---
type: Instrument
title: "The EU Data Act"
description: "Regulation (EU) 2023/2854, applicable since 12 September 2025: the user of a connected product has a right to its data, and exclusive control by the maker is over."
resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
tags: [eu-data-act, regulation, eu, spine]
kind: regulation
cite: "Regulation (EU) 2023/2854"
legal_review: none
generated: { by: claude-code/opus-5.5, at: "2026-10-09T00:00:00Z" }
status: draft
stale_after: "2027-01-12T00:00:00Z"
sources:
  - id: eli
    resource: "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"
    title: "Regulation (EU) 2023/2854, Official Journal"
  - id: commission
    resource: "https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained"
    title: "Data Act explained — European Commission"
  - id: gt
    resource: "https://www.gtlaw.com/en/insights/2025/9/action-required-for-manufacturers-of-connected-devices-challenges-under-the-eu-data-act"
    title: "Greenberg Traurig: action required for manufacturers of connected devices"
  - id: prototype
    resource: "https://github.com/DavidJCrawford/stewardship-explorer/blob/main/brain/references/eu-data-act.md"
    title: "stewardship-explorer brain: The EU Data Act"
---

# Why it is the spine

Of all the instruments on the site, the Data Act is the only one that gives the
*buyer* of a building system rights over its data. Everything else enters as a
question the buyer should ask. See [the wider rulebook](/law/wider-rulebook/index.md).

# What it gives the building's owner

It reaches anyone placing connected products or related services on the EU
market, wherever they are established ([Article 1](/law/eu-data-act/articles/article-01.md)).[^eli]

- **Access** to the data the product and its services generate, free, in a
  structured machine-readable form, continuously where applicable
  ([Article 4](/law/eu-data-act/articles/article-04.md)).
- **Sharing** with any third party the user designates, including a competitor
  of the vendor ([Article 5](/law/eu-data-act/articles/article-05.md)).
- **Data by design** for products and services placed on the market after 12
  September 2026 ([Article 3](/law/eu-data-act/articles/article-03.md)).
- **Fair terms**: unfair data clauses imposed unilaterally do not bind
  ([Article 13](/law/eu-data-act/articles/article-13.md)); from 12 September 2027
  this also reaches qualifying older contracts.
- **Switching**: the right to leave a cloud service, with the exit written into
  the contract ([Articles 23–31](/law/eu-data-act/chapters.md)), and no switching
  charges at all from 12 January 2027 ([Article 29](/law/eu-data-act/articles/article-29.md)).
- **Protection** from unlawful foreign governmental access
  ([Article 32](/law/eu-data-act/articles/article-32.md)), and published
  jurisdictions ([Article 28](/law/eu-data-act/articles/article-28.md)).
- **The event log is not a protected database**: the sui generis database right
  cannot be used to block access ([Article 43](/law/eu-data-act/articles/article-43.md)).

Penalties are set by Member States; for some infringements GDPR-level fines of
up to EUR 20 million or 4% of worldwide turnover apply
([Article 40](/law/eu-data-act/articles/article-40.md)).

# Where it steps back

The Data Act does not override GDPR. Where building data is personal data,
privacy rights come first ([Article 44](/law/eu-data-act/articles/article-44.md),
[GDPR](/law/wider-rulebook/gdpr.md)). Micro and small enterprises are exempt
from the Chapter II duties ([Article 7](/law/eu-data-act/articles/article-07.md)).

# Status on 2026-10-09

In force since 11 January 2024, applicable since 12 September 2025. Data by
design applies since 12 September 2026. The next date is 12 January 2027.
Amendments proposed in the [Digital Omnibus](/law/wider-rulebook/digital-omnibus.md)
are not agreed; the Act applies as written.

# In this bundle

* [Articles](/law/eu-data-act/articles/index.md) · [Chapters](/law/eu-data-act/chapters.md) · [Definitions](/law/eu-data-act/definitions.md) · [Actors](/law/eu-data-act/actors.md) · [Milestones](/law/eu-data-act/milestones.md)

[^eli]: Regulation (EU) 2023/2854