must make accessible, to whom, and in what form. Also locate the storage and processing operations involved.

Inventory sensors, telematics and technical logs.
Distinguish between raw data, derived data and personal data.
Locate the storage and processing operations involved.

Step 2 — Make data accessible by design

Adapt your products and interfaces to enable users to easily and continuously access, in a usable format, the data they generate. 'Access by design' often requires technical changes (APIs, exports) that must be planned early.

The objective is to remove unjustified barriers: users must be able to retrieve their data or have it transmitted to a third party without disproportionate obstacles.

Provide standardised APIs or exports for the user.
Document the terms of access and third-party transmission.
Avoid any unjustified technical lock-in.

Step 3 — Update pre-contractual information

Before purchase or subscription, users must know what data the product will generate, in what volume, at what frequency, and how to access or share it. Incorporate this information into your commercial and contractual documentation.

This upstream transparency is a structurally significant new requirement: it must be clear, complete and understandable.

Describe the data generated and its frequency.
Explain the terms of access and sharing.
Incorporate this information into product sheets and contracts.

Step 4 — Revise your contracts

Review your general terms and conditions and data-sharing agreements to remove potentially unfair clauses (unilateral limitations, imposed imbalances) and to incorporate compliant access and sharing terms.

This revision also protects your SME partners and secures your relationships over the long term.

Identify and remove unbalanced clauses.
Add compliant access and sharing clauses.
Establish safeguards for the protection of trade secrets during sharing.

Step 5 — Adapt your cloud offerings

If you are a cloud or edge provider, prepare for portability and interoperability: documented migration procedures, usable formats, and the gradual elimination of switching fees.

The challenge is to stop locking in your customers: fluidity is becoming a legal requirement as much as a commercial argument.

Document clear migration procedures.
Progressively eliminate exit fees.
Work on interoperability and data formats.

Step 6 — Protect trade secrets

Data sharing must not mean disclosure of your industrial secrets. Put in place proportionate technical and contractual measures to share useful data while protecting what falls under trade secret protection.

The regulation provides safeguards: identify precisely what is protected and govern its sharing accordingly.

Identify data covered by trade secret protection.
Govern their sharing through appropriate measures and clauses.
Document the justification for any restrictions.

Step 7 — Coordinate with GDPR and the DGA

Where data is personal, apply GDPR safeguards: legal basis, information, security, data subject rights. The Data Act does not replace GDPR — it adds to it.

Also coordinate your approach with the Data Governance Act if you act as a data intermediary or operate within a data space.

Process personal data through the lens of GDPR.
Link your Data Act flows to your records of processing activities.
Verify your potential role under the DGA.

Common mistakes to avoid

Assuming the Data Act only concerns personal data: it also covers, and above all, industrial data.
Neglecting pre-contractual information on data generated by the product.
Retaining cloud switching fees or architectures that lock in the customer.
Overlooking the interplay with GDPR when personal data is in circulation.
Underestimating the technical changes required for "access by design".
Maintaining unbalanced clauses vis-à-vis SME partners.
Confusing the Data Act (access rights) with the Data Governance Act (governance and intermediaries).

How Data Comply One supports you

Data Comply One helps you map your data flows and document your Data Act obligations within the same platform as your GDPR, AI Act, NIS2, and DORA compliance — without multiplying tools or creating silos.

Our experts secure the delicate articulation between personal and non-personal data, review your data-sharing and cloud exit clauses, and structure your data governance end to end. Two modes are available to you: manage your compliance yourself using the software, or outsource it to our experts who manage it for you directly on the platform.

This dedicated module is coming soon to the platform: request a demo to get early access.

Where do you stand? ·

Take action

Take action with Data Comply One: all-in-one compliance software and outsourced DPO/CISO experts.

Discover the Data Act software →The Data Act regulation →