The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

Regulation (EU) 2023/2854

The Data Act: which chapter reaches you

Who it applies to
Anyone who places connected products on the market, provides services for them, uses them, receives their data, runs a cloud or edge service, or sells smart contracts for data agreements.
The dates
Applies since 12 September 2025. Access by design reaches products placed on the market after 12 September 2026, and switching charges end on 12 January 2027.
The one thing to do
Make the product's data reachable, tell the buyer what it generates, answer a user's request, and for a cloud service drop the switching barriers and the charges.

Which chapter reaches you?

Eleven answers, read by the same determination the portal runs. Nothing you pick is sent or stored.

What you do

Do you place connected products on the EU market?

Article 2(5): a product that obtains, generates or collects data about its use or environment, and can communicate it. Placing one on the market makes you a data holder under Chapter II.

Do you provide related services for a connected product?

Article 2(6): a digital service, software included, so connected to the product that its absence would prevent a function. Its provider is a data holder too.

Does other Union law oblige you to make data available to a recipient?

Article 12(1) puts Chapter III's terms on that sharing wherever another act requires it: fair, reasonable and non-discriminatory terms, and transparent conditions.

Do you use connected products or related services in your own business?

Article 2(12): a user owns the product or holds the right to use it. A user may ask the data holder for the data, and may have it shared with a third party under Article 5.

Do you receive data from a data holder at a user's request?

Article 2(14) calls that a data recipient. Chapter III sets what you may do with the data and Article 6 what you may not.

Do you provide a data processing service, cloud or edge?

Article 2(8). Chapter VI is the switching chapter: the contract terms of Article 25, the duties of Articles 23 to 26, and the end of switching charges.

Do you offer smart contracts for executing data sharing agreements?

Article 36 puts essential requirements on the vendor of such a smart contract: robustness and access control, safe termination, data archiving and continuity.

The enterprise

How large is the enterprise?

Recommendation 2003/361/EC. Article 7(1) excludes Chapter II's obligations for a micro or small enterprise, and for a medium one in its first year as a medium one.

Is a partner or linked enterprise of yours larger than small, or are you its subcontractor?

Article 7(1) withholds the exclusion where the enterprise is linked to a larger one or subcontracted by one, so the size on its own does not settle it.

Answer each question and the reading appears here.

The three days

  • The Regulation applies12 September 2025
  • Access by design, for products placed on the market after12 September 2026
  • Switching charges end12 January 2027

The duties underneath

154 rows, in the Regulation's own order and under its own article headings.

  • 3(1)Design the product so the user reaches its data
  • 3(2)Tell the buyer beforehand what data the product generates
  • 3(3)Tell the user what data the related service generates
  • 4(1)Give the user their data without undue delay, free
  • 4(2)Notify the authority when you refuse on security grounds
  • 4(3)A security restriction can be challenged
  • 4(4)Never make the user's choices unduly difficult
  • 4(5)Ask only what is needed to verify a user
  • 4(6)Protect trade secrets before disclosing data
  • 4(7)Explain withheld trade secrets in writing and notify
  • 4(8)Refuse for serious economic damage only, in writing
  • 4(9)The user can challenge a refusal or suspension
  • 4(10)Do not use obtained data for a competing product
  • 4(11)Never coerce or exploit gaps to get at data
  • 4(12)Share others' personal data only on a legal basis
  • 4(13)Use non-personal product data only under a user contract
  • 4(14)Give third parties non-personal data for the contract only
  • 5(1)Share the user's data with their chosen third party
  • 5(2)Test data for unlaunched products is outside Article 5(1)
  • 5(3)Gatekeepers are not eligible third parties
  • 5(4)Verify a user or third party with minimal information
  • 5(5)Never coerce or exploit gaps to get at data
  • 5(6)Do not profile the third party from shared data
  • 5(7)Share others' personal data only on a legal basis
  • 5(8)Failing to agree never blocks the data subject's portability
  • 5(9)Disclose trade secrets to third parties only when necessary
  • 5(10)Explain withholding from a third party in writing
  • 5(11)Refuse a third party only for serious economic damage
  • 5(12)The third party can challenge a refusal or suspension
  • 5(13)The right leaves data subjects' rights untouched
  • 6(1)Process shared data only as agreed with the user
  • 6(2)(a)Never make the user's choices unduly difficult
  • 6(2)(b)Do not profile with the data beyond the service
  • 6(2)(c)Pass the data on only under a user contract
  • 6(2)(d)Never give the data to a gatekeeper
  • 6(2)(e)Do not use the data for a competing product
  • 6(2)(f)Do not use the data to harm product security
  • 6(2)(g)Respect the agreed trade-secret measures
  • 6(2)(h)Never stop a consumer from sharing the data further
  • 7(1)Micro and small enterprises are outside Chapter II
  • 7(2)Terms that cut the user's rights do not bind
  • 8(1)Share data with recipients on fair, reasonable, non-discriminatory terms
  • 8(2)Terms cutting the user's rights do not bind
  • 8(3)Treat comparable data recipients alike
  • 8(4)Share with a recipient only when the user asks
  • 8(5)Ask only what verifying the agreed terms needs
  • 8(6)No duty to disclose trade secrets beyond the law
  • 9(1)Charge reasonable, non-discriminatory compensation, margin allowed
  • 9(2)Base the compensation on the costs and the investment
  • 9(3)Compensation may reflect volume, format and nature
  • 9(4)Charge SMEs and research bodies the costs at most
  • 9(6)Other law may lower or exclude compensation
  • 9(7)Show the recipient how the compensation is calculated
  • 10(1)Use a certified dispute settlement body for data disputes
  • 10(3)Bear the fees when the dispute goes against you
  • 10(4)Customers may take a dispute to a certified body
  • 10(12)A dispute body's decision binds only if agreed beforehand
  • 10(13)The courts stay open whatever the dispute body decides
  • 11(1)Protect the data technically, but never block lawful access
  • 11(2)Erase or stop using data when the holder demands
  • 11(3)Misuse of the data triggers the Article 11(2) remedies
  • 11(4)A user who breaks protection measures faces Article 11(2)
  • 11(5)Users get the holder's remedies against a misusing recipient
  • 12(1)Chapter III applies when law obliges you to share
  • 12(2)Terms excluding Chapter III do not bind
  • 13(1)Do not impose unfair data terms on another company
  • 13(2)Terms that mirror mandatory Union law are not unfair
  • 13(3)Test each term against good commercial practice
  • 13(4)Drop the terms the Act always treats as unfair
  • 13(5)Review the terms presumed to be unfair
  • 13(6)Be ready to prove a term was negotiated
  • 13(7)An unfair term falls and the contract survives
  • 13(8)Price and main subject matter are outside the test
  • 13(9)Do not contract out of Article 13
  • 14Give data to a public body with exceptional need
  • 15(1)Check the request shows an exceptional need
  • 15(2)Micro and small companies are outside point (b)
  • 17(1)Check the request names what Article 17(1) requires
  • 17(2)Check the request is written, specific and proportionate
  • 17(5)Complain if a body passes your data on wrongly
  • 18(1)Make the requested data available without undue delay
  • 18(2)Decline a request within 5 or 30 working days
  • 18(3)Name the body that asked first, if you decline
  • 18(4)Anonymise personal data, or pseudonymise where needed
  • 18(5)Disputes over a request go to the competent authority
  • 19(2)Never use the data to compete with the holder
  • 19(3)Mark the data that are trade secrets
  • 20(1)Give emergency data free of charge
  • 20(2)Claim fair compensation, and show how you priced it
  • 20(3)Small companies may be paid for emergency data too
  • 20(4)No fee for official statistics where purchase is barred
  • 20(5)A public body may contest your compensation claim
  • 21(5)Expect notice before your data goes to researchers
  • 22(3)A foreign request comes through your own authority
  • 23Let customers switch to another provider or on-premises
  • 24Your duties cover only what you provide yourself
  • 25(1)Put the switching rights and duties in the contract
  • 25(2)(a)Let the customer switch or port within the transition
  • 25(2)(b)Support the customer's exit strategy with all relevant information
  • 25(2)(c)State when the contract ends after switching or erasure
  • 25(2)(d)Keep the switching notice period under two months
  • 25(2)(e)List every category of data and assets that ports
  • 25(2)(f)List the internal data exempt from export
  • 25(2)(g)Give at least 30 days for retrieval after transition
  • 25(2)(h)Guarantee full erasure after the retrieval period
  • 25(2)(i)State the switching charges, within Article 29
  • 25(3)Let the customer notify a switch, port or erasure
  • 25(4)Say within 14 working days if transition is unfeasible
  • 25(5)Let the customer extend the transitional period once
  • 26Publish the switching procedures and an online register
  • 27Cooperate in good faith to make switching work
  • 28(1)Publish the infrastructure location and the data protections
  • 28(2)Name that website in every contract
  • 29(1)Charge nothing for switching from the date set
  • 29(2)Until then, only reduced switching charges
  • 29(3)Keep reduced charges within your direct switching costs
  • 29(4)Disclose fees and early termination penalties before contract
  • 29(5)Warn where switching is complex, costly or impossible
  • 29(6)Publish that information on your website
  • 30(1)Infrastructure services: ensure functional equivalence after switching
  • 30(2)Other services: offer open interfaces to all customers equally
  • 30(3)Follow the common specifications and harmonised standards
  • 30(4)Keep the online register of standards up to date
  • 30(5)Export data in a structured, machine-readable format
  • 30(6)No new technology or protected assets are owed
  • 31(1)Custom-built services are outside parts of this Chapter
  • 31(2)Time-limited test versions are outside this Chapter
  • 31(3)Tell the customer beforehand which duties will not apply
  • 32(1)Guard non-personal data against unlawful foreign access
  • 32(2)Foreign orders bind only through an international agreement
  • 32(3)Without an agreement, transfer only on the three conditions
  • 32(3)-2Ask the national body when an order is doubtful
  • 32(4)Give only the minimum data the request allows
  • 32(5)Tell the customer before answering a foreign request
  • 33(1)(a)Describe the dataset, its licence, method and quality machine-readably
  • 33(1)(b)Publish the data structures, formats and vocabularies
  • 33(1)(c)Describe the APIs, their terms and their service quality
  • 33(1)(d)Enable interoperable tools such as smart contracts where applicable
  • 33(3)Meet the harmonised standards and you are presumed compliant
  • 34(1)Parallel use: the switching duties apply to you too
  • 34(2)Charge egress only for the costs of parallel use
  • 36(1)(a)Make the smart contract robust with access control
  • 36(1)(b)Build in safe termination and interruption
  • 36(1)(c)Archive the transaction data and logic on termination
  • 36(1)(d)Control access at the governance and contract layers
  • 36(1)(e)Keep the smart contract consistent with the agreement
  • 36(2)Assess conformity and draw up the declaration
  • 36(3)Take responsibility for the declaration you draw up
  • 36(4)Meet the harmonised standards and you are presumed compliant
  • 50-2The Act applies from its application date
  • 50-3Design new products for data access from the date
  • 50-4Chapter III covers sharing duties created after the date
  • 50-5Chapter IV covers contracts concluded after the date
  • 50-6Review older long-running contracts by the second date

This page in:DeutschFrançaisNederlandsEspañolDansk