Know the Facts: Data Act
Official Source Link: Read Here
Status & Jurisdiction: Enacted - European Union & Ireland
Target Organisations: Smart Hardware Manufacturers, Connected Vehicle Providers, SaaS/Cloud Providers & IoT Startups
Compliance Ranking: 🔴 Level 3 (see here)
1. Key Takeaways
Device Data Access: Grants users of connected (IoT) devices statutory rights to access and share data generated by their usage.
Cloud Unbundling: Forces cloud providers to eliminate switching fees and ensure functional interoperability.
Public Emergency Access: Empowers public sector bodies to request private enterprise data in emergency contexts.
2. What is the Data Act?
It establishes harmonised rules on fair data access and usage rights across B2B, B2C and B2G domains. It ensures that businesses and consumers retain control over the non-personal data generated by their connected products and cloud services.
It covers manufacturers of connected devices, cloud infrastructure providers and secondary data processors operating in the EU.
3. Regulatory & Financial Impact on Businesses
Direct Obligations: IoT manufacturers must design products so data is accessible "by default" free of charge. Cloud providers must remove technical and financial barriers to vendor switching.
Indirect Supply Chain Pressures: Third-party repair providers and independent tech platforms will gain competitive access to hardware telemetry data historically monopolised by Original Equipment Manufacturers (OEMs).
Penalties for Non-Compliance: Fines are administered by national data protection authorities (e.g. Irish DPC) using the GDPR penalty scale (up to €20 million or 4% of global turnover).
4. Implementation Timeline & Key Dates
11 January 2024 - Entered into force.
12 September 2025 - Main application date for device accessibility and cloud switching obligations.
12 September 2026 - Application of design obligations for newly manufactured connected products.
