Regulation (EU) 2023/2854
The EU Data Act
Regulation (EU) 2023/2854, applicable since 12 September 2025: the user of a connected product has a right to its data, and exclusive control by the maker is over.
Of all the instruments on the site, the Data Act is the only one that gives the buyer of a building system rights over its data. Everything else enters as a question the buyer should ask. See the wider rulebook.
See it laid along the building in the rulebook, or follow a door event through it.
Dates
| 11 January 2024 | Entry into force · Art. 50 |
|---|---|
| 12 September 2025 | General application · Art. 4, Art. 5, Art. 50 |
| 12 September 2026 | Data by design · Art. 3, Art. 50 |
| 12 January 2027 | Switching charges end (to come) · Art. 29 |
| 12 September 2027 | Ch. IV reaches old contracts (to come) · Art. 13, Art. 50 |
Amendments are proposed in the Digital Omnibus and are not agreed; the Act applies as written. What is proposed.
Chapter I · General Provisions
- Article 1 Subject matter and scope
The perimeter: if you put connected hardware or its companion services on the EU market, this law reaches you, wherever you are based. - Article 2 Definitions
The load-bearing words. Most arguments about this Act are arguments about these definitions — start here.
Chapter II · Business to Consumer and Business to Business Data Sharing
- Article 3 Obligation to make product data and related service data accessible to the user
Data by design becomes a product requirement, like safety. The building's edge devices must be born legible to their owner. - Article 4 The rights and obligations of users and data holders with regard to access, use and making available product data and related service data
Whatever the vendor can see of your system's data, you can demand — free, machine-readable, live. The custody question stops being 'may I?' and becomes 'how well?'. - Article 5 Right of the user to share data with third parties
Your data goes wherever you point — including to the vendor's competitor. Lock-in by possession is repealed; being worth choosing is what remains. - Article 6 Obligations of third parties receiving data at the request of the user
The receiving party is a steward too: purpose-bound, no onward leakage, no cloning the product it came from. - Article 7 Scope of business-to-consumer and business-to-business data sharing obligations
The duties scale with the size of the party holding the data — and cannot be waived in the fine print.
Chapter III · Obligations for Data Holders Obliged to Make Data Available Pursuant to Union Law
- Article 8 Conditions under which data holders make data available to data recipients
FRAND comes to device data: when sharing is owed, the terms cannot be a second wall around the moat. - Article 9 Compensation for making data available
Data access has a price tag, but a regulated one: cost-based for the small, transparent for everyone. - Article 10 Dispute settlement
A referee short of a courtroom, for when the steward and the recipient can't agree the terms. - Article 11 Technical protection measures on the unauthorised use or disclosure of data
Protection is legitimate; protection-as-obstruction is not. The lock guards the agreement, never the exit. - Article 12 Scope of obligations for data holders obliged pursuant to Union law to make data available
The FRAND machinery attaches to new sharing obligations going forward, not retroactively.
Chapter IV · Unfair Contractual Terms Related to Data Access and Use Between Enterprises
- Article 13 Unfair contractual terms unilaterally imposed on another enterprise
Take-it-or-leave-it custody clauses lose their teeth. The stewardship posture — clear terms both sides would sign in daylight — becomes the only stable strategy.
Chapter V · Making Data Available to Public Sector Bodies, the Commission, the ECB and Union Bodies on the Basis of an Exceptional Need
- Article 14 Obligation to make data available on the basis of an exceptional need
The state can ask — but only through the narrow gate of exceptional need, defined next door. - Article 15 Exceptional need to use data
Emergencies, mostly. This is not a general public-sector data tap. - Article 16 Relationship with other obligations to make data available to public sector bodies
Housekeeping: this chapter adds a channel; it doesn't rewrite the others. - Article 17 Requests for data to be made available
The state's ask must arrive in writing, scoped and published — a well-formed request, or no request. - Article 18 Compliance with requests for data
Comply, or push back on listed grounds — quickly, either way. - Article 19 Obligations of public sector bodies, the Commission, the ECB and Union bodies
The state is held to stewardship rules too: purpose, protection, deletion. - Article 20 Compensation in cases of an exceptional need
Emergencies are pro bono; everything else is cost-plus. - Article 21 Sharing of data obtained in the context of an exceptional need with research organisations or statistical bodies
One hop further is allowed — to researchers, same leash. - Article 22 Mutual assistance and cross-border cooperation
Cross-border asks go through channels, not around them.
Chapter VI · Switching Between Data Processing Services
- Article 23 Removing obstacles to effective switching
The exit exists by law. Everything in this chapter is the removal of furniture piled against that door. - Article 24 Scope of the technical obligations
Who owes how much of the switching machinery, by service type. - Article 25 Contractual terms concerning switching
The exit is written into the contract with dates on it — retrieval, assistance, then provable erasure. - Article 26 Information obligation of providers of data processing services
The map to the exit must be printed and kept current. - Article 27 Obligation of good faith
No malicious compliance at the door. - Article 28 Contractual transparency obligations on international access and transfer
Where your data physically lives, and what shields it from foreign subpoenas — published, not whispered. - Article 29 Gradual withdrawal of switching charges
Egress-priced exits are a business model with an expiry date printed on it: 12 January 2027. - Article 30 Technical aspects of switching
Not just permission to leave — the technical means to arrive somewhere else, intact. - Article 31 Specific regime for certain data processing services
Bespoke systems get a carve-out — declared up front, not discovered at exit.
Chapter VII · Unlawful International Governmental Access and Transfer of Non-Personal Data
- Article 32 International governmental access and transfer
The sovereignty backstop: your data cannot be quietly reached across borders through your provider.
Chapter VIII · Interoperability
- Article 33 Essential requirements regarding interoperability of data, of data sharing mechanisms and services, as well as of common European data spaces
Interoperability as a duty of description: data legible enough to travel. - Article 34 Interoperability for the purposes of in-parallel use of data processing services
Not just leaving — running two at once must be possible too. - Article 35 Interoperability of data processing services
Where the market won't standardise the plumbing, Brussels can. - Article 36 Essential requirements regarding smart contracts for executing data sharing agreements
If code executes the agreement, the code carries duties: a kill switch, an audit trail, access control.
Chapter IX · Implementation and Enforcement
- Article 37 Competent authorities and data coordinators
Who enforces all this in each country — and the one desk (the coordinator) that fronts it. - Article 38 Right to lodge a complaint
The user's escalation path when the steward isn't one. - Article 39 Right to an effective judicial remedy
Courts remain above the machinery. - Article 40 Penalties
The teeth: GDPR-calibre fines stand behind the access and sharing duties. - Article 41 Model contractual terms and standard contractual clauses
Official templates, so fair terms have a starting point. - Article 42 Role of the EDIB
The coordination layer above the national desks.
Chapter X · Sui Generis Right Under Directive 96/9/EC
- Article 43 Databases containing certain data
A vendor cannot rebuild the possession moat by declaring the event log a 'protected database'. That door is closed by name.
Chapter XI · Final Provisions
- Article 44 Other Union legal acts governing rights and obligations on data access and use
The Act joins the lattice of EU data law; it doesn't replace it. - Article 45 Exercise of the delegation
Plumbing for future refinements. - Article 46 Committee procedure
More plumbing. - Article 47 Amendment to Regulation (EU) 2017/2394
Consumer authorities get this Act in their toolkit. - Article 48 Amendment to Directive (EU) 2020/1828
Class-style actions can enforce it. - Article 49 Evaluation and review
The law audits itself on a schedule. - Article 50 Entry into force and application
The clock: live since September 2025, design duties from September 2026, charge-free switching from January 2027 (Art. 29), and the fine print of old contracts caught from September 2027.
The Regulation in the Official Journal · The overview in the knowledge base
Not legal advice. This is the author’s own reading of the law, written to help facilities managers ask better questions. It has not been reviewed by a lawyer. For decisions, read the official text and take legal advice.