EU Data Act · Chapter II · Business to Consumer and Business to Business Data Sharing
Article 6
Obligations of third parties receiving data at the request of the user
Precise reading
Third parties may process received data only for the purposes and under the conditions agreed with the user, must not use it to profile people (save as needed for the service), pass it on without agreement, or use it to develop competing connected products; they must apply agreed protections and delete when required.
A summary of the operative demand, not the statute.
Plain reading
The receiving party is a steward too: purpose-bound, no onward leakage, no cloning the product it came from.
Paraphrase.
Facts
| Applies from | 12 September 2025 |
|---|---|
| Binds | Third Party / Data Recipient |
| Cross-references | Article 5 |
| On the trace | Stop 4, Cloud AI, Stop 5, Third party |
| Rights that rest on it | You can send it to anyone — even their competitor. |
The Regulation in the Official Journal · This article in the knowledge base
Not legal advice. This is the author’s own reading of the law, written to help facilities managers ask better questions. It has not been reviewed by a lawyer. For decisions, read the official text and take legal advice.