Regulationsby GlyphEU Data Act
In force European Union · In force Jan 11, 2024 · next deadline Jan 12, 2027 (in 3 months)
Deadlines
Coming up
Cloud switching charges abolishedProviders of data processing services may no longer impose any switching charges on customers (Art 29(1)).
Unfair-terms rules extend to older long-term contractsChapter IV (unfair contractual terms) applies to contracts concluded on or before 12 Sep 2025 that are of indefinite duration or expire at least 10 years from 11 Jan 2024 (Art 50).
Commission evaluationCommission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).
Already passed
Access-by-design for new connected productsArt 3(1) design obligation (product data and related service data accessible to the user by default) applies to connected products and related services placed on the market after 12 Sep 2026.
Data Act appliesMost obligations apply, including user data access and sharing (Chapters II-III), cloud switching (Chapter VI) and interoperability; Chapter IV unfair terms apply to contracts concluded after this date (Art 50).
Member States notify penalty rulesMember States had to notify the Commission of their penalty rules (Art 40(2)).
Data Act enters into forceEntered into force on the twentieth day after publication in the OJ on 22 Dec 2023 (Art 50).
Reduced switching charges period beginsFrom 11 Jan 2024 to 12 Jan 2027, data processing providers may charge only reduced switching fees, capped at costs directly linked to switching (Art 29(2)-(3)).
Summaries for reference, not legal advice. Check the official text.
What it does
Gives users of connected products and related services the right to access and share the data those products generate, and sets rules for business-to-business data sharing. It bans unfair data-sharing contract terms imposed on businesses and lets public bodies obtain data in cases of exceptional need. Cloud and other data processing service providers must make switching easy, and switching charges are phased out.
- Who it applies to
- Manufacturers of connected products and providers of related services placed on the EU market; data holders and data recipients; providers of data processing services (cloud/edge) to EU customers; participants in data spaces. Micro and small enterprises are exempt from some data-holder obligations.
- Penalties
- Set by Member States (Art 40), which had to notify their rules by 12 Sep 2025. Where personal data is involved, data protection authorities may impose GDPR-level fines (up to EUR 20M or 4% of worldwide turnover).
- Enforced by
- National competent authorities designated by each Member State (data coordinator); data protection authorities for personal data; European Data Innovation Board (EDIB)
- Official name
- Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)
- Citation
- OJ L, 2023/2854, 22.12.2023
- Topics
- Data access and sharing, Privacy
Research notes
The Digital Omnibus proposal COM(2025) 837 would amend the Data Act and fold in the Data Governance Act, Free Flow of Non-Personal Data Regulation and Open Data Directive. Still under negotiation as of Sept 2026 (Legislative Train status 'tabled', 1 Aug 2026), so no Data Act dates have changed.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 months
Questions about EU Data Act
- What are the EU Data Act compliance deadlines?
- Jan 11, 2024: Data Act enters into force. Jan 11, 2024: Reduced switching charges period begins. Sep 12, 2025: Data Act applies. Sep 12, 2025: Member States notify penalty rules. Sep 12, 2026: Access-by-design for new connected products. Jan 12, 2027: Cloud switching charges abolished. Sep 12, 2027: Unfair-terms rules extend to older long-term contracts. Sep 12, 2028: Commission evaluation.
- When does EU Data Act take effect?
- EU Data Act took effect on Jan 11, 2024. The next milestone is Jan 12, 2027: Cloud switching charges abolished.
- Who does EU Data Act apply to?
- Manufacturers of connected products and providers of related services placed on the EU market; data holders and data recipients; providers of data processing services (cloud/edge) to EU customers; participants in data spaces. Micro and small enterprises are exempt from some data-holder obligations.
- What are the penalties under EU Data Act?
- Set by Member States (Art 40), which had to notify their rules by 12 Sep 2025. Where personal data is involved, data protection authorities may impose GDPR-level fines (up to EUR 20M or 4% of worldwide turnover).