--- title: "Data Act Trade Secrets and Protection Measures" canonical_url: "https://www.sorena.io/artifacts/eu/data-act/trade-secrets-and-protection" source_url: "https://www.sorena.io/artifacts/eu/data-act/trade-secrets-and-protection" author: "Sorena AI" description: "Data Act guide for protecting trade secrets during access and sharing: classification, safeguards, refusal thresholds, notices, evidence records, and reviews." published_at: "2026-05-06" updated_at: "2026-05-06" keywords: - "EU Data Act" - "Regulation (EU) 2023/2854" - "trade secrets" - "confidentiality" - "technical protection measures" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # Data Act Trade Secrets and Protection Measures Data Act guide for protecting trade secrets during access and sharing: classification, safeguards, refusal thresholds, notices, evidence records, and reviews. *Artifact Guide* *EU* *Data Act* ## EU Data Act Trade Secrets and Protection Measures Protect trade secrets in Data Act access and sharing requests by identifying protected fields, agreeing proportionate safeguards, and reserving withholding or refusal for the narrow cases the regulation allows. Based on Regulation (EU) 2023/2854 and Commission materials for teams handling connected-product, related-service, B2B, and third-party data requests. The EU Data Act does not let a data holder treat every commercially sensitive dataset as off limits. It preserves trade secrets, but disclosure controls must be tied to identified protected data, agreed technical and organisational measures, written reasons, and the specific access path involved. ## Start with the Data Act access path and the protected trade secret data at stake Trade secret handling under the Data Act depends on who is asking and why. Article 4 covers access by the user of a connected product or related service. Article 5 covers sharing with a third party chosen by that user. Articles 8 and 9 then govern B2B conditions and compensation where a data holder is obliged to make data available to a data recipient. Before adding confidentiality controls, separate product data, related service data, and the metadata needed to interpret and use those data from inferred or derived information that is outside the Chapter II access obligation unless separately agreed. - Record whether the request is from the user, from a party acting on behalf of the user, or from a third-party data recipient. - Identify the data holder and, if different, the trade secret holder named in the pre-contractual or request materials. - Mark the exact fields or metadata claimed as trade secrets; do not label the whole feed if only part of it is protected. - Separate raw and pre-processed data from inferred or derived outputs before deciding what can be shared. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Defines product data, related service data, users, data holders, data recipients, trade secrets, and the Article 4 and Article 5 access paths. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Confirms the Chapter II access focus on raw and pre-processed data rather than every analytical output. - [Commission guidance on vehicle data - Official Journal](https://eur-lex.europa.eu/eli/C/2025/5026/oj/eng?ref=sorena.io) - Explains that in the vehicle context, access covers product and related service data plus necessary metadata, while inferred or derived information is out of scope. ## Agree the safeguards the Data Act expects before any trade secret disclosure Articles 4(6) and 5(9) preserve trade secrets, but they require practical measures before disclosure. The data holder or trade secret holder must identify the protected data, including relevant metadata, and agree proportionate technical and organisational measures with the user or third party. Useful safeguards are specific to the recipient and the data. A generic NDA can be part of the package, but the Data Act examples also point to strict access protocols, technical standards, model contractual terms, confidentiality agreements, and codes of conduct. - Use field-level classification, metadata labels, role-based access, secure delivery, logging, and retention limits where those controls fit the risk. - Write down what the recipient may do with the data, who may access it, whether subcontractors are allowed, and when copies must be erased. - For third-party sharing, disclose trade secrets only to the extent strictly necessary for the purpose agreed between the user and the third party. - For B2B arrangements, keep the access terms fair, reasonable, non-discriminatory, and transparent. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports the requirement to identify trade secret data and agree proportionate technical and organisational measures before disclosure. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Confirms that the Commission model contractual terms cover data access and use arrangements across data holders, users, and recipients. ## Limit withholding, suspension, and refusal to the Data Act thresholds The Data Act distinguishes three different positions. First, the data holder may withhold or suspend sharing of identified trade secret data if the necessary measures are not agreed, are not implemented, or confidentiality is undermined. Second, the data holder who is also the trade secret holder may refuse access only in exceptional circumstances. Third, security-based contractual restrictions under Article 4(2) are a separate route tied to serious adverse effects on health, safety, or security. A refusal based on trade secrets must be case-by-case and specific to the data in question. The data holder must be able to demonstrate that serious economic damage is highly likely despite the agreed measures, using objective elements such as enforceability of trade secret protection in third countries, confidentiality level, and the uniqueness and novelty of the connected product. - Provide the withholding, suspension, or refusal decision in writing and without undue delay to the user or third party. - Notify the Article 37 competent authority when withholding, suspending, or refusing under the trade secret provisions. - Identify which measures were not agreed or implemented, or which trade secrets had their confidentiality undermined. - Do not convert a trade secret concern into a blanket denial of all product or related service data. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports the limited grounds for withholding, suspension, and exceptional refusal under Articles 4 and 5, including written reasons and competent-authority notification. ## Use technical protection measures without blocking the lawful access the Data Act grants Article 11 allows appropriate technical protection measures, including smart contracts and encryption, to prevent unauthorised access to data and metadata and to enforce agreed terms. Those measures cannot discriminate between data recipients or hinder the user's Article 4 and Article 5 rights. The control design should therefore separate access enablement from misuse prevention. Encryption, access tokens, data rooms, signed logs, API scopes, watermarking, and smart-contract controls may help preserve confidentiality, but they should not make the Data Act request right practically unusable. - Configure controls to protect identified trade secret fields and metadata rather than suppressing unrelated data. - Keep verification data only as necessary for request execution and infrastructure security or maintenance. - Prohibit users, third parties, and data recipients from altering or removing technical protection measures unless the data holder agrees. - Maintain evidence that the same access conditions are applied to comparable recipients unless objective differences justify a different setup. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports use of Article 11 technical protection measures while preserving non-discriminatory access and user rights. ## Control what users and third parties may do with protected data under the Data Act Trade secret protection continues after delivery. Users may not use accessed data to develop a competing connected product or share the data with a third party for that intent, and they may not use the data to derive insights about the manufacturer's or data holder's economic situation, assets, or production methods. Third parties receiving data at the user's request face additional limits. They must process the data only for the agreed purposes and conditions, erase it when no longer necessary unless otherwise agreed for non-personal data, avoid unauthorised onward sharing, preserve trade secret measures, and avoid gatekeeper onward sharing. - Put the agreed purpose, prohibited uses, onward-sharing limits, erasure trigger, and confidentiality measures into the recipient terms. - For onward sharing by a third party, require a user contract and measures preserving the confidentiality of trade secrets. - Exclude Digital Markets Act gatekeepers from the Article 5 third-party recipient route. - Use Article 11 remedies when a third party or recipient gives false information, uses coercive means, abuses protection gaps, unlawfully discloses data, or ignores agreed measures. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports user and third-party use restrictions, onward-sharing limits, gatekeeper exclusion, and Article 11 remedies for misuse or unlawful disclosure. ## Keep records that match each Data Act trade secret decision and refusal A useful Data Act trade secret file shows the request, the actor roles, the protected data, the safeguards proposed and agreed, the delivered data, and any written decision to withhold, suspend, or refuse. It should also show that verification and access logs were kept only as needed for request execution and infrastructure security or maintenance. If a user or third party challenges a withholding, suspension, or refusal, the record should support the competent-authority complaint path, dispute settlement, or court review without requiring teams to reconstruct the facts later. - Request record: requester identity, Article 4 or Article 5 route, dataset, metadata, purpose, recipient, and requested delivery method. - Protection record: trade secret holder, protected fields, risk analysis, agreed safeguards, recipient commitments, and technical control settings. - Delivery record: data made available, format, timing, access method, and any masking or filtering applied. - Restriction record: written rationale, objective elements relied on, competent-authority notice, and any challenge or dispute outcome. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports written substantiation, competent-authority notification, dispute paths, and limits on retaining access-verification information. ## Avoid confidentiality shortcuts that contradict the Data Act regulation The most common implementation error is treating trade secret protection as a broad exception to access. The Data Act instead expects identification, proportionate safeguards, narrow written restrictions, and challenge routes. Another error is relying on contractual language while ignoring technical access design. A recipient can sign confidentiality terms and still create unacceptable risk if API scopes, logs, subcontractor access, export controls, or deletion controls are missing. - Do not claim inferred or derived outputs are trade secrets if the stronger and more accurate position is that they are outside the Data Act access obligation. - Do not keep request logs or recipient verification data beyond what is necessary for execution, security, and maintenance. - Do not use technical protection measures in a way that discriminates between comparable recipients or blocks user rights. - Do not omit the competent-authority notification when the regulation requires it after withholding, suspension, or refusal. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports the page's warnings against overbroad confidentiality labels, excessive logging, discriminatory technical controls, and missing notifications. ## Maintain a Data Act trade secret access pack that survives regulator review The practical output should be a maintained access pack that legal, product, security, and data engineering can use before a live request arrives. It should be narrow enough to avoid blocking lawful access and detailed enough to support a written Data Act decision. For each product or related service, the pack should connect datasets, metadata, trade secret claims, recipient terms, technical measures, and escalation steps. That makes the page useful for both first-party user access and B2B third-party sharing. - Register: dataset, product or related service, data holder, trade secret holder, protected fields, metadata treatment, and access route. - Safeguards: contractual terms, confidentiality commitments, access protocol, technical standards, encryption or smart-contract controls, monitoring, and erasure rule. - Decision templates: delivery approval, withholding or suspension notice, exceptional refusal rationale, competent-authority notification, and dispute response. - Review triggers: new data fields, new recipients, onward-sharing requests, security incidents, misuse, changed product architecture, or updated Commission materials. Sources for this answer: - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Supports the core access-pack fields by requiring identified trade secrets, agreed safeguards, written reasons, notifications, and technical protection controls. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Provides Commission context for the Data Act's connected-product data access rights and the goal of making user-generated data more accessible. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Supports use of non-binding model contractual terms across data holder, user, and recipient relationships. - [Commission guidance on vehicle data - Official Journal](https://eur-lex.europa.eu/eli/C/2025/5026/oj/eng?ref=sorena.io) - Provides sector-specific source support for mapping product data, related service data, metadata, and excluded inferred or derived information. *Recommended next step* *Placement: after implementation section* ## Use Data Act Trade Secrets and Protection Measures as a cited research workflow Turn this Data Act guide into an access pack for product, legal, procurement, security, and engineering teams. Keep protected fields, recipient safeguards, technical controls, written reasons, and cited sources together. - [Open Research Copilot](/solutions/research-copilot.md): Answer Data Act scope, timing, and interpretation questions with cited outputs. - [Talk through implementation](/contact.md): Review your product scope, contracts, evidence model, and next actions. ## Primary sources - [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng?ref=sorena.io) - Primary law for Data Act trade secret preservation, Articles 4 and 5 access safeguards, Article 6 third-party restrictions, Article 8 B2B terms, Article 10 disputes, and Article 11 technical protection measures. - [European Commission - Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained?ref=sorena.io) - Commission overview explaining the Data Act's purpose for connected-device data access and broader data sharing. - [European Commission - Data Act FAQs v1.4](https://ec.europa.eu/newsroom/dae/redirection/document/108144?ref=sorena.io) - Commission FAQ support for raw and pre-processed data boundaries and non-binding model contractual terms for data access and use. - [Commission guidance on vehicle data - Official Journal](https://eur-lex.europa.eu/eli/C/2025/5026/oj/eng?ref=sorena.io) - Official sector guidance illustrating Chapter II access to product and related service data, necessary metadata, and the treatment of inferred or derived information. ## Related Topic Guides - [Data Act and Common European Data Spaces](/artifacts/eu/data-act/data-act-and-common-european-data-spaces.md): How Data Act Article 33 connects data-space participation with metadata, vocabularies, APIs, access terms, data quality, governance, and standards monitoring. - [Data Act and Data Governance Act Overlap FAQ](/artifacts/eu/data-act/faq/data-governance-act-overlap.md): FAQ explaining where the EU Data Act and Data Governance Act overlap, how they differ, and how to route product, cloud, public-sector reuse, intermediary, and data altruism workflows. - [Data Act and GDPR Personal Data Overlap FAQ](/artifacts/eu/data-act/faq/gdpr-personal-data-overlap.md): FAQ on how the EU Data Act works when connected-product or related-service data includes personal data, mixed datasets, GDPR roles, lawful basis, trade secrets, and third-party sharing. - [Data Act Audit Evidence and Request Logs FAQ](/artifacts/eu/data-act/faq/audit-evidence-and-request-logs.md): FAQ for Data Act request logs covering user and third-party access, B2G exceptional need requests, cloud switching records, contract terms, trade secrets, and GDPR boundaries. - [Data Act B2B Data-Sharing Contract Clauses](/artifacts/eu/data-act/b2b-data-sharing-contract-clauses.md): Clause guide for EU Data Act B2B data sharing: FRAND terms, compensation, trade secret safeguards, recipient limits, termination, logs, and GDPR boundaries. - [Data Act B2B Data-Sharing Contract Template](/artifacts/eu/data-act/b2b-data-sharing-contract-template.md): A usable EU Data Act B2B data-sharing template outline covering access requests, data schedules, permitted use, trade secrets, security, compensation, GDPR boundaries, audit records, and termination. - [Data Act B2G Exceptional-Need Requests](/artifacts/eu/data-act/b2g-exceptional-need-requests.md): An official source guide to EU Data Act Chapter V requests from public bodies: exceptional need, public emergencies, request contents, limits, safeguards, costs, and records. - [Data Act Cloud Switching Compliance Checklist](/artifacts/eu/data-act/cloud-switching-compliance-checklist.md): A cited EU Data Act checklist for cloud and data processing service providers covering switching clauses, notices, export formats, charges, interoperability, and evidence. - [Data Act Cloud Switching Contract Terms FAQ](/artifacts/eu/data-act/faq/cloud-switching-contract-terms.md): FAQ on EU Data Act cloud switching contract terms: Article 25 clauses, assistance, notice, transition, charges, export, termination, interoperability, and records. - [Data Act Cloud Switching Fees and Deadlines FAQ](/artifacts/eu/data-act/faq/cloud-switching-fees-and-deadlines.md): FAQ on EU Data Act cloud switching charges, 2027 fee removal, notice periods, transition windows, data retrieval, contract terms, and evidence records. - [Data Act Complaints and Dispute Settlement FAQ](/artifacts/eu/data-act/faq/complaints-and-dispute-settlement.md): FAQ on EU Data Act complaints, competent authorities, dispute settlement bodies, B2B data-sharing disputes, B2G requests, cloud switching disputes, and evidence records. - [Data Act Exportable Data and Metadata FAQ](/artifacts/eu/data-act/faq/exportable-data-and-metadata.md): FAQ explaining which product, related service, metadata, and cloud switching data must be exportable under the EU Data Act, and which data can be excluded. - [Data Act FAQ for Aftermarket Repair and Mobility Services](/artifacts/eu/data-act/faq/aftermarket-repair-and-mobility-services.md): FAQ on EU Data Act vehicle-data access for repairers, independent service providers, fleets, insurers, and mobility services. - [Data Act Functional Equivalence FAQ](/artifacts/eu/data-act/faq/functional-equivalence.md): FAQ on Data Act functional equivalence for cloud switching: IaaS scope, customer outcomes, export support, interoperability duties, limits, and evidence. - [Data Act Indirect Access Request Flows FAQ](/artifacts/eu/data-act/faq/indirect-access-request-flows.md): FAQ for Data Act teams handling user and third-party data requests when direct connected-product access is unavailable, incomplete, or limited. - [Data Act International Government Access FAQ](/artifacts/eu/data-act/faq/international-government-access.md): FAQ on EU Data Act safeguards for non-EU government access to non-personal data held in the Union by data processing service providers. - [Data Act Interoperability Standards FAQ](/artifacts/eu/data-act/faq/interoperability-standards.md): FAQ on EU Data Act interoperability standards for data spaces, cloud switching, smart contracts, harmonised standards, common specifications, and M/614. - [Data Act Model Contractual Terms FAQ](/artifacts/eu/data-act/faq/model-contractual-terms.md): FAQ on the EU Data Act non-binding model contractual terms for data access and use, cloud switching clauses, B2B use, unfair terms, and evidence. - [Data Act Public Emergency Requests FAQ](/artifacts/eu/data-act/faq/public-emergency-requests.md): FAQ on EU Data Act public emergency requests: exceptional need, request content, timing, data holder response, compensation, confidentiality, and records. - [Data Act Smart Contracts for Data Sharing](/artifacts/eu/data-act/smart-contracts-for-data-sharing.md): Data Act Article 36 smart contract guide for data-sharing agreements: scope, robustness, access control, termination, interruption, archiving, standards status, and conformity evidence. - [Data Act SME Exceptions and Startups FAQ](/artifacts/eu/data-act/faq/sme-exceptions-and-startups.md): FAQ on where the EU Data Act gives micro, small, medium-sized, startup, and SME actors narrower treatment for access duties, compensation, and B2B terms. - [Data Act Trade Secret Technical Protection Measures FAQ](/artifacts/eu/data-act/faq/trade-secret-technical-protection-measures.md): FAQ on how EU Data Act data holders can protect trade secrets with confidentiality safeguards, technical measures, limited withholding, suspension, refusal, and evidence. - [Data Act Unfair Contractual Terms | Article 13 B2B Contract Review](/artifacts/eu/data-act/unfair-contractual-terms.md): Review B2B data-sharing clauses under EU Data Act Article 13: unilateral terms, always unfair examples, presumed unfair terms, model clauses, evidence, and remediation. - [Data Act Vehicle Data Guidance](/artifacts/eu/data-act/vehicle-data-guidance.md): Commission-cited guide to Data Act vehicle data access: connected vehicles, vehicle-related services, raw and pre-processed data, aftermarket use cases, access routes, safeguards, and GDPR boundaries. - [Data Act vs GDPR: connected-product data access](/artifacts/eu/data-act/data-act-vs-gdpr.md): Compare EU Data Act connected-product access duties with GDPR personal-data rules: scope, roles, lawful basis, data subject rights, third-party sharing, trade secrets, and conflicts. - [EU Data Act and Common European Data Spaces FAQ](/artifacts/eu/data-act/faq/data-act-and-common-european-data-spaces.md): FAQ on how EU Data Act interoperability duties, Data Governance Act rules, and sector data-space governance fit together without treating participation as a general obligation. - [EU Data Act Applicability Test](/artifacts/eu/data-act/applicability-test.md): Check whether a product, related service, data holder, cloud service, data-space role, smart contract, or B2G request is in scope of the EU Data Act. - [EU Data Act Application Dates and Transition FAQ](/artifacts/eu/data-act/faq/application-dates-and-transition.md): FAQ on when the EU Data Act applies, which obligations are delayed, and what product, contract, cloud, and evidence records teams should maintain. - [EU Data Act Article 3 Pre-Contract Information](/artifacts/eu/data-act/pre-contractual-information-obligations.md): What Article 3 of the EU Data Act requires before connected-product purchase, rent, lease, or related-service contracting: data categories, access, data holder identity, third-party sharing, complaints, and evidence. - [EU Data Act Article 36 Smart Contract Controls FAQ](/artifacts/eu/data-act/faq/article-36-smart-contract-controls.md): FAQ explaining when EU Data Act Article 36 applies to smart contracts for data-sharing agreements and what controls, conformity evidence, and limits it requires. - [EU Data Act B2B Data Sharing Compensation FAQ](/artifacts/eu/data-act/faq/compensation-for-b2b-data-sharing.md): FAQ on when Data Act data holders may charge B2B data recipients, what reasonable compensation can include, SME limits, unfair terms, disputes, and trade secret safeguards. - [EU Data Act B2G Compensation and Costs FAQ](/artifacts/eu/data-act/faq/b2g-compensation-and-costs.md): FAQ on when Data Act B2G exceptional-need requests are free, when fair compensation may be claimed, which costs can be included, and what records to keep. - [EU Data Act B2G Exceptional Need FAQ](/artifacts/eu/data-act/faq/b2g-exceptional-need.md): When public-sector bodies can request business-held data under the EU Data Act, what a valid request must contain, and how data holders handle limits, trade secrets, compensation, and evidence. - [EU Data Act Checklist for Product, Cloud, and Contract Teams](/artifacts/eu/data-act/checklist.md): A cited EU Data Act checklist for connected-product data access, third-party sharing, B2G requests, cloud switching, unfair terms, smart contracts, personal data boundaries, evidence, and owners. - [EU Data Act Cloud Switching and Exit Plans](/artifacts/eu/data-act/cloud-switching-and-exit-plans.md): A cited EU Data Act guide for data processing service exit plans: switching contracts, exportable data, assistance, charges, interoperability, retrieval, erasure, and records. - [EU Data Act Cloud Switching Procurement FAQ](/artifacts/eu/data-act/faq/cloud-switching-procurement-checklist.md): Procurement checklist FAQ for EU Data Act cloud switching: contract terms, exit support, exportable data, switching charges, interoperability, termination, and supplier evidence. - [EU Data Act Compliance Program](/artifacts/eu/data-act/compliance.md): Build a Data Act compliance program for connected-product data access, contracts, B2G requests, cloud switching, smart contracts, GDPR boundaries, records, and ownership. - [EU Data Act Connected Product Scope and Data Types](/artifacts/eu/data-act/scope-connected-products-and-data-types.md): Classify EU Data Act connected products, related services, product data, related-service data, readily available data, metadata, and excluded derived outputs. - [EU Data Act Connected Product Scope FAQ](/artifacts/eu/data-act/faq/scope-connected-products.md): FAQ explaining when connected products, related services, generated data, EU market placement, and SME exceptions fall within EU Data Act scope. - [EU Data Act Data Processing Service Switching](/artifacts/eu/data-act/data-processing-services-switching.md): A cited EU Data Act guide for provider and customer switching duties: exit assistance, exportable data, contract clauses, charges, interoperability, retrieval, and erasure. - [EU Data Act data spaces interoperability FAQ](/artifacts/eu/data-act/faq/data-spaces-interoperability.md): FAQ explaining Article 33 Data Act interoperability requirements for data-space participants, common European data spaces, standards, APIs, metadata, and architecture evidence. - [EU Data Act deadlines and compliance calendar](/artifacts/eu/data-act/deadlines-and-compliance-calendar.md): A cited calendar for EU Data Act application dates, product design timing, contract remediation, cloud switching charges, response periods, standards work, and evidence records. - [EU Data Act Direct Access by Design FAQ](/artifacts/eu/data-act/faq/direct-access-by-design.md): FAQ for product and legal teams designing user access to connected-product and related-service data under the EU Data Act. - [EU Data Act Enforcement and Competent Authorities FAQ](/artifacts/eu/data-act/faq/enforcement-and-competent-authorities.md): FAQ on who enforces the EU Data Act, how complaints work, how Member States set penalties, when dispute settlement can be used, and when GDPR authorities remain responsible. - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates](/artifacts/eu/data-act/faq.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. - [EU Data Act Non-Emergency Public-Sector Requests FAQ](/artifacts/eu/data-act/faq/non-emergency-public-sector-requests.md): FAQ on EU Data Act requests where a public body claims exceptional need outside a public emergency, including scope, request contents, limits, compensation, confidentiality, and evidence. - [EU Data Act Non-Personal Data and Mixed Datasets FAQ](/artifacts/eu/data-act/faq/non-personal-data-and-mixed-datasets.md): FAQ on how the EU Data Act treats non-personal data, mixed datasets, GDPR precedence, user and third-party access, trade-secret limits, and evidence records. - [EU Data Act Penalties and Enforcement](/artifacts/eu/data-act/penalties-and-fines.md): Official source guide to Data Act penalties under Article 40, Member State enforcement, penalty factors, complaints, judicial remedies, and the GDPR enforcement boundary. - [EU Data Act Pre-Contractual Information FAQ](/artifacts/eu/data-act/faq/pre-contractual-information.md): FAQ on EU Data Act Article 3 pre-contract information for connected products and related services, including data categories, access methods, data holder identity, third-party sharing, and GDPR boundaries. - [EU Data Act Product Data vs Related Service Data FAQ](/artifacts/eu/data-act/faq/product-data-and-service-data.md): FAQ explaining how the EU Data Act separates connected product data, related service data, readily available raw and pre-processed data, metadata, and inferred or derived outputs. - [EU Data Act Readily Available Data FAQ](/artifacts/eu/data-act/faq/readily-available-data.md): FAQ on what counts as readily available data under the EU Data Act, including product data, related service data, metadata, inferred data, and access mechanics. - [EU Data Act Related Services FAQ](/artifacts/eu/data-act/faq/related-services.md): FAQ explaining when software is a Data Act related service, how it links to connected products, which product and service data are in scope, and what exclusions apply. - [EU Data Act requirements](/artifacts/eu/data-act/requirements.md): Official source EU Data Act requirements for connected-product data access, B2B sharing terms, B2G exceptional needs, cloud switching, smart contracts, interoperability, GDPR boundaries, and records. - [EU Data Act Smart Contracts for Data Sharing FAQ](/artifacts/eu/data-act/faq/smart-contracts-for-data-sharing.md): Answers on Article 36 Data Act smart-contract requirements for data sharing: scope, robustness, access control, termination, archiving, conformity assessment, contract terms, and standards status. - [EU Data Act Third-Party Data Sharing FAQ](/artifacts/eu/data-act/faq/third-party-data-sharing.md): FAQ on user-directed third-party data sharing under the EU Data Act, covering data holder duties, recipient limits, trade secrets, security, GDPR, and gatekeepers. - [EU Data Act Trade Secret Safeguards FAQ](/artifacts/eu/data-act/faq/trade-secrets-safeguards.md): FAQ on protecting trade secrets when handling EU Data Act user and third-party data access requests, including safeguards, withholding, suspension, refusal, notices, and records. - [EU Data Act Unfair Contractual Terms FAQ](/artifacts/eu/data-act/faq/unfair-contractual-terms.md): FAQ on Article 13 of the EU Data Act: B2B unfair contract terms, unilateral take-it-or-leave-it clauses, always-unfair terms, presumed-unfair terms, SMEs, model terms, and review evidence. - [EU Data Act User Access and Portability Rights](/artifacts/eu/data-act/access-rights-and-portability.md): Practical guide to EU Data Act user access, connected-product data portability, third-party sharing, trade secret safeguards, and the GDPR boundary. - [EU Data Act Users, Data Holders, and Recipients FAQ](/artifacts/eu/data-act/faq/users-data-holders-and-recipients.md): FAQ explaining Data Act users, data holders, data recipients, connected products, related services, user access, third-party limits, and GDPR boundaries. - [EU Data Act Vehicle Data Guidance FAQ](/artifacts/eu/data-act/faq/vehicle-data-guidance.md): FAQ on EU Data Act vehicle data guidance for connected vehicles, aftermarket repair, mobility services, third-party access, trade secrets, security, and GDPR boundaries. - [EU Data Act vs Data Governance Act](/artifacts/eu/data-act/data-act-vs-data-governance-act.md): Compare the EU Data Act with the Data Governance Act: connected-product access, cloud switching, B2B/B2G duties, protected public-sector reuse, intermediaries, altruism, governance, and enforcement. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/data-act/trade-secrets-and-protection