The Data Act can create access and use rights for connected-product data, while GDPR governs any personal data within the same dataset or workflow.
GDPR prevails where the regimes conflict on personal-data protection. A Data Act access right does not remove the need for a GDPR role, lawful basis, notice, rights process, security control, and transfer assessment.
The Data Act and GDPR can govern the same dataset. For Chapter II, identify the user, data holder, related service, and readily available data. The Data Act covers personal data and non-personal data, while GDPR applies to every personal-data operation in the workflow. Article 1(5) of the Data Act preserves data-protection law and makes it prevail in a conflict.
Side-by-side comparison
GDPR vs EU Data Act: privacy and data-access decisions
Use these rows to decide which regime applies, which actor must act, and which evidence can be shared without merging the legal tests.
Covers personal-data processing, lawful basis, rights, transfers, security, controller and processor accountability, and records.
Second framework
EU Data Act
Covers access to and use of data from connected products and related services, business-to-business data terms, public-sector exceptional need, cloud switching, interoperability, and related duties.
GDPR vs EU Data Act: privacy and data-access decisions
Covers data broadly, including connected-product and related-service data, and can apply to personal and non-personal data. Other chapters govern specified data-sharing, contract, public-sector, switching, and interoperability situations.
Requires role allocation for controllers, joint controllers, processors, representatives where relevant, DPO tasks where applicable, processor contracts, RoPA, security, breach, DPIA, and accountability records.
Supports practical RoPA evidence for accountability.
under Article 30 GDPR
Relevant Data Act actors include users of connected products or related services, data holders, third-party data recipients, enterprises receiving contractual terms, public-sector bodies making exceptional-need requests, and providers and customers of data-processing services.
Requires a lawful basis for each processing purpose and accountability evidence for lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity, and confidentiality.
Supports Article 5 principles and Article 6 lawful processing.
Lawfulness of processing
A Data Act right or duty to make data available does not erase GDPR conditions for personal-data processing. The Data Act preserves data-protection law and makes it prevail where the rules conflict.
Requires transparent information and data-subject rights handling, including access, rectification, erasure, restriction, portability, objection, and automated-decision safeguards where applicable.
Supports GDPR Chapter III rights and transparent information duties.
rights of the data subject
Chapter II gives users rights to access data generated by connected products and related services and to have data made available to third parties, subject to conditions including limits on recipient use and trade-secret safeguards.
The Data Act has safeguards against unlawful third-country government access to non-personal data held in the Union. Those safeguards are distinct from GDPR Chapter V mechanisms for personal data.
GDPR duties follow the processing lifecycle: lawful basis and notice before processing, DPIA before likely high-risk processing, rights clocks on request, and breach assessment after awareness.
Supports pre-processing transparency and DPIA duties, rights-response periods, and breach-notification timing.
without undue delay
The Data Act generally applies from 12 September 2025. Article 3(1) design duties apply to covered products and related services placed on the market after 12 September 2026; other chapters have their own contract and switching transitions.
The GDPR gives supervisory authorities powers to monitor application, handle complaints, investigate, and impose corrective measures, including suspension of data flows or administrative fines where needed.
Supports supervisory authority monitoring, complaint-handling, corrective powers, and fines.
monitor and enforce the application of this Regulation
Member States designate one or more competent authorities for the Data Act and lay down penalties. Data-protection authorities remain responsible for monitoring personal-data protection where the Data Act involves personal data.
Articles 37 and 40 establish competent-authority and penalty frameworks.
Route the privacy issue to the competent data-protection authority and the Data Act issue to the designated Data Act authority; coordinate when both are engaged.
The GDPR analysis can still run even when another EU data regime is also relevant, and the same factual workflow may need a separate lawfulness, transfer, or security review.
Start with GDPR if any personal data is present, and determine scope, lawful basis, rights, transfers, security, and accountability for the planned processing.
If a connected-product, data-sharing, contract, public-sector request, cloud-switching, interoperability, or smart-contract fact pattern is present, identify the applicable Data Act chapter, role, duty, safeguard, and date.
Covers data broadly, including connected-product and related-service data, and can apply to personal and non-personal data. Other chapters govern specified data-sharing, contract, public-sector, switching, and interoperability situations.
Supports treating personal data processing as the GDPR trigger.
processing of personal data
Covered actors
GDPR
Requires role allocation for controllers, joint controllers, processors, representatives where relevant, DPO tasks where applicable, processor contracts, RoPA, security, breach, DPIA, and accountability records.
Supports practical RoPA evidence for accountability.
under Article 30 GDPR
EU Data Act
Relevant Data Act actors include users of connected products or related services, data holders, third-party data recipients, enterprises receiving contractual terms, public-sector bodies making exceptional-need requests, and providers and customers of data-processing services.
Supports determining controller and processor roles from personal-data processing facts.
purposes and means
Trigger
GDPR
Requires a lawful basis for each processing purpose and accountability evidence for lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity, and confidentiality.
Supports Article 5 principles and Article 6 lawful processing.
Lawfulness of processing
EU Data Act
A Data Act right or duty to make data available does not erase GDPR conditions for personal-data processing. The Data Act preserves data-protection law and makes it prevail where the rules conflict.
Supports the need to document GDPR lawfulness and accountability before processing.
be able to demonstrate compliance
Core obligations
GDPR
Requires transparent information and data-subject rights handling, including access, rectification, erasure, restriction, portability, objection, and automated-decision safeguards where applicable.
Supports GDPR Chapter III rights and transparent information duties.
rights of the data subject
EU Data Act
Chapter II gives users rights to access data generated by connected products and related services and to have data made available to third parties, subject to conditions including limits on recipient use and trade-secret safeguards.
The Data Act has safeguards against unlawful third-country government access to non-personal data held in the Union. Those safeguards are distinct from GDPR Chapter V mechanisms for personal data.
Supports SCCs as a GDPR transfer safeguard in relevant cases.
appropriate data protection safeguards
Timing and deadlines
GDPR
GDPR duties follow the processing lifecycle: lawful basis and notice before processing, DPIA before likely high-risk processing, rights clocks on request, and breach assessment after awareness.
Supports pre-processing transparency and DPIA duties, rights-response periods, and breach-notification timing.
without undue delay
EU Data Act
The Data Act generally applies from 12 September 2025. Article 3(1) design duties apply to covered products and related services placed on the market after 12 September 2026; other chapters have their own contract and switching transitions.
Supports keeping GDPR event-based deadlines separate from Data Act application and transition dates.
without undue delay
Enforcement
GDPR
The GDPR gives supervisory authorities powers to monitor application, handle complaints, investigate, and impose corrective measures, including suspension of data flows or administrative fines where needed.
Supports supervisory authority monitoring, complaint-handling, corrective powers, and fines.
monitor and enforce the application of this Regulation
EU Data Act
Member States designate one or more competent authorities for the Data Act and lay down penalties. Data-protection authorities remain responsible for monitoring personal-data protection where the Data Act involves personal data.
Articles 37 and 40 establish competent-authority and penalty frameworks.
Operational implication
Route the privacy issue to the competent data-protection authority and the Data Act issue to the designated Data Act authority; coordinate when both are engaged.
Supports supervisory authority enforcement powers and complaint handling.
handle complaints lodged by a data subject
Overlap and reuse
GDPR
The GDPR analysis can still run even when another EU data regime is also relevant, and the same factual workflow may need a separate lawfulness, transfer, or security review.
Supports separating GDPR accountability from other regulatory workstreams.
be able to demonstrate compliance
Practical decision rule
GDPR
Start with GDPR if any personal data is present, and determine scope, lawful basis, rights, transfers, security, and accountability for the planned processing.
If a connected-product, data-sharing, contract, public-sector request, cloud-switching, interoperability, or smart-contract fact pattern is present, identify the applicable Data Act chapter, role, duty, safeguard, and date.
Supports the GDPR-first decision rule when personal data is involved.
processing of personal data
Practical decision rule
How should teams use this comparison?
Identify the Data Act chapter, or other fact pattern, user, data holder or other actor, data in scope, right or duty, safeguards, and application date.
Classify the requested fields as personal, non-personal, or mixed and document which data is readily available, inferred, derived, content, or outside the request.
For personal data, confirm the GDPR role, purpose, lawful basis, notice, rights, processor, minimisation, security, retention, and transfer result before disclosure or reuse.
Record the release method, recipient, permitted purpose, trade-secret measures, contract restrictions, exceptions, notices, reviewer, and completion evidence.
Keep one factual inventory where useful, but issue separate GDPR and Data Act findings and require both to permit the planned action.
Primary source for the Data Act side of the decision path.
1
Section 1
Classify the product, data, people, and roles
The Data Act applies across several data-economy relationships. Its connected-product rules concern users, data holders, and third-party data recipients; other chapters address legally required business-to-business data access, unfair contractual terms imposed on enterprises, public-sector requests based on exceptional need, switching between data-processing services, interoperability, and smart contracts.
For a or related service, identify the user, data holder, available product data, readily available related-service data, intended third-party recipient, trade-secret issues, and whether any person is identifiable. If personal data is present, separately identify the GDPR controller, processor, purpose, lawful basis, transparency duties, and data-subject rights.
Do not assume all device data is personal data; assess whether the data relates to an identified or identifiable person.
Do not assume non-personal data is outside the Data Act; the regulation covers data broadly and contains specific protections for non-personal data.
Record the Data Act access or sharing right and the GDPR lawful basis as separate conclusions.
Apply trade-secret safeguards without using them as an automatic reason to reject every access request.
Primary Data Act text for scope, connected-product data access, data holders and recipients, trade secrets, contracts, public-sector access, cloud switching, interoperability, enforcement, and application dates.
2
Section 2
Keep lawful basis, rights, and accountability separate from Data Act analysis
A Data Act workstream does not supersede GDPR Article 6 lawful-basis analysis, transparency duties, data-subject rights handling, processor terms, security controls, or breach documentation. Article 1(5) says Data Act Chapter II rights complement GDPR access and portability rights where users are data subjects, and data-protection law prevails in a conflict.
For controller and processor accountability, maintain a record that shows who determines purposes and means, who processes on documented instructions, which processor terms apply, and how data-subject requests reach the accountable controller.
For each data-use scenario, name the GDPR processing purpose before discussing data sharing.
Store lawful-basis reasoning beside privacy notice text and data-subject request handling steps.
Keep controller, joint-controller, and processor decisions tied to the actual purposes and means of processing.
Use RoPA entries to link purposes, categories of data subjects, categories of personal data, recipients, transfers, retention, and security measures.
Article 1(5) preserves data-protection law, makes it prevail in a conflict, and explains how Chapter II rights complement GDPR access and portability rights.
Supports RoPA as practical accountability evidence for Article 30 processing records.
Records of Processing Activities
3
Section 3
Preserve transfer safeguards when data-sharing crosses borders
If a data-access, recipient, vendor, cloud, support, or analytics path sends personal data outside the EU/EEA or to an international organisation, keep the GDPR Chapter V transfer analysis separate from any Data Act comparison.
The Data Act's safeguards against unlawful third-country government access concern non-personal data held in the Union. They do not replace the GDPR Chapter V mechanism required when a sharing or access path transfers personal data to a third country or international organisation.
Identify exporter, importer, roles, destination, categories of personal data, and onward-transfer points.
Attach the transfer mechanism, SCC module or adequacy basis, and any supplementary-measures assessment to the processing record.
Do not treat a Data Act access or sharing label as a substitute for GDPR transfer safeguards.
Reassess transfers when recipients, hosting locations, support models, subprocessors, or government-access risk facts change.
Article 32 addresses unlawful third-country government access to and transfer of non-personal data held in the Union; Article 1(5) preserves GDPR rules for personal data.
4
Section 4
Evidence to keep when both regimes may be discussed
Use one factual inventory with two legal layers. The Data Act layer should record the product or service, user, data holder, data in scope, access method, requested recipient, permitted purpose, trade-secret safeguards, contract terms, and applicable date. The GDPR layer should record the personal-data purpose, role, lawful basis, notice, rights, processor, security, retention, and transfer controls.
The Data Act entered into force on 11 January 2024 and generally applies from 12 September 2025. Its Article 3(1) design obligation applies to connected products and related services placed on the market after 12 September 2026. Separate transition rules apply to specified contract chapters and cloud switching charges.
GDPR scope note: personal data, processing operation, data subjects, purposes, recipients, and systems.
GDPR safeguard note: lawful basis, notice, rights route, security measures, breach workflow, retention, and transfer mechanism.
Role note: controller, joint controller, processor, subprocessors, and contract or arrangement evidence.
Data Act evidence: product and service scope, user and data-holder roles, access route, third-party request, trade-secret decision, contract rule, switching plan, and application date.
Primary source for Data Act scope, evidence fields, transition rules, and the GDPR conflict rule.
5
Section 5
Work a connected-product access request from facts to release
First identify the , related service, user, data holder, requested data, period, access method, and intended third-party recipient. Separate product data and related-service data from content, highly enriched inferred or derived data, and data that is not readily available to the data holder. Keep the technical evidence for that boundary, including where the data is generated, stored, retrieved, pre-processed, or transmitted.
Then classify every field as personal, non-personal, or mixed. If the user is the data subject, the Data Act right complements GDPR access and portability rights. If the user is not the data subject, do not disclose another person's personal data until a GDPR controller has identified a valid lawful basis and the other GDPR conditions are met.
Before release, record the recipient, purpose, format, metadata, security method, trade-secret status, agreed protection measures, prohibited uses, and any refusal or suspension ground. Trade-secret identification starts a safeguard process; it is not an automatic veto. A refusal needs the specific legal ground, supporting facts, notice, escalation route, and review owner.
Scope record: product placement, product or service function, user right, data-holder role, requested period, and applicable date.
Data boundary: raw, pre-processed, metadata, inferred, derived, content, personal, non-personal, and readily available status.
GDPR gate: data subject, controller, processor, purpose, lawful basis, transparency, rights, minimisation, security, retention, and transfer.
Release record: recipient, permitted purpose, access method, format, frequency, protection measures, contract terms, and completion evidence.
Exception record: trade secret, security concern, third-party rights, technical limit, refusal or suspension ground, reviewer, notice, and reassessment date.
Current Commission guidance on connected products, related services, data in scope, readily available data, edge processing, personal data, and trade secrets.
Grounds the personal-data lawfulness, transparency, rights, security, minimisation, and transfer checks before release.
6
Section 6
Test the overlap with concrete scenarios
A fleet operator requesting vehicle telemetry may be the Data Act user while drivers and passengers are GDPR data subjects. The operator's Data Act access position does not supply a GDPR lawful basis for every location, behavior, or in-cabin data point. The release record must separate the operator's access right from the controller's personal-data decision.
A manufacturer can be the data holder for product data and a GDPR controller for its own analytics, while processing other personal data for a customer on documented instructions. Record the role per purpose and data flow. One organization can hold several roles, but one label should not be stretched across all processing.
A cloud-switching project may engage the Data Act even without a . If customer exports contain personal data, keep the GDPR processor, security, deletion, return, subprocessor, and international-transfer controls alongside the Data Act switching plan. Article 32 safeguards for non-personal data do not replace GDPR Chapter V.
Vehicle or equipment data: separate the organizational user from each identifiable driver, operator, patient, worker, or bystander.
Third-party service: test the Data Act recipient restrictions and the GDPR controller or processor position for the recipient's intended purpose.
Edge data: document whether raw or pre-processed data was ever accessible, stored, retrievable, or externally transmittable.
Cloud switching: record export, continuity, interoperability, deletion, security, personal-data transfer, and transition-date evidence.
Grounds purpose-specific role, lawfulness, processor, security, rights, deletion, and transfer analysis.
Recommended next step
Turn this comparison into a personal-data evidence record
Sorena can help map each data-use scenario to GDPR scope, lawful basis, rights, transfers, and accountability evidence alongside the applicable Data Act role, access duty, safeguard, and date.
Primary Data Act source for access and use rights, roles, safeguards, contracts, switching, enforcement, dates, and interaction with GDPR.
Primary Data Act text for scope, connected-product data access, data holders and recipients, trade secrets, contracts, public-sector access, cloud switching, interoperability, enforcement, and application dates.
Article 1(5) preserves data-protection law, makes it prevail in a conflict, and explains how Chapter II rights complement GDPR access and portability rights.
Show 14 more
Article 32 addresses unlawful third-country government access to and transfer of non-personal data held in the Union; Article 1(5) preserves GDPR rules for personal data.
Primary source for Data Act scope, evidence fields, transition rules, and the GDPR conflict rule.
Articles 3 to 6 and related definitions ground the Chapter II access path, recipient controls, and trade-secret safeguards.
Grounds user and data-holder roles, Chapter II access, switching, international non-personal-data safeguards, and the GDPR conflict rule.
Articles 1 and 2 establish Data Act subject matter, scope, and definitions.
Article 2 defines user, data holder, data recipient, and other Data Act roles.
Article 1(5) preserves GDPR and other privacy law and states the conflict rule.
Articles 3 to 6 establish connected-product information, access, third-party sharing, and recipient-use rules.
Article 32 establishes safeguards for international access and transfer of non-personal data.
Article 50 establishes general application and specified transition dates.
Articles 37 and 40 establish competent-authority and penalty frameworks.
Chapter II and Article 1(5) support parallel Data Act access and GDPR privacy analysis.
Primary source for the Data Act decision rule.
Primary source for the Data Act side of the decision path.
Commission implementation guidance dated 22 January 2026 on connected products, related services, users, data holders, data in scope, edge processing, trade secrets, personal-data overlap, and implementation. The document states that its views are not authoritative and do not add to the legal text.
Current Commission guidance on connected products, related services, data in scope, readily available data, edge processing, personal data, and trade secrets.
Provides current Commission examples and interpretation for connected products, edge data, users, data scope, and personal-data overlap.