EU Data Act B2B Data Sharing Compensation FAQ

Yes, but the Data Act does not give data holders an open-ended right to set deterrent access fees. Article 9 says compensation agreed between a data holder and a data recipient for making data available in B2B relations must be reasonable and non-discriminatory, and it may include a margin.

First confirm that Chapter III applies. The data holder must be obliged in a B2B relationship to make data available under Article 5 or under applicable EU law or national legislation adopted in accordance with EU law. Article 50 adds a transition rule: Chapter III applies to data-making-available obligations under Union or qualifying national law that entered into force after 12 September 2025. Voluntary sharing, consumer access, business-to-government requests, and cloud switching follow different rules.

Article 9 points to concrete inputs, not a generic market-price uplift. The parties must take into account costs incurred in making the data available, especially formatting, electronic dissemination, and storage. They must also consider investments in collecting and producing the data where applicable, including whether other parties contributed to obtaining, generating, or collecting the data.

The compensation may also depend on the volume, format, and nature of the data. That allows different calculations for materially different data requests, but it does not support unexplained charges, punitive access fees, or prices that cannot be tied back to the Article 9 inputs.

Article 9 says compensation may include a margin, but the margin still sits inside the rule that the overall compensation must be reasonable and non-discriminatory. The Data Act therefore supports a documented margin analysis, not an arbitrary profit line or a charge designed to make access unattractive.

The margin position should be checked against the recipient category. Where the data recipient is an eligible SME or not-for-profit research organisation, Article 9(4) limits compensation to the costs incurred in making the data available, which excludes a margin above those cost elements for that protected recipient category.

The Data Act gives protected treatment to data recipients that are SMEs or not-for-profit research organisations, provided the recipient does not have partner enterprises or linked enterprises that do not qualify as SMEs. For those recipients, compensation cannot exceed the costs incurred in making the data available under Article 9(2)(a).

The Data Act imports the SME definition from Recommendation 2003/361/EC: fewer than 250 employees and either annual turnover not above EUR 50 million or an annual balance-sheet total not above EUR 43 million, with the Recommendation's rules for autonomous, partner, and linked enterprises. A startup has no separate Data Act discount and must pass that SME test.

The data holder must provide the data recipient with information setting out the basis for calculating compensation in enough detail for the recipient to assess whether Article 9(1) to 9(4) are met. A single line item such as "data access fee" is unlikely to be useful for that assessment.

A practical disclosure should show the relevant data scope, cost categories, investment assumptions where used, volume or format factors, margin treatment where applicable, and whether the SME or not-for-profit research organisation cap was assessed.

Compensation clauses should be reviewed together with Chapter IV on unfair contractual terms. Article 13 applies to contractual terms concerning access to and use of data, or liability and remedies for breach or termination of data-related obligations, when an enterprise unilaterally imposes the term on another enterprise.

A compensation term is higher risk when it is take-it-or-leave-it, cannot be meaningfully negotiated, lets the imposing party interpret conformity alone, limits remedies inappropriately, or allows substantial price changes without a valid reason and termination right. Article 13 does not assess adequacy of price against data supplied, but surrounding terms can still be unfair.

Trade secrets are a safeguard issue, not a blank cheque for compensation. The Commission FAQ explains that a data holder may require confidentiality and secrecy safeguards before disclosure, and the Data Act allows withholding, suspension, or exceptional refusal only under specific conditions. A trade secret label alone is not enough to block the access right.

Where trade secret protection affects cost, separate the protection measure from the compensation calculation. For example, confidentiality arrangements, strict access protocols, or technical controls may affect the effort needed to make data available, but the data holder should still be able to show how those measures relate to the requested data and Article 9 cost basis.

Keep a file that lets someone else reconstruct the Data Act Article 9 decision. The record should show the mandatory sharing trigger, the recipient category, the cost items used, any margin analysis, and the disclosure given to the recipient. It should also show why similar recipients were treated the same or differently.

Because Article 10 allows certified dispute settlement bodies to resolve FRAND and compensation disputes, teams should also keep the material they would need if the amount is challenged: the worksheet, recipient correspondence, and the rationale for any SME or research-organisation cap.

The Data Act does not set a fixed tariff table. Calculate compensation from the applicable cost categories, any permitted margin, the recipient's protected status, and the disclosure needed for the recipient to assess the calculation. A startup must meet the SME test to receive the cost cap.

Also avoid using compensation to do work that belongs to another rule. Trade secret risk should be handled through safeguards and, where justified, the Data Act withholding, suspension, or exceptional-refusal procedure. Bargaining-power problems should be handled through unfair-term review. Personal data issues still need GDPR compliance, because the Data Act does not create a new legal basis for personal data processing.

Assign the Data Act question to the team that can actually change the compensation workflow. In practice, that is usually legal for the Article 9 analysis, finance or pricing for the worksheet, and the product or operations owner for the request process and recipient notice.

One person should own the final decision, but legal, commercial, privacy, and security reviewers should each have a clear role. That helps avoid a single compensation amount being reused in situations that have different recipient categories, different cost bases, or different trade secret constraints.