EU Data Act
What is the EU Data Act?
When consumers buy a ‘traditional’ physical product, they own all the parts and accessories. However, when someone buys a connected product (such as a smart watch or a smartphone) it is not always clear what happens to the data it generates.
With the global economy’s increasing reliance on big data, there is a clear need to make it easier for people, businesses and organisations to access, share and use data. It is also important to reduce imbalances between large corporations, smaller businesses and individual users in relation to data access and sharing.
The EU Data Act (2023/2854) came into force across the EU on 12 September 2025 to address these concerns. Among other things, it:
- Gives users of connected products greater control over the data they generate
- Requires data holders, such as manufacturers and service providers, to share data with users fairly, without delay and free of charge
The Act aims to increase fairness, competition and innovation in the data economy across the EU.
What is covered by the Data Act?
The Data Act covers a range of data-related activities, such as how data from connected products are used and the right to switch providers for storing data on the cloud. It also covers how data can be requested by public sector bodies in certain situations, such as during a public emergency or natural disaster.
What is a connected product?
A connected product is a device, piece of equipment or machine that is electronically connected, for instance to the internet, generates or collects data on the product’s performance, use or environment and communicates that data electronically.
Examples include:
- Wearable devices, such as fitness trackers or watches
- Smartphones and smart TVs
- Smart home systems, for example app-controlled lighting, heating or alarms
- Connected vehicles, for example to collect and share data on road conditions
- Connected medical devices
- Connected industrial and agricultural machinery
What is a related service?
A related service is a digital service, such as an app, software or remote monitoring, that makes a product work properly or helps improve or update its features. It can be included with a connected product upfront or added later by the manufacturer or another party.
Together, connected products and related services create a network called the ‘internet of things’ (IoT).
What are some of the main elements of the Data Act?
Rights for users of connected products
The Data Act defines users as individuals or entities that own, lease or rent a connected product.
The Act gives users of connected products the right to:
- Access and use the data they generate from using those products free of charge
- Share that data with third parties of their choice, for example to get repairs or upgrades or receive professional advice
Obligations on data holders
Data holders are typically manufacturers of connected products or providers of related services.
The Act requires data holders to:
- Make data directly accessible or provide data to a user without undue delay
- Share data fairly and transparently
- Provide data to a user free of charge
- Share data in a manner that safeguards security, individual privacy and intellectual property
- Ensure fairness and clarity in data sharing agreements
Data holders must also ensure that all products and related services placed on the EU market from 12 September 2026 are designed with direct data access in mind. Instead of users needing to request access to the data generated from connected products, data holders are required, where technically feasible, to design products and services that allow users to access relevant data directly, by default.
In practice, enabling users to access data more easily through, for example, a built-in interface, an app or another technical tool moves the Data Act from an access-on-request model to an access-by-design approach. Making data access more straightforward from the moment a connected product or related service is used benefits both consumers and businesses.
How businesses can adapt to “access by design” requirements
Data holders should review the design of their connected products or related services to make sure they meet the “access by design” requirements from September 2026. In particular, they should assess if data access is provided directly to users or provided indirectly through a request mechanism. If direct access is not provided, data holders should be able to demonstrate and document the reasons.
What are the CCPC’s powers under the Data Act?
The CCPC expects it will be a competent authority under the Data Act.
*The full scope of CCPC’s powers as competent authority is not yet final. The Irish legislation giving effect to the Data Act, and confirming CCPC’s powers, is expected in the coming months.
Further information
European Commission FAQ document regarding the Data Act.
European Commission non-binding Model Contractual Terms for data access.
The European Commission runs a Data Act Legal Helpdesk. This aims to make compliance easier, support informed decisions, and help organisations get the most out of the Data Act. You can submit a question through the legal helpdesk here.
Disclaimer: All information on this page is correct as at September 2026 and is subject to change.
We will communicate further details on CCPC’s powers before the Irish legislation comes into effect. Please check back for updates to our website.
