Search every question across sub-FAQs

Under the Data Act, a user or third party that disputes a withholding, suspension, or refusal can take the matter to a competent authority, use the dispute settlement procedure, or seek a judicial remedy, which is why the holder must give written reasons and notify the authority. The safeguard decision has to stand up to that review.

Because the recipient can challenge the decision, the holder should keep the identification list, the agreed measures, and the evidence together so the reasoning can be reconstructed if the decision is questioned.

Under the Data Act, the safeguard package should be reviewed whenever the protected data, the access path, the recipient, or the available controls change, because each can shift the proportionality balance. A new firmware build, a new export field, or a new third-party recipient can each move the risk picture.

Reviews should also be triggered by a confidentiality incident, a complaint, or a dispute settlement outcome, since each can change what counts as a necessary and proportionate measure for that data.

Article 13 protects one enterprise from unfair data-related contract terms unilaterally imposed by another enterprise. The rule covers terms about access to and use of data, and terms about liability and remedies for breach or termination of data-related obligations.

If the term is unfair under Article 13, it is not binding on the enterprise on which it was imposed. The rest of the contract can still bind the parties if the unfair term can be severed from the remaining terms.

A term that reflects mandatory Union-law provisions, or Union-law provisions that would apply if the contract did not regulate the issue, is not unfair under Article 13. Parties also cannot contract out of Article 13, derogate from it, or vary its effects.

A term is treated as unilaterally imposed when one contracting party supplied it and the other party could not influence its content despite trying to negotiate it. This is the practical issue behind take-it-or-leave-it data access and data use clauses.

The party that supplied the contested term bears the burden of proving that it was not unilaterally imposed. The same party cannot use Article 13 to argue that its own supplied term is unfair.

The general test is whether the term grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing. That test matters for terms not already captured by the Article 13 always-unfair or presumed-unfair examples.

A practical review should compare the clause against the Data Act purpose of fair data access and use, the parties' bargaining position, the data involved, the impact on legitimate interests, and the remedies available if obligations are not performed.

Article 13 lists three types of terms that are unfair where their object or effect matches the list. These are the closest equivalent to a black-list review for B2B data contracts.

The always-unfair examples cover terms that exclude or limit the imposing party's liability for intentional acts or gross negligence, remove remedies for the enterprise on which the term was imposed, or give the imposing party the exclusive right to decide data conformity or interpret the contract.

Article 13 also lists terms presumed unfair. The party that imposed one of these terms may try to show that it is not unfair.

The presumed-unfair group includes inappropriate limits on remedies or liability, harmful access to or use of the other party's data, preventing the other party from using data it provided or generated, blocking termination within a reasonable period, blocking a copy of provided or generated data, termination at unreasonably short notice, or substantial unilateral changes to price or data-sharing conditions without a valid reason and termination right.

Article 13 does not apply to terms defining the main subject matter of the contract or to the adequacy of the price as against the data supplied in exchange. Record that exclusion before treating a pricing or core-scope clause as an Article 13 unfair term.

The exclusion is narrow in practice. A price number or core data-sharing description may sit beside other reviewable terms, such as unilateral changes to price, format, quality, quantity, termination, remedies, or copy rights.

The Data Act applies from 12 September 2025, and Chapter IV applies to contracts concluded after 12 September 2025. Older contracts concluded on or before 12 September 2025 enter Chapter IV from 12 September 2027 only if they are of indefinite duration or are due to expire at least 10 years from 11 January 2024.

For contract operations, keep a contract population view that separates new contracts, renewals or amendments, indefinite-duration contracts, and very long-running older contracts. Do not apply the older-contract rule to every legacy agreement without checking the duration criteria.

Chapter IV protects enterprises of every size, with particular relevance for SMEs facing stronger bargaining positions in data-sharing negotiations. Article 13 applies when another enterprise unilaterally imposes a covered unfair term.

SME status is still operationally important. The Commission says the model contractual terms were developed to help parties, especially SMEs, implement the Data Act, and the Data Act explainer highlights Chapter IV as a tool against stronger parties imposing non-negotiable data access and use terms.

The Commission model contractual terms are voluntary tools, not a replacement for Article 13. They can help draft Data Act data-sharing contracts and benchmark whether a clause structure is aligned with fair, reasonable, and non-discriminatory rights and obligations.

The Commission source says the model contractual terms for Data Act data sharing are compliant with Chapter IV on unfair contract terms. Teams should still adapt them to the actual data-sharing relationship and keep a clause-by-clause rationale when changing them.

Keep enough evidence to show the clause text, who supplied it, whether the other party tried to negotiate it, the data-related obligation affected, the Article 13 category considered, and the final outcome. The record should let a later reviewer distinguish a negotiated clause from a unilateral template clause.

For practical contract review, use a matrix with fields for clause location, data type or dataset, contract relationship, Article 13 category, always-unfair or presumed-unfair flag, negotiation evidence, fallback wording, approver, and date. Add model-term comparison where the Commission wording was used or intentionally changed.

Keep the legal basis and the decision trail together. For Article 13 work, the record should cite the Data Act source clause, the specific Article 13 paragraph used, the Commission guidance or model-term reference relied on, and the contract version that was reviewed. That makes it clear why a term was treated as unilaterally imposed, always unfair, presumed unfair, or outside the scope of Article 13.

Teams should also retain the implementation artifact that shows how the decision was applied in practice, such as the redlined contract, review memo, approved template, or deviation note.

Assign one accountable owner who can change the contract or workflow affected by Article 13. For a Data Act unfair-terms review, that is usually the legal or commercial lead for the contract, with procurement, product, cloud, support, or security teams consulted where their process is affected.

For implementation, ownership should track the action: one owner for template updates, one owner for contract review approvals, and one owner for operational follow-up on the workflow or system that uses the clause. That avoids a generic checklist and makes the decision executable.

A user is a natural or legal person that owns a connected product, has temporary contractual rights to use that connected product, or receives a related service. A company can be a user; a consumer can be a user; and more than one person can be a user of the same connected product when ownership, lease, rental, or service rights support that position.

Do not treat every end customer, passenger, employee, or account contact as a Data Act user. The Commission FAQ explains that the user needs a stable right over the connected product or the related service. A person merely benefiting from a broader service, such as transport, is not automatically a user of the connected product that provides that service.