The European Union’s Data Act, which entered into force on January 11, 2024, and becomes fully applicable in September 2025, represents a significant shift in the data economy landscape. This legislation aims to enhance data accessibility and fairness across all sectors, impacting businesses within and outside the EU.
The European Commission estimates that approximately 80% of industrial data remains unused, and this regulation seeks to unlock that potential, potentially generating an additional €270 billion in GDP by 2028.
Understanding the EU Data Act
The Data Act is a central component of the EU’s strategy to create a single market for data, facilitating its use and re-use to drive innovation and economic growth.
The Data Act is a product of the big data age—covering everything from personal info to valuable business data. It’s all about boosting the EU’s competitiveness, as long as it also protects people’s and companies’ rights. That’s why it gives users more control over their data and makes it easier for businesses to switch between cloud or data service providers. It also puts rules in place to stop illegal data transfers and pushes for common standards so data can be reused more easily across different industries.
Why UK Companies Should Pay Attention
Even though the UK is no longer part of the EU, the Data Act still has significant implications for UK-based businesses—especially those offering connected products or digital services within the EU market. If your company handles data from EU users or devices, you may need to comply with new rules on data access, sharing, and portability. This is particularly important for businesses involved in IoT, cloud services, or cross-border data partnerships.
Aligning with the Data Act not only helps ensure compliance but also positions UK companies as trustworthy, future-ready partners in the increasingly regulated European digital ecosystem.
What Does the Data Act Involve?
The Data Act encompasses a wide range of data-related activities and introduces a comprehensive regulatory framework to ensure more equitable access to data:
- Clarifies data ownership and access rights, particularly regarding IoT and connected devices.
- Establishes mandatory data sharing obligations for businesses in specific circumstances.
- Introduces conditions under which public sector bodies can request access to privately held data.
- Defines guidelines for switching cloud and edge services, including portability and interoperability requirements.
- Creates transparency obligations around data usage and sharing practices.
- By providing a legal framework for data access and reuse, the Act aims to empower users, stimulate innovation, and foster competitive digital services across Europe.
Who is Affected by the EU Data Act?
- IoT and other connected products/services manufacturers in the EU
- Users (Individual and Enterprise) of these products and services
- Data recipients in the EU
- Public sector bodies in the EU
- Providers of data processing services who offer these services in the EU
Key Provisions of the Data Act
The Data Act introduces several critical measures:
- User Data Access: Users of connected devices (e.g., IoT products) are granted rights to access data generated through their use.
- Business-to-Business (B2B) Data Sharing: Establishes fair, reasonable, and non-discriminatory terms for data sharing between businesses, aiming to prevent larger entities from imposing unfair contractual terms on smaller enterprises.
- Business-to-Government (B2G) Data Sharing: In cases of public emergencies, private sector data can be accessed by public sector bodies to aid in response efforts.
- Cloud Service Portability: Mandates that cloud service providers facilitate easier switching between services, enhancing competition and reducing vendor lock-in.
- Interoperability Standards: Promotes the development and adoption of open interoperability specifications and harmonized standards to ensure seamless data flow across different services and sectors.
Where the Data Act Fits In: Linking the EU’s Digital Laws
The EU Data Act along with the AI Act, and Data Governance Act are all part of the EU’s plan to build a safer and more competitive digital economy. The AI Act makes sure that AI systems are safe, fair, and respect people’s rights. But for AI to work well—especially in sensitive or high-risk areas—it needs access to good-quality data. That’s where the Data Act comes in. It makes it easier for businesses to access data from connected devices and services, which helps AI developers and startups build better tools. At the same time, the Data Governance Act helps create safe and reliable ways for data to be shared across the EU.
Together, these laws support innovation, make data sharing easier, and help ensure that AI in Europe is both powerful and trustworthy.
Figure: Connecting the Dots: How the Data Act, AI Act, and Data Governance Act Work Together
How Does the Data Act Impact Industries?
Industries across Europe and globally will feel the ripple effects of the Data Act:
- Manufacturing & IoT: Manufacturers of connected devices will need to enable users to access and share the data their products generate.
- Cloud Providers: Will face strict rules on service switching, data portability, and restrictions on unjustified barriers.
- Public Services & Emergency Response: Government bodies will gain rights to request data in cases of public emergencies or exceptional need.
- Startups and SMEs: Could benefit from fairer data access rules, enabling more innovation and competition.
- Tech & SaaS Companies: May need to redesign service architectures to comply with interoperability standards and data-sharing obligations.
- These shifts will create both compliance burdens and opportunities for those who adapt early.
Implications for Your Business
The Data Act’s broad scope means that its provisions will likely impact various aspects of your operations:
- Compliance Obligations: Businesses must assess and potentially revise their data management practices to align with new access and sharing requirements.
- Contractual Adjustments: Existing contracts may need to be renegotiated to comply with fairness provisions, particularly concerning data sharing terms.
- Operational Changes: Companies may need to invest in new technologies or systems to facilitate data portability and interoperability.
- Strategic Opportunities: Enhanced data access can open avenues for innovation, enabling the development of new products and services.
What Should Be Remembered?
As organizations prepare for compliance, it’s essential to retain the following takeaways:
01. Proactive Preparation: Begin now with a gap analysis and a roadmap to align data operations with regulatory requirements.
02. Legal and Technical Readiness: Understand both the legal implications and the technical infrastructure needed to comply with the Act.
03. Fair Data Sharing Policies: Adopt internal policies that ensure fairness, transparency, and security in data access and reuse.
04. Value Creation through Compliance: View the Act not just as a compliance burden, but as a framework to unlock new revenue streams, improve customer trust, and enable data-driven services.
How Quaylogic Can Support Your Transition
At Quaylogic, we understand the complexities introduced by the Data Act and are prepared to assist your business in navigating these changes through a range of data solutions:
- Compliance Assessments: Conduct thorough evaluations of your current data practices to identify areas requiring adjustment.
- Data Privacy Implementation: We establish data privacy functions and implement tooling to protect your data and maintain compliance through tailored solutions.
- Technological Solutions: Provide guidance on implementing systems that support data portability and interoperability, reducing potential operational disruptions.
- Data-Centric Regulatory Change: Help identify opportunities arising from enhanced data access, ensuring long-term regulatory compliance, readiness and adaptability
Act Now to Stay Ahead
With the Data Act’s applicability approaching in September 2025, proactive steps taken today can ensure compliance and position your business to capitalize on the opportunities it presents. Delaying action may lead to compliance challenges and missed strategic advantages.
Contact us today to schedule a consultation and begin your journey toward seamless compliance and strategic growth in the new data landscape.
About the Author
For more than 30 years, Geoff Smith, Data Practitioner at Quaylogic, has led commercially focused data privacy and empowerment functions, developing, operating and transforming data systems and culture. He is a Visiting Professor at Loughborough University focusing on Digital Ethics and Trust Economies, Innovation, Leadership and Empowerment Technology.
Geoff is an advocate for sustainable development he is an ethical advisor on the UK Government National Digital Twin Program and member of the working group for digital decarbonization.
