Regulation · directly applicable · CELEX 32023R2854
Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data
Official text: Regulation (EU) 2023/2854 (Data Act)Tier 1 · primary law
General application since 12 September 2025 (Art. 50). The Art. 3(1) design obligation applies to connected products and related services placed on the market after 12 September 2026; the switching-charge ban from 12 January 2027 (Art. 29(1)); Chapter IV's unfair-terms rules to long-running contracts concluded on or before 12 September 2025 from 12 September 2027 (Art. 50). Re-read against the milestones and the Official Journal text (CELEX 32023R2854) on 27 Sep 2026: still partly applicable. last_verified moved from 27 Aug to 27 Sep 2026 on 21 Oct 2026 (audit item 10), the date on which the status above was re-read against Arts 29 and 50 (commit 282a782); the other fields were last re-read on 27 Aug 2026.
Fair access to and use of data — predominantly non-personal, industrial and machine-generated — reallocating control over it by default.
Lock-in and contractual imbalance.
Entry into force, application and transposition are different events and are kept apart. A date at month precision is shown as a month rather than invented as a day.
4 rules in the dataset turn on this instrument. They are conditions, not a test: the engine ranks them against what you actually answer, and downgrades rather than excludes where a question is left blank.
Chapter VI is nine articles (Arts. 23-31) out of fifty and carries most of the Regulation's practical weight for the software industry. Providers of data processing services must remove all pre-commercial, commercial, technical, contractual and organisational obstacles to switching, and Article 25 prescribes the mandatory contractual terms.
Last verified 27 August 2026The Data Act reaches non-EEA providers of data processing services with customers in the Union. Establishment outside the Union is not a way out of the switching regime.
Last verified 27 August 2026From 12 September 2026 connected products must be designed and manufactured so that product and related service data are, by default, easily, securely and directly accessible to the user. This is a design obligation, not a disclosure one: it bites at the point the product is placed on the market.
Exemptions: Data holders may limit access where data qualifies as a trade secret, but must notify the national competent authority, and the user may challenge before a court. The brief records practitioner doubt about whether the confidentiality measures required of recipients are sufficient.
Last verified 27 August 2026The Data Act governs product and service data as such — personal or not, though predominantly non-personal, industrial and machine-generated, with the GDPR prevailing wherever personal data is involved — and reallocates control over it by default. An organisation may be a data holder, a user or a data recipient depending on the arrangement, and the obligations differ in each role.
Last verified 27 August 20264 provisions recorded. This is what the dataset holds, not the whole instrument — an article that is not here has not been entered, which is a different statement from its not existing.
| Article | Heading | Binds | Applies |
|---|---|---|---|
| Art. 3(1) load-bearing | Obligation to make connected product data accessible to the userConnected products must be designed and manufactured so that product and related service data are, by default, easily, securely and directly accessible to the user. | Connected-product provider · Manufacturer | Applies from 12 September 2026 |
| Art. 25 load-bearing | Contractual terms concerning switchingMandatory contractual content for switching: maximum two-month notice period; 30 calendar day transitional period (or a justified alternative not exceeding seven months where technically unfeasible); at least 30 days data retrieval afterwards; full erasure once retrieval ends. | Provider of data processing services | Applies from 12 September 2025 then from 12 January 2027: application date |
| Art. 8 | Conditions under which data holders make data available to data recipientsWhere, in business-to-business relations, a data holder is obliged to make data available to a data recipient, it must agree the arrangements on fair, reasonable and non-discriminatory terms and conditions and in a transparent manner. | Data holder | Applies from 12 September 2025 |
| Art. 13 (Chapter IV) | Unfair contractual terms related to data access and use between enterprisesChapter IV applies to contracts concluded after 12 September 2025, and from 12 September 2027 to contracts concluded on or before that date that are of indefinite duration or due to expire at least ten years from 11 January 2024 (Art. 50). | Data holder · Data recipient | Applies from 12 September 2027 |
This dataset holds no enforcement action under this instrument. That is what the record says; it is not a finding that none has been taken.
Every statement this site makes about Data Act, graded by what actually carries it. The grade is derived from the claim type and its sources, never stored, so it cannot drift from what it describes.
The instrument record itself was last verified on 27 September 2026; every claim below carries its own date.
The Data Act applies to providers of data processing services, irrespective of their place of establishment, that provide such services to customers in the Union.
Regulation (EU) 2023/2854 (Data Act) — EUR-Lex 22 December 2023 Art. 1(3)(f)
Data Act Article 25 prescribes hard-edged switching terms: maximum two-month notice to initiate switching, a 30-calendar-day transitional period (or a justified alternative not exceeding seven months where technically unfeasible), at least 30 days data retrieval afterwards, and full erasure once retrieval ends.
Regulation (EU) 2023/2854 (Data Act) — EUR-Lex 22 December 2023 Art. 25(2)(a), (d), (g), (h); Art. 25(4)
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VI
The Data Act Article 3(1) design obligation — connected products must be built so that product and related service data are accessible to the user by default — applies to connected products and related services placed on the market after 12 September 2026.
Regulation (EU) 2023/2854 (Data Act) — EUR-Lex 22 December 2023 Art. 50, third paragraph
EU Data Act — article index, Article 1 (Subject matter and scope) and Article 50 (Entry into force and application) — eu-data-act.com (unofficial reproduction of the Data Act text) Art. 50
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VI, Annex A
Ireland published the General Scheme of its Data Bill 2025 on 4 February 2026; it designates the CCPC and ComReg as competent authorities for the Data Act, and the CCPC as Data Coordinator.
General Scheme of the Data Bill 2025 — Government of Ireland — Department of Enterprise, Tourism and Employment 4 February 2026 Publication page: 'Published on: 4 February 2026'; the CCPC and ComReg 'are designated as competent authorities for the Data Act. The CCPC is also designated as the Data Coordinator'
The Data Act Part III: The Irish Enforcement Framework — Matheson 18 May 2026 Section on the General Scheme
No Data Bill had been introduced in the Oireachtas by 25 September 2026: none appears among the bills of 2025 or of 2026 in its register.
Oireachtas legislation register — bills of 2025 and 2026 (open data API) — Houses of the Oireachtas no Data Bill among the 85 bills of 2025 or the 92 of 2026 (register updated to 25 Sep 2026)
Dublin is one of Europe's main data-centre hubs, alongside Frankfurt, London, Amsterdam and Paris (the 'FLAP-D' markets).
The value of data centres to Ireland — an independent report prepared by KPMG for the Department of Enterprise, Tourism and Employment (March 2026) — Department of Enterprise, Tourism and Employment (Ireland); report prepared by KPMG 2 June 2026 Executive summary: 'a strategic European data centre hub, alongside Frankfurt, London, Amsterdam, and Paris – collectively known as the FLAP-D markets'
Almost the entire EU digital rulebook rests on Article 114 TFEU (internal-market harmonisation) rather than on a speech, safety or morality competence, and that choice shapes each instrument's form.
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part I
The Data Act's trade-secret carve-out may swallow the rule or be swallowed by it: data holders may limit access where data qualifies as a trade secret, but practitioners doubt the required confidentiality measures are sufficient.
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VI
Data Act Article 50 phases in Chapter IV for pre-existing contracts but contains no equivalent carve-out for Chapter VI, and practitioner analysis reads the switching right as applying to contracts concluded before 12 September 2025 as well; the Commission's Data Act FAQ (version 1.4, January 2026) does not address the point directly.
EU Data Act — article index, Article 1 (Subject matter and scope) and Article 50 (Entry into force and application) — eu-data-act.com (unofficial reproduction of the Data Act text) Art. 50
Understanding switching rights under the Data Act — DLA Piper 31 July 2025
Frequently Asked Questions — Data Act, Version 1.4 — European Commission 22 January 2026 Questions 42b, 52-58b
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VI
Data Act enforcement is national and therefore uneven: each Member State designates its own competent authorities, and Ireland — one of Europe's main data-centre hubs — published the General Scheme of its Data Bill only on 4 February 2026, with no Bill introduced in the Oireachtas by late September 2026.
Regulation (EU) 2023/2854 (Data Act) — EUR-Lex 22 December 2023 Art. 37(1): 'Each Member State shall designate one or more competent authorities to be responsible for the application and enforcement of this Regulation'
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VI
Sovereignty and interoperability pull in opposite directions: the Data Act was designed to mandate open interoperability and eliminate lock-in, while the proposed Cloud and AI Development Act's sovereignty requirements push toward highly secure, localised environments.
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part X
Where the GDPR governs personal data, the Data Act governs product and service data as such — personal or not, though predominantly non-personal, industrial and machine-generated, with the GDPR prevailing wherever personal data is involved — and reallocates control over it by default.
Regulation (EU) 2023/2854 (Data Act) — EUR-Lex 22 December 2023 Art. 1(2): 'This Regulation covers personal and non-personal data'; Art. 1(5): 'In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy … the relevant Union or national law on the protection of personal data or privacy shall prevail'
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VI
1 recorded interaction with other instruments — each with a direction, the provisions that carry it and its own sources. Direction is preserved as recorded: an instrument that amends another is not the same as one amended by it.
Cloud and AI Development Act In tension with Data Act
The Data Act mandates open interoperability and the elimination of lock-in; the sovereignty requirements of the proposed Cloud and AI Development Act push toward highly secure, localised environments. The two pull in opposite directions.
Recorded as at 27 August 2026