--- title: "EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates" canonical_url: "https://www.sorena.io/artifacts/eu/data-act/faq" source_url: "https://www.sorena.io/artifacts/eu/data-act/faq/items/page/28" author: "Sorena AI" description: "EU Data Act FAQ index covering connected-product access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, and application dates." published_at: "2026-05-06" updated_at: "2026-07-25" keywords: - "EU Data Act FAQ" - "Data Act scope" - "connected product data" - "B2G data sharing" - "cloud switching" - "GDPR Data Act" - "EU Data Act" - "Data Act FAQ" - "Regulation (EU) 2023/2854" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates EU Data Act FAQ index covering connected-product access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, and application dates. *FAQ* *EU* *Data Act* ## EU Data Act FAQ hub Answers to the recurring EU Data Act questions that decide whether connected-product data, related-service data, B2G requests, cloud contracts, or smart-contract tooling need a compliance review. This index helps orient product, legal, cloud, procurement, data protection, security, and public-sector request teams before opening the deeper topic modules. The Data Act, Regulation (EU) 2023/2854, has applied generally since 12 September 2025. It gives qualifying users access to readily available data from connected products and related services, sets terms for mandatory business-to-business data sharing, creates a narrow public-sector exceptional-need route, and regulates switching between data processing services. It also addresses unfair contract terms, unlawful third-country government access to non-personal data, interoperability, and smart contracts. GDPR and sector-specific EU rules continue to apply alongside it. ## Definitions ### EU Data Act **Term:** Data Act The Data Act is Regulation (EU) 2023/2854, a directly applicable EU regulation on access to and use of data. It covers connected-product and related-service data, legally required business-to-business data sharing, exceptional public-sector requests, switching between data processing services, unfair data-contract terms, interoperability, and smart contracts. **Why it matters here:** The applicable chapter depends on the actor, data, product or service, and transaction. The regulation has applied generally since 12 September 2025, but several duties have separate transition rules. Sources: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) ## Browse sub-FAQ modules ### [Data Act and Data Governance Act Overlap FAQ](/artifacts/eu/data-act/faq/data-governance-act-overlap.md) FAQ explaining where the EU Data Act and Data Governance Act overlap, how they differ, and how to route product, cloud, public-sector reuse, intermediary, and data altruism workflows. - 12 items ### [Data Act Audit Evidence and Request Logs FAQ](/artifacts/eu/data-act/faq/audit-evidence-and-request-logs.md) FAQ for Data Act request logs covering user and third-party access, B2G exceptional need requests, cloud switching records, contract terms, trade secrets, and GDPR boundaries. - 12 items ### [Data Act Cloud Switching Contract Terms FAQ](/artifacts/eu/data-act/faq/cloud-switching-contract-terms.md) FAQ on EU Data Act cloud switching contract terms: Article 25 clauses, assistance, notice, transition, charges, export, termination, interoperability, and records. - 12 items ### [Data Act Cloud Switching Fees and Deadlines FAQ](/artifacts/eu/data-act/faq/cloud-switching-fees-and-deadlines.md) FAQ on EU Data Act cloud switching charges, 2027 fee removal, notice periods, transition windows, data retrieval, contract terms, and evidence records. - 12 items ### [Data Act Complaints and Dispute Settlement FAQ](/artifacts/eu/data-act/faq/complaints-and-dispute-settlement.md) FAQ on EU Data Act complaints, competent authorities, dispute settlement bodies, B2B data-sharing disputes, B2G requests, cloud switching disputes, and evidence records. - 12 items ### [Data Act Exportable Data and Metadata FAQ](/artifacts/eu/data-act/faq/exportable-data-and-metadata.md) FAQ explaining which product, related service, metadata, and cloud switching data must be exportable under the EU Data Act, and which data can be excluded. - 12 items ### [Data Act FAQ for Aftermarket Repair and Mobility Services](/artifacts/eu/data-act/faq/aftermarket-repair-and-mobility-services.md) FAQ on EU Data Act vehicle-data access for repairers, independent service providers, fleets, insurers, and mobility services. - 12 items ### [Data Act SME Exceptions and Startups FAQ](/artifacts/eu/data-act/faq/sme-exceptions-and-startups.md) FAQ on where the EU Data Act gives micro, small, medium-sized, startup, and SME actors narrower treatment for access duties, compensation, and B2B terms. - 12 items ### [Data Act Trade Secret Technical Protection Measures FAQ](/artifacts/eu/data-act/faq/trade-secret-technical-protection-measures.md) FAQ on how EU Data Act data holders can protect trade secrets with confidentiality safeguards, technical measures, limited withholding, suspension, refusal, and evidence. - 12 items ### [EU Data Act and Common European Data Spaces FAQ](/artifacts/eu/data-act/faq/data-act-and-common-european-data-spaces.md) FAQ on how EU Data Act interoperability duties, Data Governance Act rules, and sector data-space governance fit together without treating participation as a general obligation. - 12 items ### [EU Data Act and GDPR: Personal Data Overlap FAQ](/artifacts/eu/data-act/faq/gdpr-personal-data-overlap.md) FAQ on how the EU Data Act works when connected-product or related-service data includes personal data, mixed datasets, GDPR roles, lawful basis, trade secrets, and third-party sharing. - 12 items ### [EU Data Act Application Dates and Transition FAQ](/artifacts/eu/data-act/faq/application-dates-and-transition.md) FAQ on when the EU Data Act applies, which obligations are delayed, and what product, contract, cloud, and evidence records teams should maintain. - 12 items ### [EU Data Act Article 32: Foreign Government Access FAQ](/artifacts/eu/data-act/faq/international-government-access.md) FAQ on EU Data Act safeguards for non-EU government access to non-personal data held in the Union by data processing service providers. - 12 items ### [EU Data Act Article 36 Smart Contract Controls FAQ](/artifacts/eu/data-act/faq/article-36-smart-contract-controls.md) FAQ explaining when EU Data Act Article 36 applies to smart contracts for data-sharing agreements and what controls, conformity evidence, and limits it requires. - 12 items ### [EU Data Act B2B Data Sharing Compensation FAQ](/artifacts/eu/data-act/faq/compensation-for-b2b-data-sharing.md) FAQ on when Data Act data holders may charge B2B data recipients, what reasonable compensation can include, SME limits, unfair terms, disputes, and trade secret safeguards. - 12 items ### [EU Data Act B2G Compensation and Costs FAQ](/artifacts/eu/data-act/faq/b2g-compensation-and-costs.md) FAQ on when Data Act B2G exceptional-need requests are free, when fair compensation may be claimed, which costs can be included, and what records to keep. - 12 items ### [EU Data Act B2G Exceptional Need FAQ](/artifacts/eu/data-act/faq/b2g-exceptional-need.md) When public-sector bodies can request business-held data under the EU Data Act, what a valid request must contain, and how data holders handle limits, trade secrets, compensation, and evidence. - 13 items ### [EU Data Act Cloud Switching Procurement FAQ](/artifacts/eu/data-act/faq/cloud-switching-procurement-checklist.md) Procurement checklist FAQ for EU Data Act cloud switching: contract terms, exit support, exportable data, switching charges, interoperability, termination, and supplier evidence. - 12 items ### [EU Data Act Connected Product Scope FAQ](/artifacts/eu/data-act/faq/scope-connected-products.md) FAQ explaining when connected products, related services, generated data, EU market placement, and SME exceptions fall within EU Data Act scope. - 12 items ### [EU Data Act data spaces interoperability FAQ](/artifacts/eu/data-act/faq/data-spaces-interoperability.md) FAQ explaining Article 33 Data Act interoperability requirements for data-space participants, common European data spaces, standards, APIs, metadata, and architecture evidence. - 12 items ### [EU Data Act Direct Access by Design FAQ](/artifacts/eu/data-act/faq/direct-access-by-design.md) FAQ for product and legal teams designing user access to connected-product and related-service data under the EU Data Act. - 12 items ### [EU Data Act Enforcement and Competent Authorities FAQ](/artifacts/eu/data-act/faq/enforcement-and-competent-authorities.md) FAQ on who enforces the EU Data Act, how complaints work, how Member States set penalties, when dispute settlement can be used, and when GDPR authorities remain responsible. - 13 items ### [EU Data Act Functional Equivalence: IaaS Switching FAQ](/artifacts/eu/data-act/faq/functional-equivalence.md) FAQ on Data Act functional equivalence for cloud switching: IaaS scope, customer outcomes, export support, interoperability duties, limits, and evidence. - 12 items ### [EU Data Act Indirect Access Request Workflow FAQ](/artifacts/eu/data-act/faq/indirect-access-request-flows.md) FAQ for Data Act teams handling user and third-party data requests when direct connected-product access is unavailable, incomplete, or limited. - 12 items ### [EU Data Act Interoperability Standards: Articles 33-36](/artifacts/eu/data-act/faq/interoperability-standards.md) FAQ on EU Data Act interoperability standards for data spaces, cloud switching, smart contracts, harmonised standards, common specifications, and M/614. - 12 items ### [EU Data Act Model Terms and Cloud Clauses FAQ](/artifacts/eu/data-act/faq/model-contractual-terms.md) FAQ on the EU Data Act non-binding model contractual terms for data access and use, cloud switching clauses, B2B use, unfair terms, and evidence. - 12 items ### [EU Data Act Non-Emergency Public-Sector Request FAQ](/artifacts/eu/data-act/faq/non-emergency-public-sector-requests.md) FAQ on EU Data Act requests where a public body claims exceptional need outside a public emergency, including scope, request contents, limits, compensation, confidentiality, and evidence. - 12 items ### [EU Data Act Pre-Contractual Information FAQ](/artifacts/eu/data-act/faq/pre-contractual-information.md) FAQ on EU Data Act Article 3 pre-contract information for connected products and related services, including data categories, access methods, data holder identity, third-party sharing, and GDPR boundaries. - 12 items ### [EU Data Act Product Data vs Related-Service Data](/artifacts/eu/data-act/faq/product-data-and-service-data.md) FAQ explaining how the EU Data Act separates connected product data, related service data, readily available raw and pre-processed data, metadata, and inferred or derived outputs. - 12 items ### [EU Data Act Public Emergency Request FAQ](/artifacts/eu/data-act/faq/public-emergency-requests.md) FAQ on EU Data Act public emergency requests: exceptional need, request content, timing, data holder response, compensation, confidentiality, and records. - 12 items ### [EU Data Act Readily Available Data FAQ](/artifacts/eu/data-act/faq/readily-available-data.md) FAQ on what counts as readily available data under the EU Data Act, including product data, related service data, metadata, inferred data, and access mechanics. - 12 items ### [EU Data Act Related Services FAQ](/artifacts/eu/data-act/faq/related-services.md) FAQ explaining when software is a Data Act related service, how it links to connected products, which product and service data are in scope, and what exclusions apply. - 12 items ### [EU Data Act Smart Contracts for Data Sharing FAQ](/artifacts/eu/data-act/faq/smart-contracts-for-data-sharing.md) Answers on Article 36 Data Act smart-contract requirements for data sharing: scope, robustness, access control, termination, archiving, conformity assessment, contract terms, and standards status. - 12 items ### [EU Data Act Third-Party Data Sharing FAQ](/artifacts/eu/data-act/faq/third-party-data-sharing.md) FAQ on user-directed third-party data sharing under the EU Data Act, covering data holder duties, recipient limits, trade secrets, security, GDPR, and gatekeepers. - 12 items ### [EU Data Act Trade Secret Safeguards FAQ](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md) FAQ on protecting trade secrets when handling EU Data Act user and third-party data access requests, including safeguards, withholding, suspension, refusal, notices, and records. - 12 items ### [EU Data Act Unfair Contractual Terms FAQ](/artifacts/eu/data-act/faq/unfair-contractual-terms.md) FAQ on Article 13 of the EU Data Act: B2B unfair contract terms, unilateral take-it-or-leave-it clauses, always-unfair terms, presumed-unfair terms, SMEs, model terms, and review evidence. - 12 items ### [EU Data Act Users, Data Holders, and Recipients FAQ](/artifacts/eu/data-act/faq/users-data-holders-and-recipients.md) FAQ explaining Data Act users, data holders, data recipients, connected products, related services, user access, third-party limits, and GDPR boundaries. - 12 items ### [EU Data Act Vehicle Data Guidance FAQ](/artifacts/eu/data-act/faq/vehicle-data-guidance.md) FAQ on EU Data Act vehicle data guidance for connected vehicles, aftermarket repair, mobility services, third-party access, trade secrets, security, and GDPR boundaries. - 12 items ### [EU Data Act: Non-Personal Data and Mixed Datasets](/artifacts/eu/data-act/faq/non-personal-data-and-mixed-datasets.md) FAQ on how the EU Data Act treats non-personal data, mixed datasets, GDPR precedence, user and third-party access, trade-secret limits, and evidence records. - 12 items Browse all indexed questions: [/artifacts/eu/data-act/faq/items](/artifacts/eu/data-act/faq/items.md) ## All FAQ items *Page 28 of 32. Showing 15 of 470 items.* ### [How does the GDPR affect third-party sharing?](/artifacts/eu/data-act/faq/third-party-data-sharing.md#how-does-the-gdpr-affect-third-party-sharing) *Module: [EU Data Act Third-Party Data Sharing](/artifacts/eu/data-act/faq/third-party-data-sharing.md)* The Data Act does not supersede GDPR. It complements Union data-protection and privacy law and does not create a new legal basis for providing access to personal data where the user is not the data subject. If personal data generated by a connected product or related service is to be made available to a third party and the user is not the data subject, the data holder needs a valid Article 6 GDPR legal basis and, where relevant, conditions for special-category data and ePrivacy terminal-equipment rules. - Classify whether the requested dataset contains personal data and whether the user is the data subject. - Document the GDPR legal basis before sharing personal data with the third party. - Use anonymisation, pseudonymisation, or data separation where needed, but do not use privacy measures as a pretext to avoid Article 5 when the data remains readily available. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Recital 7 and Article 5 explain that the Data Act is without prejudice to data-protection law and does not itself create a GDPR legal basis where the user is not the data subject. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ explains GDPR portability overlap and how anonymisation, pseudonymisation, and privacy-enhancing technologies interact with Data Act access requests. ### [Can the data holder charge for third-party sharing under the Data Act?](/artifacts/eu/data-act/faq/third-party-data-sharing.md#can-the-data-holder-charge-for-third-party-sharing-under-the-data-act) *Module: [EU Data Act Third-Party Data Sharing](/artifacts/eu/data-act/faq/third-party-data-sharing.md)* Article 5 says the data must be made available to the third party free of charge to the user. Separately, Article 9 allows reasonable and non-discriminatory compensation agreed between a data holder and a data recipient in business-to-business relations, and says compensation may include a margin. - Do not charge the user for Article 5 third-party sharing. - If charging a data recipient, keep compensation reasonable, non-discriminatory, and documented. - Apply the Article 9 cost-only cap where the recipient is an eligible SME or not-for-profit research organisation. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Articles 5 and 9 support free-of-charge sharing to the user, reasonable recipient compensation, SME and research-organisation caps, and calculation transparency. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview explains reasonable compensation and cost limits for micro companies, SMEs, and not-for-profit research organisations. ### [What practical workflow should teams follow for a third-party sharing request under the Data Act?](/artifacts/eu/data-act/faq/third-party-data-sharing.md#what-practical-workflow-should-teams-follow-for-a-third-party-sharing-request-under-the-data-act) *Module: [EU Data Act Third-Party Data Sharing](/artifacts/eu/data-act/faq/third-party-data-sharing.md)* Use a simple sequence: first confirm the request comes from the user or someone acting on the user's behalf, then confirm the recipient is eligible, then check the data scope and any GDPR issues. If the request is valid, make the data available without undue delay and in the required format. If trade secrets or security concerns apply, use the Article 5 or Article 4 safeguards, and if the issue cannot be resolved, withhold, suspend, or refuse only within the conditions in the Data Act. - Intake: verify user authority, recipient eligibility, and the specific request. - Review: check scope, GDPR, trade secrets, and security limits before releasing data. - Action: share, or if the legal test is not met, withhold, suspend, or refuse and document why. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Articles 3, 5, 6, 8, and 9 provide the request, eligibility, use, trade-secret, security, and compensation steps. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview supports a practical request workflow from user request to sharing, suspension, or refusal. ### [What records should teams keep for a third-party sharing request under the Data Act?](/artifacts/eu/data-act/faq/third-party-data-sharing.md#what-records-should-teams-keep-for-a-third-party-sharing-request-under-the-data-act) *Module: [EU Data Act Third-Party Data Sharing](/artifacts/eu/data-act/faq/third-party-data-sharing.md)* Keep a request record that shows the user authority, recipient identity and eligibility, requested data categories, personal-data assessment, trade-secret and security assessment, recipient purpose, delivery route, delivery format, compensation position if any, and final outcome. These records should be enough to explain why data was shared, limited, suspended, withheld, or refused. - Log the Article 5 request, verification facts, data scope, and recipient commitments. - Keep written substantiation for trade-secret withholding, suspension, or refusal and any competent-authority notice. - Record misuse response steps if a recipient uses deceptive means, unauthorised purposes, unlawful onward disclosure, or removes agreed protection measures. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Articles 5, 6, 8, 9, and 11 ground request evidence, recipient terms, misuse remedies, and trade-secret escalation records. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview summarizes remedies for unlawful access or use by third parties or users. ### [How should teams assign ownership for Data Act third-party sharing implementation work?](/artifacts/eu/data-act/faq/third-party-data-sharing.md#how-should-teams-assign-ownership-for-data-act-third-party-sharing-implementation-work) *Module: [EU Data Act Third-Party Data Sharing](/artifacts/eu/data-act/faq/third-party-data-sharing.md)* Assign one accountable owner for the Data Act request workflow, with clear support from legal, privacy, security, product, and operations as needed. The owner should be the person who can actually change the affected process and decide whether the request is fulfilled, limited, suspended, or refused. - Name one accountable owner for each sharing request workflow. - Track legal, privacy, security, product, and operations inputs as consults, not as duplicate owners. - Store the approval, refusal, or suspension rationale with the request record. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Binding source for Article 5 user-requested third-party sharing, Article 6 recipient duties, Article 8 terms, Article 9 compensation, Article 11 remedies, safeguards, the gatekeeper exclusion, and application from 12 September 2025. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission explainer for connected-product and related-service data scope, user and data-holder roles, third-party sharing, GDPR overlap, trade-secret limits, security limits, compensation context, and gatekeeper exclusion. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ support for user definitions, data holder roles, related services, GDPR portability overlap, readily available data, and privacy-enhancing technology boundaries. - [European Commission - EU Data Act gives users control over data from connected devices](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2078?ref=sorena.io) - Commission press source confirming the user-control framing for connected-device data and implementation support on trade secrets, data sharing model terms, and cloud clauses. ### [Does the EU Data Act let data holders protect trade secrets during data access and sharing?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#does-the-eu-data-act-let-data-holders-protect-trade-secrets-during-data-access-and-sharing) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Yes. The Data Act says trade secrets must be preserved when product data or related-service data is disclosed to a user or to a third party chosen by the user. The data holder, or the trade secret holder if different, must identify the protected data before disclosure, including in relevant metadata where needed. - Identify the specific fields, records, metadata, or outputs that are claimed to contain trade secrets. - Separate trade-secret material from data that can be shared without special confidentiality controls. - Record whether the request is a user-access request under Article 4 or a third-party sharing request under Article 5, because the recipient obligations differ. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Article 4(6), Article 5(9), and Recital 31 support identifying trade secrets and preserving confidentiality before disclosure. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Question 23 explains that a trade-secret claim alone does not block the Data Act access right. ### [What safeguards should be agreed with users before trade-secret data is disclosed under Article 4 under the Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#what-safeguards-should-be-agreed-with-users-before-trade-secret-data-is-disclosed-under-article-4-under-the-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Before disclosure to a user, the data holder and user must take necessary measures to preserve confidentiality, especially where third parties may later be involved. The Data Act gives examples: model contractual terms, confidentiality agreements, strict access protocols, technical standards, and codes of conduct. - Define the data covered by the safeguard and the permitted purpose for the user. - State the confidentiality duties, access controls, onward-sharing limits, and incident or misuse reporting route. - Keep evidence that the user accepted and implemented the safeguards before disclosure. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Article 4(6) lists proportionate technical and organisational measures for preserving trade-secret confidentiality with users. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Question 23 gives practical safeguard examples before data sharing, including confidentiality agreements and access protocols. ### [How should teams document EU Data Act trade-secret safeguards, ownership, and evidence for later review?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#how-should-teams-document-eu-data-act-trade-secret-safeguards-ownership-and-evidence-for-later-review) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Keep a short decision record that ties the request to the specific Data Act article, the trade-secret holder, the agreed safeguard package, and the person who approved the decision. That record should also show the request date, the data category, and whether the outcome was disclosure, withholding, suspension, or refusal. - Store the source clause, decision date, approver, and affected data category in one file. - Keep the recipient notice, competent-authority notification, and non-confidential explanation with the supporting evidence. - Update the record if the safeguard package or the responsible owner changes. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Articles 4 and 5 support records for trade-secret identification, agreed safeguards, written substantiation, and competent-authority notifications. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Question 23 supports maintaining evidence for identification, safeguard agreement, withholding, suspension, refusal, and challenge handling. ### [What is the common mistake to avoid when using trade-secret safeguards under the EU Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#what-is-the-common-mistake-to-avoid-when-using-trade-secret-safeguards-under-the-eu-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* The main mistake is treating trade-secret status as a broad reason to block or delay a Data Act request. The safer operational approach is to identify the specific trade-secret data, agree proportionate safeguards, share the remaining data where possible, and reserve withholding, suspension, or refusal for the limited conditions in the Data Act. - Avoid blanket refusals based only on the phrase trade secret or confidential business information. - Avoid asking users or third parties for more information than is necessary to verify whether they qualify as a user or third party. - Avoid publishing recipient-facing explanations that disclose the trade secret while trying to justify the safeguard. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Recital 31 and Articles 4 and 5 show that trade-secret safeguards must preserve confidentiality without subverting Data Act access rights. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Question 23 explains the balance between preventing illegitimate restrictions and upholding trade-secret protection. ### [How should a data holder identify the exact trade-secret fields it wants protected under the EU Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#how-should-a-data-holder-identify-the-exact-trade-secret-fields-it-wants-protected-under-the-eu-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* The Data Act expects identification before disclosure rather than a vague claim afterwards, so the holder, or the trade-secret holder where they differ, should map the precise fields, calculated values, calibration parameters, or metadata that reveal the secret. Identification at this granularity is what later justifies a proportionate safeguard rather than a broad refusal. - Tag the specific columns, signals, or derived outputs that disclose a formula, method, or model feature. - Keep the identification list with the request so a later reviewer can see what was protected and why. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Primary legal source for Articles 4 and 5 trade-secret identification, agreed safeguards, withholding or suspension when safeguards are not agreed, implemented, or maintained, the exceptional refusal threshold, challenge routes, and application from 12 September 2025. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ source for the trade-secret handbrake, including safeguard examples and the limits on withholding, suspension, and refusal. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview source for Data Act user access, third-party sharing, trade-secret protection, security limitations, competent-authority notices, and challenge routes. ### [When may a data holder suspend trade-secret data sharing after a confidentiality breach under the EU Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#when-may-a-data-holder-suspend-trade-secret-data-sharing-after-a-confidentiality-breach-under-the-eu-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Under the Data Act, suspension is available where a user or third party fails to implement the agreed confidentiality measures or breaches them, and it must be accompanied by written reasons to the recipient and a notification to the competent authority. It is a temporary, breach-driven response rather than a way to reverse the access right. - Record the specific safeguard that was not implemented or was breached before suspending. - Send written reasons and notify the competent authority without undue delay, then restore access on remediation. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Primary legal source for Articles 4 and 5 trade-secret identification, agreed safeguards, withholding or suspension when safeguards are not agreed, implemented, or maintained, the exceptional refusal threshold, challenge routes, and application from 12 September 2025. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ source for the trade-secret handbrake, including safeguard examples and the limits on withholding, suspension, and refusal. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview source for Data Act user access, third-party sharing, trade-secret protection, security limitations, competent-authority notices, and challenge routes. ### [What objective evidence supports refusing a trade-secret data request in exceptional cases under the EU Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#what-objective-evidence-supports-refusing-a-trade-secret-data-request-in-exceptional-cases-under-the-eu-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Under the Data Act, a data holder may refuse a specific request only in exceptional circumstances and only where it demonstrates with objective evidence that disclosure is highly likely to cause serious economic damage despite the agreed measures. The assessment is per request, not a standing policy across all telemetry. - Scope any refusal to the precise fields that would cause serious economic damage if disclosed. - Assess the objective factors named by the Data Act: enforceability of trade-secret protection in relevant third countries, the nature and level of confidentiality of the requested data, and the connected product's uniqueness and novelty. - Keep case-specific evidence, give the recipient the duly substantiated written decision without undue delay, and notify the competent authority while preserving the challenge route. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Primary legal source for Articles 4 and 5 trade-secret identification, agreed safeguards, withholding or suspension when safeguards are not agreed, implemented, or maintained, the exceptional refusal threshold, challenge routes, and application from 12 September 2025. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ source for the trade-secret handbrake, including safeguard examples and the limits on withholding, suspension, and refusal. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview source for Data Act user access, third-party sharing, trade-secret protection, security limitations, competent-authority notices, and challenge routes. ### [How do trade-secret safeguards bind a third party that receives shared data under the EU Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#how-do-trade-secret-safeguards-bind-a-third-party-that-receives-shared-data-under-the-eu-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Under the Data Act, when a user directs sharing to a third party under Article 5, the confidentiality undertakings, access controls, and onward-disclosure limits should bind that recipient too, and Article 6 restricts the third party from using the data to build a competing connected product. Safeguards agreed for user access should carry through to the third-party path. - Extend the same confidentiality controls into the third-party contract, not only the user-facing route. - Bind the recipient to Article 6 use and onward-sharing restrictions before any disclosure. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Primary legal source for Articles 4 and 5 trade-secret identification, agreed safeguards, withholding or suspension when safeguards are not agreed, implemented, or maintained, the exceptional refusal threshold, challenge routes, and application from 12 September 2025. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ source for the trade-secret handbrake, including safeguard examples and the limits on withholding, suspension, and refusal. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview source for Data Act user access, third-party sharing, trade-secret protection, security limitations, competent-authority notices, and challenge routes. ### [How should teams keep trade-secret safeguards proportionate rather than over-restrictive under the EU Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#how-should-teams-keep-trade-secret-safeguards-proportionate-rather-than-over-restrictive-under-the-eu-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Under the Data Act, technical and organisational measures must be necessary and proportionate, so the right safeguard is the least restrictive control that still protects the identified secret. A measure that blocks the whole access route, or is far broader than the risk, can itself breach the prohibition on hindering Data Act rights. - Match each control to a specific protected element rather than the entire export or interface. - Prefer scoped, reversible controls over measures that make the access right impractical. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Primary legal source for Articles 4 and 5 trade-secret identification, agreed safeguards, withholding or suspension when safeguards are not agreed, implemented, or maintained, the exceptional refusal threshold, challenge routes, and application from 12 September 2025. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ source for the trade-secret handbrake, including safeguard examples and the limits on withholding, suspension, and refusal. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview source for Data Act user access, third-party sharing, trade-secret protection, security limitations, competent-authority notices, and challenge routes. ### [How do trade-secret safeguards interact with personal data and the GDPR under the EU Data Act?](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md#how-do-trade-secret-safeguards-interact-with-personal-data-and-the-gdpr-under-the-eu-data-act) *Module: [EU Data Act Trade Secret Safeguards](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md)* Under the Data Act, trade-secret protection is a separate question from personal data protection, and the Regulation is without prejudice to the GDPR, so a confidentiality control that shields a secret does not remove the need for a valid legal basis where the same dataset includes personal data. Both analyses can apply to one export. - Classify each field for both trade-secret sensitivity and personal data content before disclosure. - Apply a GDPR basis and minimisation to personal data even when confidentiality controls are in place. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Primary legal source for Articles 4 and 5 trade-secret identification, agreed safeguards, withholding or suspension when safeguards are not agreed, implemented, or maintained, the exceptional refusal threshold, challenge routes, and application from 12 September 2025. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ source for the trade-secret handbrake, including safeguard examples and the limits on withholding, suspension, and refusal. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview source for Data Act user access, third-party sharing, trade-secret protection, security limitations, competent-authority notices, and challenge routes. ## FAQ Pagination - Canonical index (page 1): [/artifacts/eu/data-act/faq/items](/artifacts/eu/data-act/faq/items.md) - Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL. - Current page: 28 of 32 Pages: [1](/artifacts/eu/data-act/faq/items.md) | [2](/artifacts/eu/data-act/faq/items/page/2.md) | [3](/artifacts/eu/data-act/faq/items/page/3.md) | [4](/artifacts/eu/data-act/faq/items/page/4.md) | [5](/artifacts/eu/data-act/faq/items/page/5.md) | [6](/artifacts/eu/data-act/faq/items/page/6.md) | [7](/artifacts/eu/data-act/faq/items/page/7.md) | [8](/artifacts/eu/data-act/faq/items/page/8.md) | [9](/artifacts/eu/data-act/faq/items/page/9.md) | [10](/artifacts/eu/data-act/faq/items/page/10.md) | [11](/artifacts/eu/data-act/faq/items/page/11.md) | [12](/artifacts/eu/data-act/faq/items/page/12.md) | [13](/artifacts/eu/data-act/faq/items/page/13.md) | [14](/artifacts/eu/data-act/faq/items/page/14.md) | [15](/artifacts/eu/data-act/faq/items/page/15.md) | [16](/artifacts/eu/data-act/faq/items/page/16.md) | [17](/artifacts/eu/data-act/faq/items/page/17.md) | [18](/artifacts/eu/data-act/faq/items/page/18.md) | [19](/artifacts/eu/data-act/faq/items/page/19.md) | [20](/artifacts/eu/data-act/faq/items/page/20.md) | [21](/artifacts/eu/data-act/faq/items/page/21.md) | [22](/artifacts/eu/data-act/faq/items/page/22.md) | [23](/artifacts/eu/data-act/faq/items/page/23.md) | [24](/artifacts/eu/data-act/faq/items/page/24.md) | [25](/artifacts/eu/data-act/faq/items/page/25.md) | [26](/artifacts/eu/data-act/faq/items/page/26.md) | [27](/artifacts/eu/data-act/faq/items/page/27.md) | [28](/artifacts/eu/data-act/faq/items/page/28.md) | [29](/artifacts/eu/data-act/faq/items/page/29.md) | [30](/artifacts/eu/data-act/faq/items/page/30.md) | [31](/artifacts/eu/data-act/faq/items/page/31.md) | [32](/artifacts/eu/data-act/faq/items/page/32.md) [Previous page](/artifacts/eu/data-act/faq/items/page/27.md) | [Next page](/artifacts/eu/data-act/faq/items/page/29.md) *Recommended next step* *Placement: before sources* ## Turn a Data Act FAQ answer into a scoped review Review one product, dataset, cloud contract, public-sector request, or smart-contract deployment against the cited Data Act source and keep the scope, role, evidence, and unresolved questions together. - [Open Research Copilot](/solutions/research-copilot.md): Check Data Act scope, GDPR boundaries, cloud switching, and contract questions with cited source outputs. - [Talk through Data Act implementation](/contact.md): Review one connected product, data-sharing contract, cloud switch, or public-sector request before committing to an implementation path. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/data-act/faq/items/page/28.md