Artifact GuideEU

EU Data Act: Fair Access to Connected Product Data and Cloud Switching B2B Data Sharing Contract Clauses

A clause library you can use to fix real B2B data contracts-without creating unfair-terms risk.

Focus: Chapter III data sharing and Chapter IV unfair contractual terms (Article 13) for enterprise-to-enterprise agreements.

Author
Sorena AI
Published
Feb 23, 2026
Updated
Feb 23, 2026
Sections
8

Structured answer sets in this page tree.

Primary sources
2

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Feb 23, 2026
Updated Feb 23, 2026
Overview

The EU Data Act turns "data access" into a contract discipline. For B2B data sharing, your agreements need to do two things at once: enable lawful, secure access and reuse (Chapter III) and avoid unilaterally imposed unfair terms that can become non binding (Chapter IV, Article 13). This page gives a practical clause library and drafting notes you can apply to APIs, portals, data feeds, and platform terms.

Section 1

1) Start with the non-negotiable: unfair terms can become non binding (Article 13)

Article 13 targets contractual terms concerning access/use of data (and liability/remedies) that are unilaterally imposed on another enterprise and are unfair. If a term is unfair, it is not binding on the other enterprise.

This changes your drafting strategy: remove 'gross deviation' clauses (exclusive interpretation rights, extreme remedy limits, one-sided termination, etc.) and document negotiation for key terms.

  • Red flags: limiting your liability for intentional acts or gross negligence; excluding remedies for non-performance
  • Red flags: giving one party the exclusive right to decide if data is conforming or to interpret terms
  • Presumptively unfair patterns: preventing termination within a reasonable period; blocking access to copies of the other party's generated/provided data
  • Proof point: keep a negotiation trail for contested clauses to rebut "unilaterally imposed" claims
Section 2

2) Data scope clause - define exactly what is shared (and what isn't)

Most disputes are scope disputes. The contract must define the dataset, the metadata needed to interpret it, the delivery method, and any limits that are consistent with the Data Act.

Draft like an API spec: versioned schemas, formats, and a change-control process.

  • Dataset definition: fields, units, timestamps, identifiers, and metadata necessary to interpret/use the data
  • Delivery mode: API endpoints, files, streaming, or portal downloads; frequency and latency expectations
  • Data quality: completeness, refresh cadence, and error handling (and what counts as a defect)
  • Change control: schema versioning, deprecation windows, and change notifications
Section 3

3) Purpose and permitted use clause - limit use without killing value

Purpose limitation is the core control for reuse. It should be specific enough to protect the data holder and trade secrets, but broad enough to avoid becoming an unfair restriction.

Avoid 'catch-all' prohibitions. Describe allowed use cases and prohibited competitive behaviors explicitly.

  • Allowed use: named product/service purposes, analytics categories, and permitted outputs/derivatives
  • Prohibited use: reverse engineering, re-identification, and use outside the agreed purpose
  • Onward sharing: conditions for sub-processors/sub-recipients; flow-down obligations and approvals
  • Retention: retention periods tied to purpose + deletion obligations upon termination where applicable
Section 4

4) Compensation clause - design a defensible pricing model (and document it)

Compensation disputes are common. Even where the Data Act expects fairness and non-discrimination, you still need a practical cost model and billing mechanics.

Write the clause so finance and engineers can execute: cost drivers, fee caps, reporting, and dispute handling.

  • Cost drivers: extraction, transformation, security controls, support, and infrastructure costs
  • Commercial structure: subscription, per-call, per-export, or tiered pricing; how bursts are handled
  • Invoice transparency: what gets itemized; how switching/termination fees are treated (avoid hidden fees)
  • Dispute process: escalation path, timelines, and interim payment handling
Section 5

5) Trade secrets and confidentiality clause - 'share with safeguards'

Trade secret protection is not a blanket refusal strategy. It is a safeguard strategy: classify trade secret fields and require enforceable confidentiality and security measures.

Make confidentiality operational: access protocol, minimum security controls, and auditability.

  • Trade secret marking: define what is considered trade secret in the dataset and how it is labeled
  • Confidentiality: NDA or confidentiality terms, purpose limitation, and restrictions on onward sharing
  • Security: encryption, access control, secure storage, and incident notification obligations
  • Auditability: logging requirements, right to request evidence, and remediation obligations for breaches
Section 6

6) Security and integrity clause - prevent 'data sharing' from becoming a breach

Security terms are not boilerplate in Data Act data sharing. They are core compliance controls.

Write security terms as verifiable requirements: authentication, authorization, monitoring, and incident response.

  • Access control: identity verification, role-based access, least privilege, and key management
  • Transport and storage: encryption in transit and at rest; integrity validation (hashes/checksums)
  • Abuse monitoring: rate limits, anomaly detection, and misuse response
  • Incident response: notification timelines, containment cooperation, and post-incident evidence
Section 7

7) Liability and remedies clause - avoid unfair terms and keep enforceability

Liability and remedies are explicitly within the Article 13 unfair-terms scope. Draft for balance and clarity.

Avoid one-sided limitations that remove remedies for non-performance or that attempt to eliminate accountability for gross negligence.

  • Remedies: service credits, cure periods, specific performance for data delivery failures
  • Liability carve-outs: avoid excluding liability for intentional acts or gross negligence
  • IP and confidentiality breaches: clear consequences and injunctive relief where appropriate
  • Termination: reasonable notice and clear data return/deletion outcomes
Section 8

Evidence checklist - what to keep for disputes and enforcement

Contract disputes under the Data Act become evidence disputes. Keep artifacts that show the dataset, the controls, and the fairness of the terms.

This also improves procurement readiness: buyers increasingly ask for proof, not promises.

  • Executed contract + negotiation trail for key terms (to rebut unilateral imposition claims)
  • Dataset manifest: schema, formats, metadata, and change log
  • Security evidence: access control model, logs, encryption configuration, and incident playbooks
  • Compensation model: documented cost drivers, fee schedule, and billing audit trail
  • Trade secret register + safeguards acceptance (NDA/terms acknowledgements)
Recommended next step

Keep EU Data Act: Fair Access to Connected Product Data and Cloud Switching B2B Data Sharing Contract Clauses in one governed evidence system

SSOT can take EU Data Act: Fair Access to Connected Product Data and Cloud Switching B2B Data Sharing Contract Clauses from reusing this material inside a governed evidence system to a reusable workflow inside Sorena. Teams working on EU Data Act: Fair Access to Connected Product Data and Cloud Switching can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

Related guides

Explore more topics

Access Rights and Portability | EU Data Act: Fair Access to Connected Product Data and Cloud Switching
EU Data Act access rights and portability (Chapter II) made practical: direct vs indirect access, "readily available" data.
Applicability Test | EU Data Act: Connected Products, B2B Data Sharing, B2G Exceptional Need, Cloud Switching
A practical EU Data Act applicability test you can run in 15 minutes: determine if Chapter II IoT access rights apply (connected products + related services).
B2B Data Sharing Contract Template | EU Data Act: Data Access and Use Agreement (Drafting Checklist)
A practical EU Data Act-aligned B2B data sharing contract template: sections, annexes, and drafting checklist for dataset definition, permitted use.
B2G Exceptional Need Requests | EU Data Act: Public Emergency Data Requests, Safeguards, Compensation
EU Data Act Chapter V B2G 'exceptional need' requests made practical.
Cloud Switching and Exit Plans | EU Data Act Chapter VI: Switch Providers, Port Data, Remove Egress Barriers
EU Data Act Chapter VI cloud switching made practical: Article 23 obstacle removal, Article 25 required contract terms (max 2-month notice, 30-day transition.
Cloud Switching Compliance Checklist | EU Data Act Chapter VI: Contracts, Exportable Data, Fees, Transparency
A detailed EU Data Act Chapter VI cloud switching compliance checklist: Article 25 contract terms (max notice period, 30-day transition, retrieval period).
Compliance Program | EU Data Act Implementation Playbook: Governance, Controls, Evidence, Operating Cadence
Turn the EU Data Act into an implementation program: chapter scoping, roles and ownership, product workflows for Chapter II access.
Deadlines and Compliance Calendar | EU Data Act
Plan EU Data Act delivery with real dates: Regulation applies from 12 Sep 2025.
EU Data Act Checklist | Chapter II Access, B2B Sharing, Unfair Terms, B2G Requests, Cloud Switching
A comprehensive EU Data Act checklist organized by roles and chapters: Chapter II connected product data access (direct vs indirect access).
EU Data Act vs GDPR | Differences, Overlap, Portability, Lawful Basis, Implementation Playbook
EU Data Act vs GDPR made practical: how Chapter II access/portability for connected product data differs from GDPR data subject rights.
FAQ | EU Data Act Explained: Key Dates, Access Rights, Trade Secrets, B2G Requests, Cloud Switching
EU Data Act FAQ with practical answers grounded in official sources: when the Data Act applies (Article 50), direct vs indirect access.
Penalties and Fines | EU Data Act Enforcement: Member State Penalties, GDPR-Linked Fines, Risk Controls
EU Data Act penalties and fines made practical: how Member States set penalties (Article 40), the criteria authorities must consider.
Requirements | EU Data Act Obligations Explained: Chapter II Access, Chapter IV Unfair Terms, Chapter V B2G, Chapter VI Switching
A structured EU Data Act requirements breakdown across Chapters II-VI: connected product data transparency and access workflows.
Scope, Connected Products and Data Types | EU Data Act: Fair Access to Connected Product Data and Cloud Switching
EU Data Act scope explained: connected products vs related services, product data vs related service data, readily available data.
Trade Secrets and Protection | EU Data Act: Confidentiality Measures, Withholding Rules, Evidence Pack
EU Data Act trade secrets protection made practical: how to identify trade secret fields before disclosure, how to agree confidentiality measures (NDAs.