Data Act enters into force

On 11 January, the Data Act has entered into force. The individual chapters of the Act will apply in stages from 12 September 2025 until full application on 12 September 2027. A large part of the Act will apply from 12 September 2025, including the right for business users and consumers to access and share data from IoT devices. The regulations will initially apply to data holders and users in regard to IoT data from connected products placed on the market after 12 September 2025. The provisions on the specific conditions under which data holders will have to make data available to recipients, including compensation, dispute settlement and technical protection measures (Chapter III) shall apply in relation to obligations to make data available under Union law or national legislation adopted in accordance with Union law, which enters into force after 12 September 2025. The provisions obliging the data holder to subject their B2B contractual terms related to data access an unfairness test (Chapter IV) shall apply to contracts concluded after 12 September 2025. The obligations for manufacturers to apply access by design principles in manufacturing of connected products will only apply to products and the services related placed on the market after 12 September 2026. Finally, after 12 September 2027, Chapter IV shall also apply to contracts concluded on or before 12 September 2025 provided that they are (a) of indefinite duration; or (b) due to expire at least 10 years from 11 January 2024.

The Data Act grants users of connected products and related services access to the related raw data and meta data generated from such products and services, and to share such data with third parties. It applies to manufacturers and suppliers as the data holders and users of IoT devices/related services. It also applies to public sector bodies in certain situations, providers of cloud services and similar data processing activities, and establishes rules for using smart contracts as discussed in more depth in our November Edition of Data Bytes. 

The Data Act is unprecedented. No other legislator outside the EU has announced similar legislation. Depending on its wider acceptance and success in fostering grow of the data economy, the Data Act has the potential of influencing legislation in other jurisdictions.

The 20 months transition period is short, considering that the preparations for the Data Act will easily reach a dimension that compares and possibly exceeds that which companies have experienced when adapting to the GDPR. Ashurst has set out a series of webinars, articles, and other educational materials such as workshops to raise awareness and help businesses start their data strategy process.

Authors: Alexander Duisberg, Partner; David Plischka, Junior Associate.