The EU Data Act: A Guide to the New Rules for Connected Device Data, IoT, and Cloud Switching

For the past decade, the data economy has operated on a simple, unspoken rule: whoever builds the hardware keeps the data. A modern connected car generates terabytes of telemetry, a smart factory machine logs every vibration, and a wearable fitness tracker maps every heartbeat. Yet, the businesses and consumers who purchased these devices rarely owned the resulting data. Instead, it was beamed back to the manufacturer's proprietary cloud, locked in a silo, and often monetized or used to force customers into expensive, authorized repair networks.[2]

The European Union's Data Act, which took its first major effect in September 2025, fundamentally rewrites these rules. Described by legal analysts as the most significant overhaul of European data law since the General Data Protection Regulation (GDPR), the Act shifts the balance of power away from hardware manufacturers and cloud giants, placing data access rights directly into the hands of the user.[2]

The core mechanism of the Data Act is a mandated right of access and portability. Under the regulation, users—whether they are individual consumers or large enterprise businesses—have the legal right to access the data generated by their connected products. More importantly, they can demand that the manufacturer share this data in real-time with a third party of the user's choosing.[1]

This sharing mechanism is designed to break up aftermarket monopolies. For example, a logistics company operating a fleet of connected trucks can now route the vehicles' diagnostic data directly to an independent, third-party repair shop, rather than being forced to rely exclusively on the original manufacturer's service network. The manufacturer is legally obligated to facilitate this transfer on fair, reasonable, and non-discriminatory (FRAND) terms.[1]

While the core access rights went live in 2025, the technology industry is currently racing toward the next critical milestone: September 12, 2026. From this date forward, all new connected products placed on the EU market must comply with strict "data-by-design" obligations. Manufacturers can no longer treat data extraction as an afterthought or a cumbersome manual process; devices must be engineered from the ground up to make data easily, securely, and directly accessible to the user by default.

The scope of the regulation is vast. It applies to both personal and non-personal data, covering the entire Internet of Things (IoT) ecosystem—from smart home appliances and wearables to industrial robotics and medical devices. Crucially, the Data Act has an extraterritorial reach. Any company offering connected products or data processing services to customers in the EU must comply, regardless of where the company is headquartered. Non-EU companies are required to designate a legal representative within a member state to ensure accountability.

Beyond connected hardware, the Data Act takes aggressive aim at the cloud computing sector. For years, enterprise customers have complained of "vendor lock-in," where hyperscale cloud providers make it technically difficult and financially punitive to migrate data and workloads to a competitor. The Data Act introduces mandatory cloud switching requirements for providers of Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS).

Under these new rules, cloud providers must allow customers to transition to a rival service within a maximum of 30 days. During this transition, the original provider must maintain functional parallel use and provide open interfaces to ensure technical equivalence at the target destination. The financial barriers to switching are also being dismantled. By January 12, 2027, all cloud switching fees—including data egress charges—will be completely prohibited by EU law.

To protect smaller enterprises from being bullied in negotiations, the Data Act introduces a "blacklist" and "greylist" of unfair contractual terms. If a large data holder attempts to force a one-sided data-sharing agreement on a small or medium-sized enterprise (SME), those terms can be deemed legally void. This ensures that the theoretical right to data access isn't undermined by aggressive corporate lawyering.

The regulation also includes provisions for business-to-government (B2G) data sharing. In exceptional circumstances, such as a public health emergency or a major natural disaster, public sector bodies and EU institutions can mandate access to privately held data if it is strictly necessary to respond to the crisis. This ensures that critical telemetry—such as mobility data during a flood—can be utilized for the public good without waiting for commercial negotiations.[2]

Enforcement of the Data Act is decentralized, with individual EU member states responsible for designating competent authorities and levying penalties. However, the financial risks of non-compliance are severe. Mirroring the GDPR's penalty structure, fines for violating the Data Act can reach up to 4% of a company's global annual revenue or EUR 20 million, whichever is higher. This has elevated Data Act compliance from a mid-level IT issue to a board-level priority.

Despite the law being in effect, significant areas of uncertainty remain, particularly around the definition and protection of "trade secrets." Hardware manufacturers have argued that raw telemetry data is often inextricably linked to proprietary algorithms and intellectual property. While the Data Act allows manufacturers to withhold data if sharing it would cause serious economic damage through the exposure of trade secrets, the threshold for proving this is high, and the European Commission has warned against using trade secrets as a blanket excuse to deny access.[2]

As the September 2026 data-by-design deadline approaches, the engineering burden on IoT companies is immense. Hardware architectures are being redesigned, firmware is being updated to support open APIs, and legal teams are rewriting thousands of B2B contracts. The transition is costly and complex, but it marks a permanent shift in the digital economy: data is no longer a proprietary asset to be hoarded, but a fluid resource that follows the user.[2]