The EU Data Act comes into force today in all member states. The legislation gives companies and consumers more control over their data and makes it easier to switch between cloud providers. Tech giants are already scrapping data transfer fees.
The Data Act was initially set to take effect in January 2024. The provisions will come into force in EU member states on September 12, 2025. The regulations will bring significant changes for millions of users of smart devices, IoT devices, and cloud services.
For example, the new rules make it easier for users of cloud platforms to switch between different providers. This should stimulate the European cloud market and prevent vendor lock-in. Insights gained from analytics and AI must be retained when switching cloud platforms.
The law complements the Data Governance Act of 2023. Whereas that law regulated processes for voluntary data exchange, the Data Act now determines who can create value from data and under what conditions. Together, both laws aim to establish a reliable European data market.
Cloud switching is actually becoming easier
Google anticipated this change by announcing two days before it came into effect that it would eliminate data transfer costs for organizations that process workloads in parallel on multiple cloud platforms in Europe and the United Kingdom. The “Data Transfer Essentials” initiative goes beyond what the law requires.
Microsoft introduced cost-based data transfer fees last month, while Amazon Web Services reports that customers can request lower rates for specific use cases.
Consequences for businesses
The legislation also sets clear requirements for manufacturers of connected products. From now on, they must design their devices in such a way that users can access their data easily and securely. The European Commission is developing model contracts to assist companies in facilitating fair data exchange.
Additionally, the law addresses the abuse of power. Companies with a strong market position can no longer impose unfair contract terms that hinder data exchange. Government agencies will also have the right to request data from private parties in emergencies.
New rights for users
The Data Act revolves around the core principle that anyone who uses an IoT device should have access to the data it generates. This applies to consumers who buy a smart thermostat, but also, for example, to farmers with connected agricultural machinery or construction companies with smart vehicles.
Data generation has become an essential part of modern devices. With traditional products, you get all the components, but with IoT devices, new data is continuously generated during use. That data now becomes an independent component of the product.
Users may also share this data with external parties. This allows independent repair companies, for example, to improve their services and compete with manufacturers. Ultimately, this should lead to lower prices and a longer lifespan for devices.
Grace Carter, government affairs advisor at Elastic, describes the impact: “The implementation of the EU Data Act represents a shift towards greater control for users, particularly in terms of how data is shared and used. It gives consumers and businesses in the EU the rights to access, share, and move the data they generate.”
The legislation focuses on data that is currently mainly accessible to device manufacturers. For example, car users will now be able to share their driving data with a garage for maintenance. Companies will have access to usage data from industrial machines to optimize their processes.
Emergency access for governments
The regulation also offers new opportunities for government agencies. In public emergencies such as natural disasters or cyberattacks, they will have access to private user data when necessary for a safe response.
This provision reflects the growing need for cooperation between the public and private sectors during crisis situations. The precise balance between national security and individual privacy will be further developed.
Challenges in implementation
The Data Act also presents challenges. Carter points to a major practical problem: “Data is fragmented. It involves structured and unstructured data spread across cloud, on-premises, and hybrid systems.”
According to her, to truly reap the benefits of the new possibilities, organizations need a way to unite and analyze this scattered data in near real-time. An integrated data platform that connects different environments is therefore essential.
Deloitte emphasizes that the Data Act presents both challenges and opportunities for business models and operational processes. Its broad scope affects virtually all sectors, from manufacturing and IoT to transportation and government services.
The coming months will reveal how companies and consumers deal with their new rights and freedoms under the EU Data Act.
Tip: Data Act requires organizations to share data with governments