--- title: "EU Data Act User Access and Portability Rights" canonical_url: "https://www.sorena.io/artifacts/eu/data-act/access-rights-and-portability" source_url: "https://www.sorena.io/artifacts/eu/data-act/access-rights-and-portability" author: "Sorena AI" description: "Practical guide to EU Data Act user access, connected-product data portability, third-party sharing, trade secret safeguards, and the GDPR boundary." published_at: "2026-05-06" updated_at: "2026-05-06" keywords: - "EU Data Act user access" - "Data Act portability" - "connected product data" - "related service data" - "third-party sharing" - "EU Data Act" - "Regulation (EU) 2023/2854" - "user access" - "portability" - "connected products" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU Data Act User Access and Portability Rights Practical guide to EU Data Act user access, connected-product data portability, third-party sharing, trade secret safeguards, and the GDPR boundary. *Artifact Guide* *EU* *Data Act* ## EU Data Act User Access Rights and Portability This guide helps scope and operate Data Act access rights for connected-product and related-service data, including direct access, request-based access, and transfers to user-chosen third parties. Based on the EU Data Act, Commission FAQs, and Commission implementation materials. This is a practical compliance research aid, supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation. The Data Act access and portability rights are not a generic privacy export. They cover readily available product data and related service data from connected products and related services, plus the metadata needed to interpret and use that data. Users may access the data themselves or ask the data holder to make it available to a third party, subject to limits for security, trade secrets, personal data, and recipient misuse. ## Which connected product and related service data must be made available to users under the EU Data Act? Start with the Chapter II data categories. Product data is data generated by the use of a connected product that was designed to be retrievable through an electronic communications service, physical connection, or on-device access. Related service data is data representing user actions or events connected with the product during the related service. The practical access package is narrower than all data a company holds. It focuses on readily available data: product data and related service data that the data holder lawfully obtains or can lawfully obtain without disproportionate effort beyond a simple operation. The package should include relevant metadata needed to interpret and use the data. - Include raw and pre-processed data that is stored, retrievable, or transmitted externally by the product or related service. - Include basic context such as timestamp, units, identifiers, format, quality limits, and other metadata needed to make the data usable. - Do not treat inferred or derived analytics from proprietary, complex algorithms as automatically in scope unless a separate agreement or law requires it. - Do not treat unrelated textual, audio, or audiovisual content as connected-product data merely because the device records, displays, or plays it. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports the definitions of connected product, related service, product data, related service data, readily available data, and metadata. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Explains that Chapter II generally covers raw and pre-processed connected-product and related-service data, with metadata, while excluding highly enriched inferred or derived data. ## Data Act: How should direct access and request-based access work? Article 3 requires connected products and related services to be designed so that product data and related service data are, by default, easily and securely accessible to the user, free of charge, in a structured, commonly used, machine-readable format, and directly accessible where relevant and technically feasible. When the user cannot directly access the data from the product or related service, Article 4 requires the data holder to provide readily available data and necessary metadata without undue delay, at the same quality available to the data holder, free of charge, and through a simple electronic request where technically feasible. - Use direct access for interfaces where the user can stream, download, or retrieve the data without a data-holder approval step. - Use indirect access for portals or request workflows where the data holder must process the request before making data available. - Avoid interface designs that make Data Act choices unduly difficult or manipulate the user's choices. - Ask only for information necessary to verify that the requester qualifies as the user, and keep access logs only as necessary for request execution, infrastructure security, and maintenance. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Articles 3 and 4 set the design-by-default, direct-access, electronic-request, format, security, and free-of-charge requirements for user access. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Distinguishes direct access from indirect access and gives examples of each access model. ## Data Act What must be disclosed before purchase, lease, rental, or a related-service contract? The Data Act access workflow starts before the user asks for data. For connected products, the seller, rentor, or lessor must tell the user the type, format, and estimated volume of product data the product can generate, whether it can generate data continuously and in real time, whether data is stored on-device or on a remote server, the intended retention duration where applicable, and how the user may access, retrieve, or erase the data where relevant. For related services, the provider must give comparable information about product data it expects to obtain and related-service data it expects to generate. The service disclosure also needs the identity and contact route for the prospective data holder, whether the data holder expects to use readily available data itself, whether third-party use is intended for purposes agreed with the user, and how the user can request or end third-party sharing. - Keep product and related-service disclosures aligned with the actual data inventory, retention configuration, and access channel. - Name the data holder and any other data-processing parties clearly enough for a user to contact the right actor. - Describe API terms, quality of service, formats, and retention in operational language that support and product teams can implement. - Update user-facing information when product updates or service changes add accessible data or restrict initially accessible data. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Article 3 lists the pre-contractual information that must be given for connected products and related services. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Confirms that users must be informed how to access generated data as part of the transparency obligation. ## Data Act: How does a user direct the data holder to share connected product data with a third party? Article 5 gives the user the right to ask the data holder to make readily available data and necessary metadata available to a third party. The transfer must be without undue delay, of the same quality available to the data holder, easy, secure, free of charge to the user, and in a comprehensive, structured, commonly used, machine-readable format. Where relevant and technically feasible, it should support continuous and real-time availability. Third-party sharing is not limited to situations where the user lacks direct access. Commission FAQs state that a user can still request transfer to a third party even when the user already has direct access, provided there is a data holder with readily available data. - Capture the user request, the authorized third party, the requested dataset, and the purpose agreed between the user and the third party. - Separate the user-facing request from the data holder's arrangements with the data recipient under Articles 8 and 9. - Do not treat Digital Markets Act gatekeepers as eligible third parties for the mandatory Article 5 mechanism. - Do not assume the Data Act obliges sharing with an operator outside the Union; the Commission FAQs say Chapter II mandatory sharing is limited to EU entities and persons. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Article 5 sets the user's third-party sharing right, format and quality requirements, and gatekeeper exclusion. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Confirms that Article 5 can apply even where the user already has direct access, and explains the EU-presence limit for Chapter II mandatory sharing. ## Data Act What limits apply to users and third-party recipients? The access right is not a right to misuse data. A user may not use Article 4 data to develop a connected product that competes with the product from which the data originates, share the data with a third party for that purpose, or use the data to derive insights about the manufacturer's or data holder's economic situation, assets, or production methods. A third party that receives data under Article 5 may process it only for the purposes and conditions agreed with the user and subject to data protection law where personal data is involved. Article 6 also prohibits specific conduct, including manipulative user interfaces, unnecessary profiling, onward sharing without the required contract and safeguards, sharing with DMA gatekeepers, competing-product development, security-harming use, and undermining agreed trade-secret measures. - Put the agreed purpose in the user authorization and recipient terms before transfer. - Require deletion when data is no longer necessary for the agreed purpose, unless the user has agreed otherwise for non-personal data. - Block recipient use cases that would create a competing connected product from the accessed data. - Preserve consumer users' ability to make received data available to other parties where Article 6 protects that ability. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Articles 4 and 6 set limits on user and third-party use, including competing-product, profiling, gatekeeper, security, and purpose restrictions. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Explains the general Article 6 rule that third parties use data for purposes agreed with the user and identifies the closed list of prohibited actions. ## Data Act How should trade secrets be protected without turning them into a blanket refusal? The Data Act preserves trade-secret protection but makes it procedural. For user access under Article 4, and third-party transmission under Article 5, the data holder or trade-secret holder must identify protected data, including protected metadata, and agree proportionate technical and organizational measures before disclosure. Withholding, suspension, or refusal should be exceptional and documented. If agreed measures are missing, not implemented, or confidentiality is undermined, the data holder may withhold or suspend the sharing of identified trade-secret data and must provide a substantiated written decision without undue delay. A case-by-case refusal is available only in exceptional circumstances where serious economic damage is highly likely despite the measures taken, and the competent authority must be notified. - Identify trade-secret fields and metadata at field level instead of labelling an entire export as secret. - Use proportionate measures such as confidentiality terms, strict access controls, technical standards, codes of conduct, or model contractual terms. - Keep the objective basis for any serious-economic-damage assessment, especially confidentiality level, uniqueness, novelty, and enforceability concerns. - Give the user or third party a written, substantiated reason for withholding, suspension, or refusal, and preserve the complaint or dispute-settlement route. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Articles 4(6)-(9) and 5(9)-(12) define trade-secret identification, safeguard agreement, withholding, suspension, refusal, notification, and challenge mechanics. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Confirms that the Data Act does not supersede the Trade Secrets Directive and describes the Data Act's trade-secret protection mechanism. ## Data Act access rights: where is the GDPR boundary when the shared data is personal data? The Data Act complements data protection law; it does not supersede it or create a new GDPR legal basis. The Commission FAQs state that the GDPR applies to all personal data processing under the Data Act and prevails in the event of conflict. When the user is not the data subject whose personal data is requested, the data holder may make personal data available to the user or third party only where there is a valid legal basis under Article 6 GDPR and, where relevant, the conditions for special-category data and terminal-equipment access are fulfilled. Users that are not data subjects, such as enterprises requesting personal data from IoT devices, may themselves be controllers and must meet GDPR obligations. - Classify each field as personal data, non-personal data, mixed data, trade secret, or other protected material before release. - When several people use the same product, avoid exposing another data subject's personal data unless the GDPR basis and safeguards are satisfied. - Use anonymization or narrower disclosure where that is the lawful way to respect other data subjects' rights, but do not use privacy-preserving processing as a pretext to avoid Data Act sharing. - Preserve the data protection authority route for issues concerning personal data processing under the Data Act. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Article 1(5), Article 4(12), Article 5(7), and recital material preserve GDPR application and require a valid legal basis where the user is not the data subject. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Explains that GDPR rules prevail for personal data, and that Articles 4 and 5 complement GDPR access and portability rights in the IoT context. ## Data Act What implementation records make the access workflow defensible? A useful Data Act access record connects the legal trigger to the dataset, actor, channel, safeguards, and outcome. It should be specific enough to show why a user received data, why a third party was authorized, why a field was excluded, or why sharing was suspended or refused. The record should also support future portability. If telemetry, account structure, retention, APIs, or related-service contracts change, the access package and user-facing disclosures should be reviewed against the same source rules. - Data inventory: product or related-service event, field name, raw or pre-processed status, metadata, format, source system, retention, and whether it is readily available. - Actor record: user identity or authority, product or service relationship, third-party recipient, EU-presence check where relevant, and agreed purpose. - Safeguards record: personal-data basis, trade-secret fields, security restrictions, technical protection measures, and recipient-use restrictions. - Outcome record: direct access route, indirect request decision, delivery receipt, format, timestamp, refusal or partial-delivery reason, authority notification where required, and dispute or complaint status. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports the operational record fields through Articles 3 to 6, Article 10 dispute settlement, and Article 11 technical protection measures. - [European Commission - EU Data Act gives users control over data from connected devices](https://digital-strategy.ec.europa.eu/en/news/eu-data-act-gives-users-control-over-data-connected-devices?ref=sorena.io) - Supports the practical framing that users of connected devices can access, use, and share raw device data for repair, maintenance, industrial, and other services. - [Commission guidance on vehicle data - Official Journal](https://eur-lex.europa.eu/eli/C/2025/5026/oj/eng?ref=sorena.io) - Provides sector-specific Commission guidance illustrating how Data Act access rules apply to vehicle data and aftermarket use cases. *Recommended next step* *Placement: after implementation section* ## Turn Data Act access rights into an auditable workflow Use the access scope, recipient terms, GDPR checks, trade-secret safeguards, and delivery records from this guide to structure product, support, legal, and engineering work. - [Open Research Copilot](/solutions/research-copilot.md): Ask cited Data Act questions across scope, access, portability, and evidence topics. - [Talk through implementation](/contact.md): Review your connected-product data inventory, third-party transfer path, and safeguard model. ## Primary sources - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Binding source for Data Act user access, third-party sharing, data-holder duties, recipient restrictions, trade-secret safeguards, personal-data boundary, and technical protection measures. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission implementation FAQs used for scope interpretation, direct versus indirect access, GDPR interaction, third-party transfers, gatekeeper exclusion, EU-presence limits, and trade-secret handling. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission explainer used for the public-facing summary of Data Act objectives and Chapter II user-control framing. - [European Commission - EU Data Act gives users control over data from connected devices](https://digital-strategy.ec.europa.eu/en/news/eu-data-act-gives-users-control-over-data-connected-devices?ref=sorena.io) - Commission press material used for examples of connected devices and practical benefits such as repair, maintenance, and industrial equipment use cases. - [Commission guidance on vehicle data - Official Journal](https://eur-lex.europa.eu/eli/C/2025/5026/oj/eng?ref=sorena.io) - Official Journal guidance used as a sector-specific example of how Data Act access and sharing rules apply to connected-vehicle data. ## Related Topic Guides - [Data Act and Common European Data Spaces](/artifacts/eu/data-act/data-act-and-common-european-data-spaces.md): How Data Act Article 33 connects data-space participation with metadata, vocabularies, APIs, access terms, data quality, governance, and standards monitoring. - [Data Act and Data Governance Act Overlap FAQ](/artifacts/eu/data-act/faq/data-governance-act-overlap.md): FAQ explaining where the EU Data Act and Data Governance Act overlap, how they differ, and how to route product, cloud, public-sector reuse, intermediary, and data altruism workflows. - [Data Act and GDPR Personal Data Overlap FAQ](/artifacts/eu/data-act/faq/gdpr-personal-data-overlap.md): FAQ on how the EU Data Act works when connected-product or related-service data includes personal data, mixed datasets, GDPR roles, lawful basis, trade secrets, and third-party sharing. - [Data Act Audit Evidence and Request Logs FAQ](/artifacts/eu/data-act/faq/audit-evidence-and-request-logs.md): FAQ for Data Act request logs covering user and third-party access, B2G exceptional need requests, cloud switching records, contract terms, trade secrets, and GDPR boundaries. - [Data Act B2B Data-Sharing Contract Clauses](/artifacts/eu/data-act/b2b-data-sharing-contract-clauses.md): Clause guide for EU Data Act B2B data sharing: FRAND terms, compensation, trade secret safeguards, recipient limits, termination, logs, and GDPR boundaries. - [Data Act B2B Data-Sharing Contract Template](/artifacts/eu/data-act/b2b-data-sharing-contract-template.md): A usable EU Data Act B2B data-sharing template outline covering access requests, data schedules, permitted use, trade secrets, security, compensation, GDPR boundaries, audit records, and termination. - [Data Act B2G Exceptional-Need Requests](/artifacts/eu/data-act/b2g-exceptional-need-requests.md): An official source guide to EU Data Act Chapter V requests from public bodies: exceptional need, public emergencies, request contents, limits, safeguards, costs, and records. - [Data Act Cloud Switching Compliance Checklist](/artifacts/eu/data-act/cloud-switching-compliance-checklist.md): A cited EU Data Act checklist for cloud and data processing service providers covering switching clauses, notices, export formats, charges, interoperability, and evidence. - [Data Act Cloud Switching Contract Terms FAQ](/artifacts/eu/data-act/faq/cloud-switching-contract-terms.md): FAQ on EU Data Act cloud switching contract terms: Article 25 clauses, assistance, notice, transition, charges, export, termination, interoperability, and records. - [Data Act Cloud Switching Fees and Deadlines FAQ](/artifacts/eu/data-act/faq/cloud-switching-fees-and-deadlines.md): FAQ on EU Data Act cloud switching charges, 2027 fee removal, notice periods, transition windows, data retrieval, contract terms, and evidence records. - [Data Act Complaints and Dispute Settlement FAQ](/artifacts/eu/data-act/faq/complaints-and-dispute-settlement.md): FAQ on EU Data Act complaints, competent authorities, dispute settlement bodies, B2B data-sharing disputes, B2G requests, cloud switching disputes, and evidence records. - [Data Act Exportable Data and Metadata FAQ](/artifacts/eu/data-act/faq/exportable-data-and-metadata.md): FAQ explaining which product, related service, metadata, and cloud switching data must be exportable under the EU Data Act, and which data can be excluded. - [Data Act FAQ for Aftermarket Repair and Mobility Services](/artifacts/eu/data-act/faq/aftermarket-repair-and-mobility-services.md): FAQ on EU Data Act vehicle-data access for repairers, independent service providers, fleets, insurers, and mobility services. - [Data Act Functional Equivalence FAQ](/artifacts/eu/data-act/faq/functional-equivalence.md): FAQ on Data Act functional equivalence for cloud switching: IaaS scope, customer outcomes, export support, interoperability duties, limits, and evidence. - [Data Act Indirect Access Request Flows FAQ](/artifacts/eu/data-act/faq/indirect-access-request-flows.md): FAQ for Data Act teams handling user and third-party data requests when direct connected-product access is unavailable, incomplete, or limited. - [Data Act International Government Access FAQ](/artifacts/eu/data-act/faq/international-government-access.md): FAQ on EU Data Act safeguards for non-EU government access to non-personal data held in the Union by data processing service providers. - [Data Act Interoperability Standards FAQ](/artifacts/eu/data-act/faq/interoperability-standards.md): FAQ on EU Data Act interoperability standards for data spaces, cloud switching, smart contracts, harmonised standards, common specifications, and M/614. - [Data Act Model Contractual Terms FAQ](/artifacts/eu/data-act/faq/model-contractual-terms.md): FAQ on the EU Data Act non-binding model contractual terms for data access and use, cloud switching clauses, B2B use, unfair terms, and evidence. - [Data Act Public Emergency Requests FAQ](/artifacts/eu/data-act/faq/public-emergency-requests.md): FAQ on EU Data Act public emergency requests: exceptional need, request content, timing, data holder response, compensation, confidentiality, and records. - [Data Act Smart Contracts for Data Sharing](/artifacts/eu/data-act/smart-contracts-for-data-sharing.md): Data Act Article 36 smart contract guide for data-sharing agreements: scope, robustness, access control, termination, interruption, archiving, standards status, and conformity evidence. - [Data Act SME Exceptions and Startups FAQ](/artifacts/eu/data-act/faq/sme-exceptions-and-startups.md): FAQ on where the EU Data Act gives micro, small, medium-sized, startup, and SME actors narrower treatment for access duties, compensation, and B2B terms. - [Data Act Trade Secret Technical Protection Measures FAQ](/artifacts/eu/data-act/faq/trade-secret-technical-protection-measures.md): FAQ on how EU Data Act data holders can protect trade secrets with confidentiality safeguards, technical measures, limited withholding, suspension, refusal, and evidence. - [Data Act Trade Secrets and Protection Measures](/artifacts/eu/data-act/trade-secrets-and-protection.md): Data Act guide for protecting trade secrets during access and sharing: classification, safeguards, refusal thresholds, notices, evidence records, and reviews. - [Data Act Unfair Contractual Terms | Article 13 B2B Contract Review](/artifacts/eu/data-act/unfair-contractual-terms.md): Review B2B data-sharing clauses under EU Data Act Article 13: unilateral terms, always unfair examples, presumed unfair terms, model clauses, evidence, and remediation. - [Data Act Vehicle Data Guidance](/artifacts/eu/data-act/vehicle-data-guidance.md): Commission-cited guide to Data Act vehicle data access: connected vehicles, vehicle-related services, raw and pre-processed data, aftermarket use cases, access routes, safeguards, and GDPR boundaries. - [Data Act vs GDPR: connected-product data access](/artifacts/eu/data-act/data-act-vs-gdpr.md): Compare EU Data Act connected-product access duties with GDPR personal-data rules: scope, roles, lawful basis, data subject rights, third-party sharing, trade secrets, and conflicts. - [EU Data Act and Common European Data Spaces FAQ](/artifacts/eu/data-act/faq/data-act-and-common-european-data-spaces.md): FAQ on how EU Data Act interoperability duties, Data Governance Act rules, and sector data-space governance fit together without treating participation as a general obligation. - [EU Data Act Applicability Test](/artifacts/eu/data-act/applicability-test.md): Check whether a product, related service, data holder, cloud service, data-space role, smart contract, or B2G request is in scope of the EU Data Act. - [EU Data Act Application Dates and Transition FAQ](/artifacts/eu/data-act/faq/application-dates-and-transition.md): FAQ on when the EU Data Act applies, which obligations are delayed, and what product, contract, cloud, and evidence records teams should maintain. - [EU Data Act Article 3 Pre-Contract Information](/artifacts/eu/data-act/pre-contractual-information-obligations.md): What Article 3 of the EU Data Act requires before connected-product purchase, rent, lease, or related-service contracting: data categories, access, data holder identity, third-party sharing, complaints, and evidence. - [EU Data Act Article 36 Smart Contract Controls FAQ](/artifacts/eu/data-act/faq/article-36-smart-contract-controls.md): FAQ explaining when EU Data Act Article 36 applies to smart contracts for data-sharing agreements and what controls, conformity evidence, and limits it requires. - [EU Data Act B2B Data Sharing Compensation FAQ](/artifacts/eu/data-act/faq/compensation-for-b2b-data-sharing.md): FAQ on when Data Act data holders may charge B2B data recipients, what reasonable compensation can include, SME limits, unfair terms, disputes, and trade secret safeguards. - [EU Data Act B2G Compensation and Costs FAQ](/artifacts/eu/data-act/faq/b2g-compensation-and-costs.md): FAQ on when Data Act B2G exceptional-need requests are free, when fair compensation may be claimed, which costs can be included, and what records to keep. - [EU Data Act B2G Exceptional Need FAQ](/artifacts/eu/data-act/faq/b2g-exceptional-need.md): When public-sector bodies can request business-held data under the EU Data Act, what a valid request must contain, and how data holders handle limits, trade secrets, compensation, and evidence. - [EU Data Act Checklist for Product, Cloud, and Contract Teams](/artifacts/eu/data-act/checklist.md): A cited EU Data Act checklist for connected-product data access, third-party sharing, B2G requests, cloud switching, unfair terms, smart contracts, personal data boundaries, evidence, and owners. - [EU Data Act Cloud Switching and Exit Plans](/artifacts/eu/data-act/cloud-switching-and-exit-plans.md): A cited EU Data Act guide for data processing service exit plans: switching contracts, exportable data, assistance, charges, interoperability, retrieval, erasure, and records. - [EU Data Act Cloud Switching Procurement FAQ](/artifacts/eu/data-act/faq/cloud-switching-procurement-checklist.md): Procurement checklist FAQ for EU Data Act cloud switching: contract terms, exit support, exportable data, switching charges, interoperability, termination, and supplier evidence. - [EU Data Act Compliance Program](/artifacts/eu/data-act/compliance.md): Build a Data Act compliance program for connected-product data access, contracts, B2G requests, cloud switching, smart contracts, GDPR boundaries, records, and ownership. - [EU Data Act Connected Product Scope and Data Types](/artifacts/eu/data-act/scope-connected-products-and-data-types.md): Classify EU Data Act connected products, related services, product data, related-service data, readily available data, metadata, and excluded derived outputs. - [EU Data Act Connected Product Scope FAQ](/artifacts/eu/data-act/faq/scope-connected-products.md): FAQ explaining when connected products, related services, generated data, EU market placement, and SME exceptions fall within EU Data Act scope. - [EU Data Act Data Processing Service Switching](/artifacts/eu/data-act/data-processing-services-switching.md): A cited EU Data Act guide for provider and customer switching duties: exit assistance, exportable data, contract clauses, charges, interoperability, retrieval, and erasure. - [EU Data Act data spaces interoperability FAQ](/artifacts/eu/data-act/faq/data-spaces-interoperability.md): FAQ explaining Article 33 Data Act interoperability requirements for data-space participants, common European data spaces, standards, APIs, metadata, and architecture evidence. - [EU Data Act deadlines and compliance calendar](/artifacts/eu/data-act/deadlines-and-compliance-calendar.md): A cited calendar for EU Data Act application dates, product design timing, contract remediation, cloud switching charges, response periods, standards work, and evidence records. - [EU Data Act Direct Access by Design FAQ](/artifacts/eu/data-act/faq/direct-access-by-design.md): FAQ for product and legal teams designing user access to connected-product and related-service data under the EU Data Act. - [EU Data Act Enforcement and Competent Authorities FAQ](/artifacts/eu/data-act/faq/enforcement-and-competent-authorities.md): FAQ on who enforces the EU Data Act, how complaints work, how Member States set penalties, when dispute settlement can be used, and when GDPR authorities remain responsible. - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates](/artifacts/eu/data-act/faq.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. - [EU Data Act Non-Emergency Public-Sector Requests FAQ](/artifacts/eu/data-act/faq/non-emergency-public-sector-requests.md): FAQ on EU Data Act requests where a public body claims exceptional need outside a public emergency, including scope, request contents, limits, compensation, confidentiality, and evidence. - [EU Data Act Non-Personal Data and Mixed Datasets FAQ](/artifacts/eu/data-act/faq/non-personal-data-and-mixed-datasets.md): FAQ on how the EU Data Act treats non-personal data, mixed datasets, GDPR precedence, user and third-party access, trade-secret limits, and evidence records. - [EU Data Act Penalties and Enforcement](/artifacts/eu/data-act/penalties-and-fines.md): Official source guide to Data Act penalties under Article 40, Member State enforcement, penalty factors, complaints, judicial remedies, and the GDPR enforcement boundary. - [EU Data Act Pre-Contractual Information FAQ](/artifacts/eu/data-act/faq/pre-contractual-information.md): FAQ on EU Data Act Article 3 pre-contract information for connected products and related services, including data categories, access methods, data holder identity, third-party sharing, and GDPR boundaries. - [EU Data Act Product Data vs Related Service Data FAQ](/artifacts/eu/data-act/faq/product-data-and-service-data.md): FAQ explaining how the EU Data Act separates connected product data, related service data, readily available raw and pre-processed data, metadata, and inferred or derived outputs. - [EU Data Act Readily Available Data FAQ](/artifacts/eu/data-act/faq/readily-available-data.md): FAQ on what counts as readily available data under the EU Data Act, including product data, related service data, metadata, inferred data, and access mechanics. - [EU Data Act Related Services FAQ](/artifacts/eu/data-act/faq/related-services.md): FAQ explaining when software is a Data Act related service, how it links to connected products, which product and service data are in scope, and what exclusions apply. - [EU Data Act requirements](/artifacts/eu/data-act/requirements.md): Official source EU Data Act requirements for connected-product data access, B2B sharing terms, B2G exceptional needs, cloud switching, smart contracts, interoperability, GDPR boundaries, and records. - [EU Data Act Smart Contracts for Data Sharing FAQ](/artifacts/eu/data-act/faq/smart-contracts-for-data-sharing.md): Answers on Article 36 Data Act smart-contract requirements for data sharing: scope, robustness, access control, termination, archiving, conformity assessment, contract terms, and standards status. - [EU Data Act Third-Party Data Sharing FAQ](/artifacts/eu/data-act/faq/third-party-data-sharing.md): FAQ on user-directed third-party data sharing under the EU Data Act, covering data holder duties, recipient limits, trade secrets, security, GDPR, and gatekeepers. - [EU Data Act Trade Secret Safeguards FAQ](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md): FAQ on protecting trade secrets when handling EU Data Act user and third-party data access requests, including safeguards, withholding, suspension, refusal, notices, and records. - [EU Data Act Unfair Contractual Terms FAQ](/artifacts/eu/data-act/faq/unfair-contractual-terms.md): FAQ on Article 13 of the EU Data Act: B2B unfair contract terms, unilateral take-it-or-leave-it clauses, always-unfair terms, presumed-unfair terms, SMEs, model terms, and review evidence. - [EU Data Act Users, Data Holders, and Recipients FAQ](/artifacts/eu/data-act/faq/users-data-holders-and-recipients.md): FAQ explaining Data Act users, data holders, data recipients, connected products, related services, user access, third-party limits, and GDPR boundaries. - [EU Data Act Vehicle Data Guidance FAQ](/artifacts/eu/data-act/faq/vehicle-data-guidance.md): FAQ on EU Data Act vehicle data guidance for connected vehicles, aftermarket repair, mobility services, third-party access, trade secrets, security, and GDPR boundaries. - [EU Data Act vs Data Governance Act](/artifacts/eu/data-act/data-act-vs-data-governance-act.md): Compare the EU Data Act with the Data Governance Act: connected-product access, cloud switching, B2B/B2G duties, protected public-sector reuse, intermediaries, altruism, governance, and enforcement. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/data-act/access-rights-and-portability.md