Data has become the most sought-after commodity in the digital economy – driving innovation, informing decision-making and shaping the future of a wide range of industry sectors. The EU Data Act (Regulation (EU) 2023/2854) is designed to create a Single Market for industrial data in the European Union by setting common basic rules on who can use and access data from connected (Internet of Things) devices across all economic sectors. The Regulation also aims to facilitate switching between data processing services and promote interoperability.
While the new legislation aims to foster greater transparency and open digital markets to new players, there has been considerable debate about the level of protection it offers for intellectual property and trade secrets – a discussion that continues to evolve as implementation approaches.
The Data Act sets the ground rules for business-to-consumer, business-to-business and business-to-government exchange of data in the EU Single Market.
Specific measures include the following:
Regarding enforcement, Member State authorities will be empowered to impose “effective, proportionate and dissuasive” financial penalties for compliance failures.
The Data Act was published in the Official Journal of the European Union on 22 December 2023 and became applicable on 12 September 2025 for the most part.
There are, however, important staggered timelines to be aware of:
Since formal adoption, the European Commission has taken steps to assist businesses in preparing for the Data Act’s requirements. The Commission has published non-binding Model Contractual Terms and Standard Contractual Clauses under Article 41, covering data access and use topics (including provisions on reasonable compensation and trade secret protection) as well as cloud computing switching arrangements. The Data Act requires the Commission to develop and recommend these non-binding tools to assist parties in drafting and negotiating contracts with fair, reasonable and non-discriminatory rights and obligations. While non-binding, these model terms provide a useful practical reference point for businesses drafting or renegotiating data-sharing and cloud agreements. The Commission has also published and updated FAQ on the Data Act.
More significantly, the Data Act is part of the reform package called “Digital Omnibus”, which the Commission has introduced in November 2025. The Digital Omnibus proposes potentially significant amendments to the Data Act across several areas. These include changes to the rules on trade secret-related refusals to share data, a narrowing of the business-to-government data access provisions, adjustments to cloud switching rules for certain contracts and providers, and the removal of the Data Act’s smart contracts article without replacement. The Digital Omnibus proposals are still under discussion and have not yet been adopted, but businesses and their advisers should monitor them closely, as they could meaningfully alter the compliance landscape before the September 2025 application date.
The Data Act is already applicable, and many organisations have already started their implementation programs. Key priorities include:
To find out more about the Data Act and how our experts can help you to conduct a scoping exercise, revise terms of use, or determine how third-party data could be used to improve your own services, please get in touch.
