The EU Data Act for Connected Products

What the Data Act is

The Data Act, Regulation (EU) 2023/2854, is an EU Regulation on fair access to and use of data. It applies directly in every Member State, without national laws to transpose it. The Commission's Data Act policy page sums up its aim as giving users, both consumers and businesses, more control over the data generated by their connected devices, such as cars, smart TVs and industrial machinery.

The Regulation covers more than devices. It also has rules on unfair data-sharing terms between businesses, on public bodies requesting data in exceptional situations such as public emergencies, and on switching between cloud and edge computing providers. This guide stays with the part that matters most to an IoT product team: Chapter II, on data sharing with consumers and businesses.

The dates in the Regulation

Article 50 of the Regulation sets out when each part applies:

• It entered into force on 11 January 2024, and the Regulation in general "shall apply from 12 September 2025".
• The design obligation in Article 3(1) applies to "connected products and the services related to them placed on the market after 12 September 2026".
• The rules on unfair contractual terms in Chapter IV apply to contracts concluded after 12 September 2025, and from 12 September 2027 to some older contracts: those of indefinite duration, or due to expire at least 10 years from 11 January 2024.

So user access rights and the pre-contract information duties have applied since 12 September 2025, and products placed on the market after 12 September 2026 must also be built for access.

Products, services and data it covers

Article 2 defines the key terms. A connected product is an item that obtains, generates or collects data about its use or environment and can communicate that data "via an electronic communications service, physical connection or on-device access". Its primary function must not be storing or processing data for someone other than the user, so a cloud server is not a connected product in this sense.

A related service is a digital service, including software, connected with the product at the time of sale in such a way that without it the product could not perform one or more of its functions, or one added later by the manufacturer or a third party to add to, update or adapt the product's functions. The companion app and cloud service of a smart device usually fit this description; our guide to companion apps for connected products describes that layer.

The rights cover two kinds of data:

• Product data: data generated by using the product that the manufacturer designed to be retrievable by a user, data holder or third party.
• Related service data: data representing user actions or events related to the product, recorded during the provision of the related service.

The user is whoever owns the product, has contractual rights to use it (for example under a lease or rental), or receives the related services. The data holder is the party that has the right or obligation to use and make the data available, often the manufacturer or the service provider.

Access by design

Article 3(1) is the obligation that reaches into engineering. Connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data, "including the relevant metadata necessary to interpret and use those data", are by default easily, securely and free of charge accessible to the user, in "a comprehensive, structured, commonly used and machine-readable format", and directly accessible where relevant and technically feasible.

In practice that means deciding at the design stage how a user gets at the data: from the device itself over a local connection, through the app, through a download in the user account, or through an API. Metadata counts too: units, timestamps and field meanings that make a raw export usable.

What buyers must be told first

Before a contract to buy, rent or lease a connected product, Article 3(2) requires the seller, renter or lessor, which may be the manufacturer, to tell the user at least:

• the type, format and estimated volume of product data the product can generate;
• whether it can generate data continuously and in real time;
• whether it can store data on the device or on a remote server, and for how long it is meant to be kept;
• how the user can access, retrieve or, where relevant, erase the data, including the technical means, terms of use and quality of service.

Article 3(3) adds a longer list for the provider of a related service, given before that contract. It includes the nature, volume and collection frequency of the data, whether the data holder will use the data itself and for what, whether it intends to let third parties use it, who the data holder is and how to contact them, how to ask for data to be shared with a third party, the right to complain to the competent authority, any trade secrets in the data, and the length of the contract and how to end it.

For a product team this information has to come from the engineering facts, so it helps to keep a current record of what each device model collects, how often, and where it is stored.

When a user asks for the data

Where the user cannot access data directly from the product or service, Article 4(1) requires the data holder to make readily available data, with the metadata needed to interpret it, accessible "without undue delay", of the same quality as the data holder has, free of charge, in a structured machine-readable format, and continuously and in real time where relevant and technically feasible. The request should be possible "on the basis of a simple request through electronic means where technically feasible".

Under Article 5 the user can also ask the data holder to send the data to a third party of their choice, such as an independent repair or maintenance service. The Commission's policy page gives that example: users of connected products can choose more cost-effective repair and maintenance providers, or do the work themselves. Its Data Act explained page lists repair and maintenance services and data-based insurance as examples of aftermarket services. Companies designated as gatekeepers under the Digital Markets Act are not eligible third parties under Article 5.

Article 4(4) bars data holders from making these rights unduly difficult to use, including through choices presented in a non-neutral way or an interface designed to subvert the user's choices. That applies to the screens in your app as much as to policy.

Limits and safeguards

• Security. Users and data holders may contractually restrict access or sharing if it could undermine security requirements of the product laid down by law, with a serious adverse effect on health, safety or security of people (Article 4(2)).
• Trade secrets. These must be preserved. The data holder identifies data protected as trade secrets and agrees confidentiality measures with the user; without agreement, or in exceptional cases of likely serious economic damage, it may withhold or refuse sharing in writing and must notify the competent authority (Article 4(6) to 4(8)).
• No competing products. The user may not use the data to develop a connected product that competes with the one the data came from (Article 4(10)).
• Personal data. Where the user is not the person the data is about, personal data may only be made available where there is a valid legal basis under the GDPR (Article 4(12)). Our privacy basics guide covers the GDPR side.
• The data holder's own use. A data holder may only use readily available non-personal data on the basis of a contract with the user, and may not pass non-personal product data to third parties except to fulfil that contract (Article 4(13) and 4(14)).

Micro and small enterprises

Under Article 7(1), the Chapter II obligations do not apply to data generated by connected products made or designed, or related services provided, by a microenterprise or a small enterprise, provided it has no partner or linked enterprise that is larger and is not subcontracted to make or design the product or provide the service. The same relief applies to an enterprise that has qualified as medium-sized for less than one year, and to products for one year after a medium-sized enterprise placed them on the market. A start-up building a device for a larger brand under contract does not get the exemption for that work.

Article 7(2) also says any contract term that excludes or weakens the user's Chapter II rights to their detriment is not binding on the user.

What this means for the build

• Data inventory. List what each device and service collects, how often, in what format, and where it is stored. It feeds both the pre-contract information and the export.
• An access route. Local access on the device, an in-app or account download, an API, or a mix. Plan it before the hardware and backend are fixed.
• A documented format. Structured, machine-readable output with field descriptions and units.
• Secure access. Only the user, or a third party they authorise, should get the data; our IoT security guide covers authentication and keys.
• Third-party sharing. A way for users to authorise and later end sharing with a recipient they choose.
• Cloud design. Where data is kept and for how long is set by your IoT cloud platform setup; make sure retention matches what you tell buyers.

The Data Act is one of several EU rules for connected products. Our guide to IoT product certification covers CE marking, the radio rules and the Cyber Resilience Act.

Where to find official guidance

The Commission publishes frequently asked questions about the Data Act, which it describes as compiled with input from stakeholders to support implementation, along with non-binding model contractual terms for data access and use, guidance on vehicle data and a Data Act Legal Helpdesk. Each Member State designates competent authorities to enforce the rules. For a decision about your own product, take legal advice.

The rules may change. In the Digital Omnibus of November 2025, the Commission "proposes specific amendments to the Data Act". As of 5 November 2026 this is still a proposal: EUR-Lex lists it against the Regulation as an amendment proposed by COM(2025) 837, with no amending act adopted, so this guide describes the text currently in force.

Frequently asked questions

Does the EU Data Act apply to my connected product?

It covers connected products placed on the EU market and their related services, such as a companion app or cloud service the product needs to perform its functions. The Chapter II data access obligations do not apply to products made or services provided by micro and small enterprises that meet the conditions in Article 7. This is general information, not legal advice.

When does the Data Act apply?

The Regulation entered into force on 11 January 2024 and applies from 12 September 2025. The Article 3(1) design obligation applies to connected products and related services placed on the market after 12 September 2026.

Can we charge users for access to their data?

No. Articles 3 and 4 require product and related service data to be made accessible to the user free of charge, and Article 5 requires data shared with a third party at the user's request to be free of charge to the user.

Do we have to share trade secrets?

Trade secrets must be preserved. The data holder identifies data protected as trade secrets and agrees confidentiality measures with the user. If no agreement is reached, or in exceptional cases of likely serious economic damage, the data holder may withhold or refuse that data, must give reasons in writing and must notify the competent authority.

Can a user use the data to build a competing product?

No. Article 4(10) says the user shall not use data obtained under the Act to develop a connected product that competes with the product the data came from, or share it with a third party with that intent.

Building a connected product? We build the firmware connectivity, the backend that collects and acts on device data, and the mobile and web apps, with security planned in from the first prototype. See our IoT development service and all our services, or email [email protected].