Search every question across sub-FAQs

Under the Data Act, an Article 33 participant offering data or data services must describe dataset content, use restrictions, licences, collection methodology, data quality, and uncertainty in machine-readable form, and describe data structures, formats, vocabularies, taxonomies, and code lists in a public and consistent way where available. These descriptions are what make a data-space offer interoperable.

A participant should also document technical access means such as APIs, terms of use, and quality of service, so another participant can consume the data without bespoke negotiation.

Under the Data Act, the interoperability position should be revisited whenever a harmonised standard reference is published in the Official Journal, a common specification is adopted by implementing act, or a repository reference for data processing services is added. Each event can change what a team must support and what merely supports conformity.

Teams should also revisit the position when an M/614 deliverable advances or a relevant standard is amended or replaced, so the implementation tracks the current references rather than an outdated draft.

No. Article 41 calls for non-binding terms and clauses, and the Commission publication says their use is voluntary and open to amendment. They are an official drafting baseline, not a compulsory template or a compliance safe harbour.

That said, voluntary wording cannot override mandatory Data Act protections. In particular, Chapter IV makes unfair terms in enterprise data-access and data-use contracts non-binding, and Article 12 prevents data-sharing agreements from excluding or varying Chapter III obligations to the detriment of a covered party or user.

The Commission publication supplies three MCT sets for mandatory Chapter II and III relationships: Data Holder to User, User to Data Recipient, and Data Holder to Data Recipient. A fourth set, Data Sharer to Data Recipient, addresses voluntary sharing.

For contract teams, the first step is to identify which relationship the deal actually creates. A connected-product manufacturer sharing data with a user, a user authorising a recipient, and a data holder sharing with that recipient need different obligations, data descriptions, permitted-use terms, compensation language, and safeguards.

Mainly, yes. The Commission says the terms were drafted primarily for business-to-business contracts. They can also be adapted for business-to-consumer relationships if the relevant consumer-protection rules are added.

The Data Act's unfair-contract-term control in Article 13 applies to terms unilaterally imposed by one enterprise on another enterprise. A B2C deployment needs a separate consumer-law check instead of assuming the B2B model wording is enough.

Under the Data Act, Article 41 specifically calls out model terms on data access and use, including reasonable compensation and the protection of trade secrets. Those topics should therefore be visible in the contract review file: what data is covered, who may use it, for what purpose, whether compensation is charged, and what confidentiality or technical measures protect trade secrets.

The model terms should not be copied as a single undifferentiated block. Each clause should be tied to the relevant data-sharing relationship, the data description, the recipient's permitted uses, and any safeguards needed to protect trade secrets without defeating the Data Act access right.

Start by classifying the deal. Decide whether it is a data-sharing contract or a cloud-switching contract, and then identify the Data Act roles on each side. That tells you which Commission model set to use and which mandatory provisions need a closer look.

Next, check whether the wording affects access, use, compensation, trade secrets, or switching. If it does, compare the drafted clause against the Data Act text before you accept the model wording or begin redlining.

For cloud contracts under the Data Act, start with the switching and exit wording, the termination mechanics, the notice period, and the data retrieval and erasure terms. Those points line up with Article 25's written-contract requirements and the broader switching obligations in Chapter VI.

Then check the information on exportable data, digital assets, exemptions for provider-internal data linked to trade secrets, continuity, security during transfer, and any switching charges. If those points are missing or vague, the contract needs a closer review before it is signed.

Under the Data Act, the Commission says the mandatory-sharing model sets are compliant with Chapter IV on unfair contractual terms, but that does not make every negotiated contract fair automatically. Article 13 still requires a term-by-term check where one enterprise supplied a term and the other enterprise could not influence it despite trying to negotiate.

High-risk clauses include terms that exclude liability for intentional acts or gross negligence, remove remedies, give one party exclusive power to interpret conformity, allow one party to access and use the other party's data in a manner significantly detrimental to the other party's legitimate interests, restrict use of data the other party provided or generated, block termination within a reasonable period, or permit unilateral changes to price or substantive data-sharing conditions without a valid reason and termination right.

Chapter IV applies to contracts concluded after 12 September 2025. From 12 September 2027, it also applies to earlier contracts that are indefinite or due to expire at least 10 years from 11 January 2024. Record the contract date and duration before deciding whether Article 13 applies.

Keep evidence that shows the contract team used the model terms as an official source drafting aid and checked the mandatory Data Act rules that matter to the deal. The record should let a reviewer see the party roles, relationship type, data categories, clause set selected, redlines, reason for deviations, unfair-term review, and cloud-switching review where relevant.

For cloud contracts, keep a separate switching evidence pack: exportable data and digital assets, known technical limits, switching method and formats, retrieval and erasure terms, continuity and security commitments, charges information, and any provider-internal data categories excluded because of trade-secret risk.

Start with the Data Act itself for the binding rule. Use Article 41 for the Commission's mandate, Articles 12 and 13 for data-sharing and unfair-term controls, and Articles 23 to 31 for cloud switching and porting.

Then use the Commission MCT and cloud SCC publication page for the voluntary model wording, the relationship sets, and the clause groups. The Commission's FAQ and contract-law pages are useful supporting context, but they should not be cited as if they replace the regulation.

The Commission's draft Recommendation contains two distinct families: MCTs for data access and use under Chapters II to IV, and SCCs for cloud computing contracts under Chapter VI. The cloud family includes Switching and Exit, Termination, and Security and Business Continuity sets, plus separate Non-Dispersion, Non-Amendment, and Liability sets.

Use the cloud SCCs for a data processing service contract and the relevant MCT relationship for connected-product or other data-sharing terms. A contract may need both families if it genuinely contains both types of arrangement, but each clause must be mapped to the correct legal relationship.

Under the Data Act, voluntary model wording cannot be used to contract out of mandatory protections, and Article 12 prevents a data-sharing agreement from excluding or varying Chapter III obligations to the detriment of a covered party or user. The model terms are a drafting aid, not a way to weaken statutory rights.

A reviewer should treat any deviation that reduces a mandatory right as a red flag, even if it is dressed in Commission-style wording, and record why the change is still compliant.

The model contractual terms and cloud standard contractual clauses are published in a Commission draft Recommendation and can be updated, so teams should re-check their contract library when the Commission revises the model sets or issues new implementation guidance. A version note in the contract file makes that easier to track.

Teams should also re-check the wording when the underlying obligation changes. Article 29 prohibits switching charges from 12 January 2027, so contracts must distinguish that prohibition from standard service fees and early-termination penalties that fall outside the defined switching charge.

A non-emergency request qualifies only if the exceptional need is limited in time and scope and concerns non-personal data. The requesting body must be acting under Union or national law and must identify specific data whose absence prevents it from fulfilling a specific task carried out in the public interest and explicitly provided for by law. Mitigation of or recovery from a public emergency and production of official statistics are examples in Article 15(1)(b), but the legal and exhaustion tests still apply.

The requesting body must also show that it has exhausted other means to obtain the data. The Data Act lists examples such as trying to buy non-personal data on the market at market rates, relying on existing obligations to make data available, or adopting new legislative measures that could guarantee timely availability. This is not a general evidence-gathering power for convenient or recurring data needs.