Search every question across sub-FAQs

Under the Data Act, exportable data means input and output data, including metadata, generated or co-generated directly or indirectly by the customer's use of the data processing service. It excludes assets or data protected by the intellectual property rights, or constituting trade secrets, of the provider or third parties. Digital assets are separate elements in digital form that the customer has the right to use independently of the contract with the source provider. Procurement should ask the supplier to define these boundaries in the contract rather than discovering them during a migration.

The checklist should confirm the formats, included metadata, and configuration or schema material needed to make the export usable on the destination service. A raw dump that the customer cannot rebuild from is insufficient.

Under the Data Act, providers of services limited to infrastructural elements must take all reasonable measures in their power to help customers achieve functional equivalence after switching to a service of the same service type. Other providers must make open interfaces available free of charge; where no relevant common specifications or harmonised standards have been published in the central Union standards repository, they must, at the customer's request, export all exportable data in a structured, commonly used, machine-readable format.

Procurement should establish which obligation applies to the service being bought, because expecting functional equivalence from a SaaS provider, or accepting only a raw export from an IaaS provider, both misread the Regulation.

Under the Data Act, the contract must give the customer a retrieval period of at least 30 calendar days starting after the agreed transitional period ends. The provider must fully erase the exportable data and digital assets generated directly by, or relating directly to, the customer after that retrieval period or a later agreed period, provided the switching process has completed successfully. Procurement should make sure the retrieval window and the erasure trigger are both explicit.

A buyer should also confirm how erasure is evidenced, so it can show that the data left the old provider once the migration and any agreed retention period ended.

Article 26 requires the provider to reference an up-to-date register of exportable-data structures, formats, standards, and open interoperability specifications. For non-IaaS services, Article 30 requires free open interfaces and, after the repository trigger and 12-month compliance period, compatibility with referenced common specifications or harmonised standards.

For IaaS, the separate Article 30(1) duty is to take all reasonable measures within the provider's power to help a customer achieve functional equivalence after a same-service-type switch. Procurement should test the correct branch and ask which formats, interfaces, tools, and standards the exit process actually uses.

Article 31 has two different regimes. For a service mainly custom-built for one customer, or developed entirely for one customer, and not offered at broad commercial scale through the provider's catalogue, only Article 23(d), Article 29, and Article 30(1) and (3) do not apply. A non-production version supplied for testing and evaluation for a limited period is outside Chapter VI entirely.

Before contract signature, the provider must identify which Chapter VI obligations do not apply. Procurement should require the factual basis, preserve the remaining duties for a qualifying custom-built service, and negotiate explicit exit protection where a limited test service falls outside Chapter VI.

Article 23 requires providers to remove obstacles that inhibit a customer, where relevant, from using several data processing providers at the same time. It also requires technically feasible unbundling of covered data processing services. Those binding duties do not guarantee that every architecture can be split or that every cost of parallel operation is free.

A phased cutover and overlap plan is a procurement control, not a fixed statutory transition design. Require the supplier to identify dependencies, feasible unbundling points, assistance, security, continuity measures, coexistence charges, and the evidence that will mark each migration stage complete.

Under the Data Act, the core cloud-switching obligations apply from 12 September 2025, and switching charges must be removed by 12 January 2027, so procurement should track which obligations a contract already meets and which depend on a future date. A renewal or new signature is the moment to align the contract with the applicable date.

The team should also set event triggers, such as a change of service architecture or supplier documentation, so the contract is re-checked when the underlying service or the applicable obligation changes.

Under the Data Act, a connected product is an item that obtains, generates, or collects data concerning its use or environment and can communicate product data through an electronic communications service, a physical connection, or on-device access. The definition also excludes items whose primary function is storing, processing, or transmitting data for a party other than the user.

The practical question is whether the product itself produces or captures operational data and has a route to communicate that data. Smart-home appliances, connected cars, medical or fitness devices, industrial machinery, agricultural machinery, planes, robots, and similar sensor-equipped products are typical examples when the rest of the scope test is met.

Yes. For connected-product scope, the Data Act applies to manufacturers of connected products placed on the market in the Union and providers of related services, regardless of where those manufacturers or providers are established. It also applies to users in the Union of those connected products or related services.

The Commission FAQ explains that placing on the market happens once for each individual product after the manufacturing stage, when ownership, possession, or another property right is transferred between economic actors. Later transactions are making available on the market, not a new first placement.

Under the Data Act, a user is a natural or legal person that owns the connected product, has contractually received temporary rights to use it, or receives related services. The user can be a consumer, business, or public sector body; the key point is a stable ownership, rental, lease, or related-service position rather than casual physical interaction.

The Commission FAQ gives the example of an airplane passenger: use of a connected aircraft through a transport service does not itself transfer property-type rights over the aircraft, so the passenger is not a Data Act user of the aircraft.

Under the Data Act, a related service is a digital service, other than an electronic communications service, that is connected with the product at purchase, rent, or lease so that the product would lose one or more functions without it, or that is later connected to add, update, or adapt product functions. Software can be a related service when it is linked to product operation.

The Commission FAQ describes two practical conditions: there must be bidirectional exchange of data between the connected product and service provider, and the service must affect the product's functions, behavior, or operation. An app that adjusts light brightness or regulates a fridge temperature can be a related service; connectivity, power supply, auxiliary consulting, analytics, financial services, and regular repair or maintenance are not related services merely because they interact with the product ecosystem.

Under the Data Act, Chapter II focuses on product data and related service data that is readily available to the data holder. Product data is data generated by use of the connected product and designed to be retrievable. Related service data is data representing user actions or events related to the product during the related service.

The scope includes raw data and pre-processed data, together with relevant metadata needed to interpret and use it. Commission materials describe this as raw or pre-processed data that is readily available, such as sensor measurements, status data, timestamps, or event logs where the data holder can obtain them without disproportionate effort beyond a simple operation.

Under the Data Act, several exclusions matter. Prototypes are outside scope because their manufacturing stage has not been completed. Data that is inferred or derived from product data through additional investment, including proprietary complex algorithms, is not treated as data that must be made available under Chapter II unless the parties agree otherwise.

The Data Act also distinguishes connected-product data from content. If a user watches a film on a smart TV, the film itself is not the Chapter II product data, but product-generated data such as screen brightness may be in scope if otherwise readily available. Data generated by infrastructure that the user does not own, rent, lease, or otherwise have rights over is not pulled into scope merely because the user's connected product uses that infrastructure.

Article 7 of the Data Act creates an important Chapter II limitation. The Chapter II obligations do not apply to data generated through connected products manufactured or designed, or related services provided, by a microenterprise or small enterprise, if the linked-enterprise and subcontracting conditions in Article 7 are satisfied.

The same Article also covers data generated through connected products manufactured by, or related services provided by, an enterprise that has qualified as a medium-sized enterprise for less than one year, and connected products for one year after they were placed on the market by a medium-sized enterprise. This is a narrow status-and-timing check; it should not be generalized into an SME exemption for every data-sharing issue.

If the connected product or related service is in scope, Article 3 of the Data Act requires product data and related service data, including relevant metadata, to be designed or provided so that they are easily, securely, free of charge, and in a comprehensive, structured, commonly used, machine-readable format accessible to the user, where relevant and technically feasible directly.

Keep the application dates separate. The Regulation generally applies from 12 September 2025, including the Article 4 request route for readily available data. The Article 3(1) access-by-design obligation applies only to connected products and the services related to them placed on the Union market after 12 September 2026. A product placed earlier is not outside Chapter II merely because that later design date does not apply.

Before contracts for a connected product or related service are concluded, the seller, rentor, lessor, or related-service provider must provide the clear information that Article 3 assigns to that contract type. Depending on the contract, this includes type, format, volume, frequency, storage, retention, access or retrieval arrangements, data-holder identity, trade-secret status, and the third-party sharing process. Where direct access is not available, Article 4 requires the data holder to make readily available data accessible to the user on request.