EU Data Act
When you buy a ‘traditional’ product, you own all the parts and accessories. However, when you buy a connected product (such as a smart watch or a smartphone) it is not always clear what happens to the data it generates. It might even be the case that only the manufacturer can access and use that data.
With the global economy’s increasing reliance on big data, there is a clear need to make it easier for people and organisations to access, share and use data. It is also important to reduce imbalances between large corporations and individual users and smaller businesses around accessing and sharing data.
Among other things, the EU Data Act (2023/2854) regulates access to the data generated from connected products and related services. It gives users of connected products greater control over the data they generate and requires that data holders, such as manufacturers and service providers, share data with users fairly, without delay and free of charge. It will increase fairness, competition and innovation in the data economy across the EU.
It came into effect on 12 September 2025.
What is covered by the Data Act?
The Data Act covers a range of data related activities, such as how data from your connected products is used and your rights to switch providers for storing data on the cloud. It also covers how data can be requested by public sector bodies, in certain situations such as during a public emergency or natural disaster.
What is a connected product?
A connected product is a device, piece of equipment or a machine that is electronically connected, for instance to the internet, and generates or collects data on the product’s performance or use. Examples include:
- Wearable devices, such as fitness trackers or watches
- Smartphones and smart TVs
- Smart home systems, for example app-controlled lighting, heating or alarms
- Connected vehicles, for example to collect and share data on road conditions
- Industrial and agricultural machinery
- Medical devices
- Commercial equipment
What is a related service?
A related service is a digital service (like software or an app) that is included with a connected product when you buy, rent or lease it or is added later by the manufacturer or another party.
The service is related because it is essential to make the product work properly and/or helps improve or update the product’s features.
Together, these products and services create a network called the ‘internet of things’ (IoT).
What are some of the main elements of the Data Act?
Rights for users of connected products
The Act gives users of connected products the right to:
- Access and use the data they generate from using those products, for free
- Share that data with third parties of their choice, for example to get repairs or upgrades or receive professional advice
A user is defined as an entity or an individual that owns, leases or rents a connected product.
Obligations on data holders
The Act imposes obligations on data holders (typically manufacturers or digital service providers) to:
- Make data directly accessible or provide data to a user without undue delay
- Share data fairly and transparently
- Provide data to a user free of charge
- Share data in a manner that safeguards security, individual privacy and intellectual property
- Make all new products that enter the market from September 2026 onward fully compliant with the Data Act
- Ensure fairness and clarity in data sharing agreements
What are the CCPC’s powers under the Data Act?
CCPC expects it will be a competent authority under the Data Act
*The full scope of CCPC’s powers as competent authority is not yet final. The Irish legislation giving effect to the EU Data Act, and confirming CCPC’s powers, is expected in 2026.
Disclaimer: All information on this page is correct as of the entry into force of the EU Data Act on 12 September 2025 and is subject to change.
We will communicate further details on CCPC’s powers before the Irish legislation comes into effect. Please check back for updates to our website.
Return to Guidelines for Business
