Search every question across sub-FAQs

The common mistake is treating Article 36 as a blockchain policy page instead of a concrete conformity and control obligation for smart contracts executing data-sharing agreements. Generic statements about security, immutability, decentralisation, or automation do not answer the Article 36 questions.

A defensible answer identifies the covered agreement, responsible actor, exact smart contract functions, access-control layers, termination and interruption path, archive plan, agreement-consistency check, conformity assessment, and EU declaration status. It also avoids uncited claims about fines, effective dates, or legal effects that are not needed to answer the Article 36 control question.

Keep the source evidence that shows why Article 36 applies and how the control decision was made. At a minimum, store the cited Data Act clause, the smart contract role identified by Article 36, the agreement version, the specific control tested, and the conformity evidence used to support the answer.

Also keep the decision date, the reviewer or approver, and the linked implementation artifact so future reviewers can see how the Article 36 control position was reached and whether the same conclusion still fits the current agreement and code version.

Assign one accountable owner for the Data Act Article 36 control record itself: the vendor of the smart contract or, where there is no vendor, the person deploying smart contracts for others in the context of executing the agreement. That owner should be responsible for the conformity assessment, the EU declaration of conformity, and the control record that links the smart contract to the agreement.

Other teams can contribute evidence, but the owner should be the person or function that can approve code, access control, interruption, archiving, and agreement changes. When responsibilities are split, keep the legal, product, security, and engineering contributors named separately so the accountable owner remains clear.

Yes, but the Data Act does not give data holders an open-ended right to set deterrent access fees. Article 9 says compensation agreed between a data holder and a data recipient for making data available in B2B relations must be reasonable and non-discriminatory, and it may include a margin.

First confirm that Chapter III applies. The data holder must be obliged in a B2B relationship to make data available under Article 5 or under applicable EU law or national legislation adopted in accordance with EU law. Article 50 adds a transition rule: Chapter III applies to data-making-available obligations under Union or qualifying national law that entered into force after 12 September 2025. Voluntary sharing, consumer access, business-to-government requests, and cloud switching follow different rules.

Article 9 points to concrete inputs, not a generic market-price uplift. The parties must take into account costs incurred in making the data available, especially formatting, electronic dissemination, and storage. They must also consider investments in collecting and producing the data where applicable, including whether other parties contributed to obtaining, generating, or collecting the data.

The compensation may also depend on the volume, format, and nature of the data. That allows different calculations for materially different data requests, but it does not support unexplained charges, punitive access fees, or prices that cannot be tied back to the Article 9 inputs.

Article 9 says compensation may include a margin, but the margin still sits inside the rule that the overall compensation must be reasonable and non-discriminatory. The Data Act therefore supports a documented margin analysis, not an arbitrary profit line or a charge designed to make access unattractive.

The margin position should be checked against the recipient category. Where the data recipient is an eligible SME or not-for-profit research organisation, Article 9(4) limits compensation to the costs incurred in making the data available, which excludes a margin above those cost elements for that protected recipient category.

The Data Act gives protected treatment to data recipients that are SMEs or not-for-profit research organisations, provided the recipient does not have partner enterprises or linked enterprises that do not qualify as SMEs. For those recipients, compensation cannot exceed the costs incurred in making the data available under Article 9(2)(a).

The Data Act imports the SME definition from Recommendation 2003/361/EC: fewer than 250 employees and either annual turnover not above EUR 50 million or an annual balance-sheet total not above EUR 43 million, with the Recommendation's rules for autonomous, partner, and linked enterprises. A startup has no separate Data Act discount and must pass that SME test.

The data holder must provide the data recipient with information setting out the basis for calculating compensation in enough detail for the recipient to assess whether Article 9(1) to 9(4) are met. A single line item such as "data access fee" is unlikely to be useful for that assessment.

A practical disclosure should show the relevant data scope, cost categories, investment assumptions where used, volume or format factors, margin treatment where applicable, and whether the SME or not-for-profit research organisation cap was assessed.

Compensation clauses should be reviewed together with Chapter IV on unfair contractual terms. Article 13 applies to contractual terms concerning access to and use of data, or liability and remedies for breach or termination of data-related obligations, when an enterprise unilaterally imposes the term on another enterprise.

A compensation term is higher risk when it is take-it-or-leave-it, cannot be meaningfully negotiated, lets the imposing party interpret conformity alone, limits remedies inappropriately, or allows substantial price changes without a valid reason and termination right. Article 13 does not assess adequacy of price against data supplied, but surrounding terms can still be unfair.

Trade secrets are a safeguard issue, not a blank cheque for compensation. The Commission FAQ explains that a data holder may require confidentiality and secrecy safeguards before disclosure, and the Data Act allows withholding, suspension, or exceptional refusal only under specific conditions. A trade secret label alone is not enough to block the access right.

Where trade secret protection affects cost, separate the protection measure from the compensation calculation. For example, confidentiality arrangements, strict access protocols, or technical controls may affect the effort needed to make data available, but the data holder should still be able to show how those measures relate to the requested data and Article 9 cost basis.

Keep a file that lets someone else reconstruct the Data Act Article 9 decision. The record should show the mandatory sharing trigger, the recipient category, the cost items used, any margin analysis, and the disclosure given to the recipient. It should also show why similar recipients were treated the same or differently.

Because Article 10 allows certified dispute settlement bodies to resolve FRAND and compensation disputes, teams should also keep the material they would need if the amount is challenged: the worksheet, recipient correspondence, and the rationale for any SME or research-organisation cap.

Avoid treating the Data Act as if it supplies a fixed tariff table. The sources support cost categories, margin possibility, protected-recipient caps, calculation transparency, and dispute routes; they do not support invented per-API-call fees, percentage-of-revenue formulas, statutory penalty amounts for overcharging, or universal startup discounts.

Also avoid using compensation to do work that belongs to another rule. Trade secret risk should be handled through safeguards and, where justified, the Data Act handbrake. Bargaining-power problems should be handled through unfair-term review. Personal data issues still need GDPR compliance, because the Data Act does not create a new legal basis for personal data processing.

Keep the source material that shows why this Data Act FAQ answer is based on Article 9 and related Commission guidance. For a compensation question, record the exact legal trigger, the cost basis used, the recipient type, and any transparency note shared with the recipient.

Also keep the version of the source you relied on, because the current answer depends on the Data Act text, the Commission explanation page, and the FAQ guidance on compensation, margin limits, and disclosure. If the calculation later changes, reviewers should be able to see what changed and why.

Assign the Data Act question to the team that can actually change the compensation workflow. In practice, that is usually legal for the Article 9 analysis, finance or pricing for the worksheet, and the product or operations owner for the request process and recipient notice.

One person should own the final decision, but legal, commercial, privacy, and security reviewers should each have a clear role. That helps avoid a single compensation amount being reused in situations that have different recipient categories, different cost bases, or different trade secret constraints.

The Data Act answer is only useful later if someone can trace it back to the actual request, the data scope, and the cost model. Keep the request or contract clause that triggered Chapter III, the internal calculation, the recipient-facing explanation, and any note showing whether the cap for SMEs or not-for-profit research organisations was applied.

It also helps to keep evidence of any trade secret safeguards, because those often affect the amount and the wording of the disclosure. If the issue is ever challenged, the reviewer should be able to reconstruct both the amount and the reason the amount was disclosed in that form.