# Data Explorer

Where a building’s data goes, who holds it at each step, and what the law says its owner is owed there.

> Not legal advice. This is the author’s own reading of the law, written to help facilities managers ask better questions. It has not been reviewed by a lawyer. For decisions, read the official text and take legal advice.

Pages: [landing](https://davidjcrawford.github.io/data-explorer/) · [the trace](https://davidjcrawford.github.io/data-explorer/trace/) · [the rulebook](https://davidjcrawford.github.io/data-explorer/rulebook/) · [the EU Data Act](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/) · [the rights](https://davidjcrawford.github.io/data-explorer/rights/) · [sources](https://davidjcrawford.github.io/data-explorer/sources/) · [knowledge base](https://davidjcrawford.github.io/data-explorer/knowledge/index.md)

## The trace

Front entrance, 07:42. A credential is presented at the reader on the front door. The door unlocks. One small record, a door event, is created, and the trace follows it until it reaches the last place it goes.

An illustrative building. Two ways to build its systems: from several makers’ parts (composite), or with one company running the path (governed). Counts follow stated definitions, not a measurement.

| Stop | Place | The event becomes | Several makers: held by | One maker: held by | Copies · companies · handoffs (several / one) |
| --- | --- | --- | --- | --- | --- |
| 0 Smart lock and reader | Front entrance, ground floor | A credential read and a decision requested | Maker A | The steward | 0 · 0 · 0 / 0 · 0 · 0 |
| 1 Building controller | Riser cupboard, ground floor | A decision and a line in the controller's event log | Maker B, a shared platform | The steward | 1 · 1 · 1 / 1 · 1 · 0 |
| 2 On-prem server (head-end) | Comms room, level 2 | A row in the system of record, joined to a person and a tenancy | Software brand C | The steward | 2 · 2 · 2 / 2 · 1 · 0 |
| 3 Cloud service | A data centre | A replica, and a backup of the replica | Software brand C and Hosting provider D | The steward and Hosting provider D | 4 · 3 · 3 / 4 · 2 · 1 |
| 4 Cloud AI | A model provider | A model input, possibly training data | AI provider E | The steward and Hosting provider D | 5 · 4 · 4 / 5 · 2 · 1 |
| 5 Third party (your choice) | Wherever the recipient is | A copy delivered at the owner's request | Recipient R, the owner's choice | Recipient R, the owner's choice | 6 · 4 · 4 / 6 · 2 · 1 |

Both ways make 6 copies. 4 companies hold them in the composite stack and 2 in the governed path; the data changes hands 4 times against 1, before the owner sends it anywhere. Camera footage of the same moment leaves the site in the first and stays on site in the second.

## The rights

### The data your building makes is yours to take.

Free, machine-readable, continuous — on request, at the same quality the vendor sees.

Every reading, event and log your building generates is accessible to you by right — not as a favour, not behind a professional-services quote. The data holder must hand it over without undue delay, in the same quality it has itself.

When: 12 September 2025, applies. Articles: [4](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-4/). [Page](https://davidjcrawford.github.io/data-explorer/rights/yours/)

### You can send it to anyone — even their competitor.

Point at a third party; the vendor must deliver your data to them on the same terms.

A rival analytics platform, an energy optimiser, your own consultant: you designate, they receive. The receiving party carries duties too — purpose-bound use, no cloning the product it came from.

When: 12 September 2025, applies. Articles: [5](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-5/), [6](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-6/). [Page](https://davidjcrawford.github.io/data-explorer/rights/share/)

### New devices must be born open.

Products placed on the market after Sep 2026 must make their data accessible by design.

Data accessibility becomes a product requirement, like safety. When you specify new building systems, 'where does the data come out?' is a question the manufacturer must already have answered.

When: 12 September 2026, applies to products placed on the market from this date. Articles: [3](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-3/). [Page](https://davidjcrawford.github.io/data-explorer/rights/born-open/)

### Leaving is your right — and the exit fee is dying.

Switching between cloud services is protected now; switching charges end 12 Jan 2027.

Contracts must spell out the exit: notice, a maximum transition period, retrieval of your data, then provable erasure. Until January 2027 they may charge only their actual costs; after that, nothing.

When: 12 September 2025, switching protected; only cost-based charges; 12 January 2027, switching charges end. Articles: [23](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-23/), [25](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-25/), [29](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-29/), [30](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-30/). [Page](https://davidjcrawford.github.io/data-explorer/rights/leave/)

### Take-it-or-leave-it data clauses can't bind you.

Unfair terms imposed unilaterally about your data are void — old contracts get caught too.

The fine print stops being a moat. Unfair unilateral clauses on data access and use don't bind, and from September 2027 the protection reaches qualifying contracts signed before the Act applied.

When: 12 September 2025, applies to contracts concluded from this date; 12 September 2027, reaches qualifying older contracts. Articles: [13](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-13/), [8](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-8/), [9](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-9/). [Page](https://davidjcrawford.github.io/data-explorer/rights/fair-terms/)

### Your data can't be quietly reached across borders.

Providers must publish where it lives and shield it from unlawful foreign access.

The jurisdictions your data sits in must be published, and your provider must take real measures against foreign governmental access that would conflict with EU or national law.

When: 12 September 2025, applies. Articles: [28](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-28/), [32](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-32/). [Page](https://davidjcrawford.github.io/data-explorer/rights/borders/)

### The event log isn't their database — it's your data.

Vendors can't rebuild lock-in by claiming database rights over what your building generated.

The sui generis database right explicitly does not apply where it would obstruct your access to device-generated data. That door is closed by name.

When: 12 September 2025, applies. Articles: [43](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-43/). [Page](https://davidjcrawford.github.io/data-explorer/rights/event-log/)

## What to ask

- **EU AI Act** (Regulation (EU) 2024/1689): What may the AI legally do to the people here? Ask: Which risk class does each AI feature fall into, who holds the conformity obligations — and does anything here watch, identify or score people?
- **Cyber Resilience Act** (Regulation (EU) 2024/2847): Is the hardware born secure — and who patches it? Ask: What is the declared support period for each device — and how do security updates reach a controller that never touches the internet?
- **GDPR** (Regulation (EU) 2016/679): Is this data about people? Ask: Which of this system's data classes are personal data, who is controller and who is processor for each — and where is the processing agreement?
- **ISO/IEC 42001** (ISO/IEC 42001:2023): Is the organisation behind the AI disciplined? Ask: Is your AI management system certified to ISO/IEC 42001 — and does the certificate's scope cover this product's AI features?
- **NIS2** (Directive (EU) 2022/2555): Whose duty is it to ask? Ask: Ask yourself first: are we an essential or important entity? Then ask the vendor for the supplier-security evidence your own regulator will one day ask you for.
- **SOC 2 · ISO/IEC 27001** (AICPA TSC · ISO/IEC 27001:2022): Is the cloud disciplined with my data? Ask: Which of the services my building depends on are inside the ISO 27001 scope or the SOC 2 report — and can I read the report under NDA?

## Outside the EU

### United Kingdom

- Instead of “The data your building makes is yours to take.”: No general right. Since 20 August 2025 the government can create smart data schemes sector by sector; none covers buildings yet.
- Instead of “You can send it to anyone — even their competitor.”: No general right to send building data to a third party. A future smart data scheme could create one.
- Instead of “New devices must be born open.”: No duty to design products so their data is accessible. The product security regime covers security, not data access.
- Instead of “Leaving is your right — and the exit fee is dying.”: No statutory right to switch cloud providers, and no rule against switching charges.
- Instead of “Take-it-or-leave-it data clauses can't bind you.”: No data-specific rule against unfair terms between businesses. General contract law applies.
- Instead of “Your data can't be quietly reached across borders.”: No duty to publish where non-personal data is held. UK GDPR's transfer rules cover personal data only.
- Instead of “The event log isn't their database — it's your data.”: No carve-out: the database right still applies to databases of device-generated data.
- Ask, UK GDPR · Data Protection Act 2018: Is this data about people? Which of this system's data is personal data, who is controller and who is processor for each, and where is the processing agreement?
- Ask, NIS Regulations 2018: Whose duty is it to ask? Are we an operator of essential services or a relevant digital service provider? If so, what supplier-security evidence will our regulator expect?
- Ask, Product security regime (PSTI): Is the hardware secure by default? Does any of this equipment fall under the consumer connectable product regime, and if not, what security commitments does the maker give for it?
- Ask, ISO/IEC 42001: Is the organisation behind the AI disciplined? Is your AI management system certified to ISO/IEC 42001 — and does the certificate's scope cover this product's AI features?
- Ask, SOC 2 · ISO/IEC 27001: Is the cloud disciplined with my data? Which of the services my building depends on are inside the ISO 27001 scope or the SOC 2 report — and can I read the report under NDA?

### New Zealand

- Instead of “The data your building makes is yours to take.”: No general right. The consumer data right applies only to designated sectors: banking since 1 December 2025. Electricity retail has been decided; its rules are not final.
- Instead of “You can send it to anyone — even their competitor.”: Only in designated sectors, to accredited recipients. Building systems are not designated.
- Instead of “New devices must be born open.”: No duty to design products so their data is accessible.
- Instead of “Leaving is your right — and the exit fee is dying.”: No statutory right to switch cloud providers, and no rule against switching charges.
- Instead of “Take-it-or-leave-it data clauses can't bind you.”: No data-specific rule against unfair terms between businesses.
- Instead of “Your data can't be quietly reached across borders.”: No duty to publish where non-personal data is held. The Privacy Act's rules on overseas disclosure cover personal information only.
- Instead of “The event log isn't their database — it's your data.”: No equivalent rule.
- Ask, Privacy Act 2020: Is this data about people? Which of this system's data is personal information, who is responsible for it, and how are people told when it is collected from somewhere other than them (IPP 3A)?
- Ask, ISO/IEC 42001: Is the organisation behind the AI disciplined? Is your AI management system certified to ISO/IEC 42001 — and does the certificate's scope cover this product's AI features?
- Ask, SOC 2 · ISO/IEC 27001: Is the cloud disciplined with my data? Which of the services my building depends on are inside the ISO 27001 scope or the SOC 2 report — and can I read the report under NDA?

### Australia

- Instead of “The data your building makes is yours to take.”: No general right. The Consumer Data Right covers designated sectors such as banking and energy retail, not building systems.
- Instead of “You can send it to anyone — even their competitor.”: Only in designated sectors, to accredited recipients.
- Instead of “New devices must be born open.”: No duty to design products so their data is accessible.
- Instead of “Leaving is your right — and the exit fee is dying.”: No statutory right to switch cloud providers, and no rule against switching charges.
- Instead of “Take-it-or-leave-it data clauses can't bind you.”: No data-specific rule. The general unfair contract terms regime for small businesses applies.
- Instead of “Your data can't be quietly reached across borders.”: No duty to publish where non-personal data is held.
- Instead of “The event log isn't their database — it's your data.”: No equivalent rule.
- Ask, Privacy Act 1988: Is this data about people, and does a program decide anything about them? Does any software here make, or substantially support, decisions that significantly affect people, and does our privacy policy say so?
- Ask, ISO/IEC 42001: Is the organisation behind the AI disciplined? Is your AI management system certified to ISO/IEC 42001 — and does the certificate's scope cover this product's AI features?
- Ask, SOC 2 · ISO/IEC 27001: Is the cloud disciplined with my data? Which of the services my building depends on are inside the ISO 27001 scope or the SOC 2 report — and can I read the report under NDA?

### United States

- Instead of “The data your building makes is yours to take.”: No general right to connected-product data in federal law.
- Instead of “You can send it to anyone — even their competitor.”: No right to have device data sent to a third party.
- Instead of “New devices must be born open.”: No duty to design products so their data is accessible.
- Instead of “Leaving is your right — and the exit fee is dying.”: No statutory right to switch cloud providers, and no rule against switching charges.
- Instead of “Take-it-or-leave-it data clauses can't bind you.”: No data-specific rule against unfair terms between businesses.
- Instead of “Your data can't be quietly reached across borders.”: No duty to publish where non-personal data is held.
- Instead of “The event log isn't their database — it's your data.”: No equivalent rule.
- Ask, California Consumer Privacy Act: Is this data about people, employees included? If any occupants are California residents, which of their personal information does this system hold, and how will we answer a request to know, delete or correct it?
- Ask, ISO/IEC 42001: Is the organisation behind the AI disciplined? Is your AI management system certified to ISO/IEC 42001 — and does the certificate's scope cover this product's AI features?
- Ask, SOC 2 · ISO/IEC 27001: Is the cloud disciplined with my data? Which of the services my building depends on are inside the ISO 27001 scope or the SOC 2 report — and can I read the report under NDA?

## The EU Data Act

Regulation (EU) 2023/2854. Amendments are proposed in the Digital Omnibus and not agreed; it applies as written.

- 11 January 2024: Entry into force
- 12 September 2025: General application
- 12 September 2026: Data by design
- 12 January 2027: Switching charges end
- 12 September 2027: Ch. IV reaches old contracts

### Chapter I: General Provisions

- [Article 1](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-1/), Subject matter and scope: The perimeter: if you put connected hardware or its companion services on the EU market, this law reaches you, wherever you are based.
- [Article 2](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-2/), Definitions: The load-bearing words. Most arguments about this Act are arguments about these definitions — start here.

### Chapter II: Business to Consumer and Business to Business Data Sharing

- [Article 3](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-3/), Obligation to make product data and related service data accessible to the user: Data by design becomes a product requirement, like safety. The building's edge devices must be born legible to their owner.
- [Article 4](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-4/), The rights and obligations of users and data holders with regard to access, use and making available product data and related service data: Whatever the vendor can see of your system's data, you can demand — free, machine-readable, live. The custody question stops being 'may I?' and becomes 'how well?'.
- [Article 5](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-5/), Right of the user to share data with third parties: Your data goes wherever you point — including to the vendor's competitor. Lock-in by possession is repealed; being worth choosing is what remains.
- [Article 6](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-6/), Obligations of third parties receiving data at the request of the user: The receiving party is a steward too: purpose-bound, no onward leakage, no cloning the product it came from.
- [Article 7](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-7/), Scope of business-to-consumer and business-to-business data sharing obligations: The duties scale with the size of the party holding the data — and cannot be waived in the fine print.

### Chapter III: Obligations for Data Holders Obliged to Make Data Available Pursuant to Union Law

- [Article 8](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-8/), Conditions under which data holders make data available to data recipients: FRAND comes to device data: when sharing is owed, the terms cannot be a second wall around the moat.
- [Article 9](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-9/), Compensation for making data available: Data access has a price tag, but a regulated one: cost-based for the small, transparent for everyone.
- [Article 10](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-10/), Dispute settlement: A referee short of a courtroom, for when the steward and the recipient can't agree the terms.
- [Article 11](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-11/), Technical protection measures on the unauthorised use or disclosure of data: Protection is legitimate; protection-as-obstruction is not. The lock guards the agreement, never the exit.
- [Article 12](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-12/), Scope of obligations for data holders obliged pursuant to Union law to make data available: The FRAND machinery attaches to new sharing obligations going forward, not retroactively.

### Chapter IV: Unfair Contractual Terms Related to Data Access and Use Between Enterprises

- [Article 13](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-13/), Unfair contractual terms unilaterally imposed on another enterprise: Take-it-or-leave-it custody clauses lose their teeth. The stewardship posture — clear terms both sides would sign in daylight — becomes the only stable strategy.

### Chapter V: Making Data Available to Public Sector Bodies, the Commission, the ECB and Union Bodies on the Basis of an Exceptional Need

- [Article 14](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-14/), Obligation to make data available on the basis of an exceptional need: The state can ask — but only through the narrow gate of exceptional need, defined next door.
- [Article 15](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-15/), Exceptional need to use data: Emergencies, mostly. This is not a general public-sector data tap.
- [Article 16](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-16/), Relationship with other obligations to make data available to public sector bodies: Housekeeping: this chapter adds a channel; it doesn't rewrite the others.
- [Article 17](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-17/), Requests for data to be made available: The state's ask must arrive in writing, scoped and published — a well-formed request, or no request.
- [Article 18](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-18/), Compliance with requests for data: Comply, or push back on listed grounds — quickly, either way.
- [Article 19](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-19/), Obligations of public sector bodies, the Commission, the ECB and Union bodies: The state is held to stewardship rules too: purpose, protection, deletion.
- [Article 20](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-20/), Compensation in cases of an exceptional need: Emergencies are pro bono; everything else is cost-plus.
- [Article 21](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-21/), Sharing of data obtained in the context of an exceptional need with research organisations or statistical bodies: One hop further is allowed — to researchers, same leash.
- [Article 22](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-22/), Mutual assistance and cross-border cooperation: Cross-border asks go through channels, not around them.

### Chapter VI: Switching Between Data Processing Services

- [Article 23](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-23/), Removing obstacles to effective switching: The exit exists by law. Everything in this chapter is the removal of furniture piled against that door.
- [Article 24](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-24/), Scope of the technical obligations: Who owes how much of the switching machinery, by service type.
- [Article 25](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-25/), Contractual terms concerning switching: The exit is written into the contract with dates on it — retrieval, assistance, then provable erasure.
- [Article 26](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-26/), Information obligation of providers of data processing services: The map to the exit must be printed and kept current.
- [Article 27](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-27/), Obligation of good faith: No malicious compliance at the door.
- [Article 28](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-28/), Contractual transparency obligations on international access and transfer: Where your data physically lives, and what shields it from foreign subpoenas — published, not whispered.
- [Article 29](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-29/), Gradual withdrawal of switching charges: Egress-priced exits are a business model with an expiry date printed on it: 12 January 2027.
- [Article 30](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-30/), Technical aspects of switching: Not just permission to leave — the technical means to arrive somewhere else, intact.
- [Article 31](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-31/), Specific regime for certain data processing services: Bespoke systems get a carve-out — declared up front, not discovered at exit.

### Chapter VII: Unlawful International Governmental Access and Transfer of Non-Personal Data

- [Article 32](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-32/), International governmental access and transfer: The sovereignty backstop: your data cannot be quietly reached across borders through your provider.

### Chapter VIII: Interoperability

- [Article 33](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-33/), Essential requirements regarding interoperability of data, of data sharing mechanisms and services, as well as of common European data spaces: Interoperability as a duty of description: data legible enough to travel.
- [Article 34](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-34/), Interoperability for the purposes of in-parallel use of data processing services: Not just leaving — running two at once must be possible too.
- [Article 35](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-35/), Interoperability of data processing services: Where the market won't standardise the plumbing, Brussels can.
- [Article 36](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-36/), Essential requirements regarding smart contracts for executing data sharing agreements: If code executes the agreement, the code carries duties: a kill switch, an audit trail, access control.

### Chapter IX: Implementation and Enforcement

- [Article 37](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-37/), Competent authorities and data coordinators: Who enforces all this in each country — and the one desk (the coordinator) that fronts it.
- [Article 38](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-38/), Right to lodge a complaint: The user's escalation path when the steward isn't one.
- [Article 39](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-39/), Right to an effective judicial remedy: Courts remain above the machinery.
- [Article 40](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-40/), Penalties: The teeth: GDPR-calibre fines stand behind the access and sharing duties.
- [Article 41](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-41/), Model contractual terms and standard contractual clauses: Official templates, so fair terms have a starting point.
- [Article 42](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-42/), Role of the EDIB: The coordination layer above the national desks.

### Chapter X: Sui Generis Right Under Directive 96/9/EC

- [Article 43](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-43/), Databases containing certain data: A vendor cannot rebuild the possession moat by declaring the event log a 'protected database'. That door is closed by name.

### Chapter XI: Final Provisions

- [Article 44](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-44/), Other Union legal acts governing rights and obligations on data access and use: The Act joins the lattice of EU data law; it doesn't replace it.
- [Article 45](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-45/), Exercise of the delegation: Plumbing for future refinements.
- [Article 46](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-46/), Committee procedure: More plumbing.
- [Article 47](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-47/), Amendment to Regulation (EU) 2017/2394: Consumer authorities get this Act in their toolkit.
- [Article 48](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-48/), Amendment to Directive (EU) 2020/1828: Class-style actions can enforce it.
- [Article 49](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-49/), Evaluation and review: The law audits itself on a schedule.
- [Article 50](https://davidjcrawford.github.io/data-explorer/law/eu-data-act/article-50/), Entry into force and application: The clock: live since September 2025, design duties from September 2026, charge-free switching from January 2027 (Art. 29), and the fine print of old contracts caught from September 2027.