EU Data Act Users, Data Holders, and Recipients FAQ

A user is a natural or legal person that owns a connected product, has temporary contractual rights to use that connected product, or receives a related service. A company can be a user; a consumer can be a user; and more than one person can be a user of the same connected product when ownership, lease, rental, or service rights support that position.

Do not treat every end customer, passenger, employee, or account contact as a Data Act user. The Commission FAQ explains that the user needs a stable right over the connected product or the related service. A person merely benefiting from a broader service, such as transport, is not automatically a user of the connected product that provides that service.

The Chapter II role analysis applies to connected products and related services. A connected product obtains, generates, or collects data about its use or environment, can communicate product data electronically, physically, or through on-device access, and is not primarily a data storage, processing, or transmission service for someone other than the user.

A related service is a digital service, including software, that is connected with the product so that the product cannot perform one or more functions without it, or is later connected to add, update, or adapt product functions. The Commission FAQ points to bidirectional data exchange and an effect on the product's functions, behaviour, or operation as key practical indicators.

A data holder is the person or organisation that has the right or obligation under the Data Act, other EU law, or national law to use and make data available. For product and related-service data, the role turns on who can lawfully retrieve, generate, use, and make available the data, not simply on who made the hardware.

A manufacturer will often be a data holder, but the Commission FAQ says it is not always the data holder. A component supplier, related-service provider, or another contracted entity can be a data holder if it receives or controls access to readily available data and is identified in the contractual and pre-contractual setup. A person can also be a user for one product and a data holder for another, but not both for the same data in the same relationship.

Users can access readily available product data and related service data, together with the metadata needed to interpret and use it. Where the data is not directly accessible from the product or service, the data holder must make it available without undue delay, in the same quality available to the data holder, easily, securely, free of charge, and in a structured, commonly used, machine-readable format.

The Commission FAQ describes the core Chapter II data set as raw and pre-processed data that is readily available to the data holder as a result of technical design. Highly enriched, inferred, or derived data resulting from additional investments, proprietary complex algorithms, or substantial transformation is outside the mandatory Chapter II sharing obligation. Personal data can be in scope, but only subject to GDPR compliance.

Yes, if Article 5 applies. At the user's request, or at the request of a party acting on behalf of the user, the data holder must make readily available data and necessary metadata available to a third party under the Data Act conditions. This right exists even if the user also has direct access, provided there is a data holder with readily available data.

A third party receiving data under Article 5 is a data recipient for that transaction, but not the user. The third party must be acting for purposes related to its trade, business, craft, or profession and must be in the Union for the Chapter II mandatory sharing obligation to apply. Digital Markets Act gatekeepers are not eligible third parties for this mandatory IoT data-sharing mechanism.

A third party receiving data at the user's request may use the data only for the purposes and under the conditions agreed with the user, subject to personal-data law where personal data is involved. It must erase the data when no longer necessary for the agreed purpose unless the user has agreed otherwise for non-personal data.

Article 6 also sets explicit prohibitions. A recipient must not manipulate the user's choices, use the data for profiling unless necessary for the service requested by the user, pass the data onward except under the Article 6 conditions, give the data to a DMA gatekeeper, develop a competing connected product, undermine product security, disregard trade-secret measures, or prevent a consumer from sharing received data with other parties.

Data holders should make the request process easy, secure, non-discriminatory, and limited to necessary verification. They must not make user choices unduly difficult, require unnecessary information to verify a user or third party, or keep access logs beyond what is needed for request execution and infrastructure security and maintenance.

Data holders can protect legitimate interests, but the safeguards are not blanket refusal rights. The Data Act allows security restrictions where lawful security requirements could be undermined with serious adverse effects; it also allows trade-secret measures, withholding, suspension, or exceptional refusal only under the specific Article 4 and 5 conditions. Technical protection measures such as encryption or smart contracts must not discriminate between recipients or hinder Data Act access rights.

The Data Act covers personal and non-personal data, but it does not supersede the GDPR. Article 1(5) says EU and national personal-data and privacy law continue to apply, and those rules prevail in a conflict. The Commission FAQ states that the GDPR is fully applicable to personal-data processing under the Data Act.

If the user is the data subject, Data Act access and sharing complement GDPR access and portability rights. If the user is not the data subject whose personal data is requested, the data holder may make the personal data available to the user or third party only where there is a valid GDPR legal basis and, where relevant, Article 9 GDPR and ePrivacy conditions are met. Data holders and recipients should therefore classify personal data, identify controller roles, and keep the GDPR legal-basis analysis separate from the Data Act role analysis.

Keep a short decision note that links the role analysis to the relevant Data Act article or Commission FAQ, the product or service in scope, the user type, the data holder, any third party or recipient involved, and the date of the decision. That gives later reviewers enough context to see why the team treated a person as a user, a party as a data holder, or a recipient as a third party.

The note should also capture the request path, contract or account reference, the data categories involved, and any GDPR or trade-secret issue that changed the answer.

Assign one accountable owner who can change the product, contract, support, procurement, or privacy process that the role decision affects. For most teams, that is legal, privacy, product, or compliance, depending on which workflow actually controls the Data Act response.

If multiple teams are involved, keep one owner and list the consulted teams separately so the record stays easy to update when the product or service changes.

Review the Data Act decision whenever the product, service, contract, access method, or data-sharing pathway changes. A new related service, a new user type, a new data holder, or a new third-party recipient can change the answer even if the product itself stays the same.

It is also worth reviewing the decision after any GDPR, security, trade-secret, or contract update, because those changes can affect what data can be made available and to whom.