The rulebook: what the law says at each stop of the building’s data

Amendments to the Data Act are proposed in the Digital Omnibus and are not agreed; it applies as written. What is proposed

What the owner is owed

The data your building makes is yours to take. Art. 4 Since 12 September 2025: Applies In force, at stops 0, 2, 3 and alongside the path. You can send it to anyone — even their competitor. Art. 5 · Art. 6 Since 12 September 2025: Applies In force, at stops 3, 5 and alongside the path. New devices must be born open. Art. 3 Since 12 September 2026: Applies to products placed on the market from this date In force, at stops 0, 1 and alongside the path. Leaving is your right — and the exit fee is dying. Art. 23 · Art. 25 · Art. 29 · Art. 30 Since 12 September 2025: Switching protected; only cost-based charges · From 12 January 2027: Switching charges end Partly in force, at stops 3, 4. Take-it-or-leave-it data clauses can't bind you. Art. 13 · Art. 8 · Art. 9 Since 12 September 2025: Applies to contracts concluded from this date · From 12 September 2027: Reaches qualifying older contracts Partly in force, at stop 3. Your data can't be quietly reached across borders. Art. 28 · Art. 32 Since 12 September 2025: Applies In force, at stops 3, 4. The event log isn't their database — it's your data. Art. 43 Since 12 September 2025: Applies In force, at stops 2, 3.

What to ask

What may the AI legally do to the people here? EU AI Act Since 2 August 2026: transparency duties apply · From 2 December 2027: high-risk duties apply (as deferred by Regulation (EU) 2026/1744) Partly in force, at stop 4 and alongside the path. Is the hardware born secure — and who patches it? Cyber Resilience Act Since 11 September 2026: exploited-vulnerability reporting · From 11 December 2027: full obligations apply Partly in force, at stops 0, 1 and alongside the path. Is this data about people? GDPR Since 25 May 2018: applies In force, at stops 0, 2, 3, 4, 5 and alongside the path. Is the organisation behind the AI disciplined? ISO/IEC 42001 Since 18 December 2023: published In force, at stop 4 and alongside the path. Whose duty is it to ask? NIS2 Since 17 October 2024: member-state transposition deadline In force, at stops 1, 2, 3. Is the cloud disciplined with my data? SOC 2 · ISO/IEC 27001 No fixed dates In force, at stop 3.

What the owner is owed

No general right. Since 20 August 2025 the government can create smart data schemes sector by sector; none covers buildings yet. In the EU: The data your building makes is yours to take. No general right to send building data to a third party. A future smart data scheme could create one. In the EU: You can send it to anyone — even their competitor. No duty to design products so their data is accessible. The product security regime covers security, not data access. In the EU: New devices must be born open. No statutory right to switch cloud providers, and no rule against switching charges. In the EU: Leaving is your right — and the exit fee is dying. No data-specific rule against unfair terms between businesses. General contract law applies. In the EU: Take-it-or-leave-it data clauses can't bind you. No duty to publish where non-personal data is held. UK GDPR's transfer rules cover personal data only. In the EU: Your data can't be quietly reached across borders. No carve-out: the database right still applies to databases of device-generated data. In the EU: The event log isn't their database — it's your data.

What to ask

Is this data about people? UK GDPR · Data Protection Act 2018 Since 25 May 2018: applies In force, at stops 0, 2, 3, 4, 5 and alongside the path. Whose duty is it to ask? NIS Regulations 2018 Since 10 May 2018: applies In force, at stops 1, 2, 3. Is the hardware secure by default? Product security regime (PSTI) Since 29 April 2024: applies to consumer connectable products In force, at stops 0, 1 and alongside the path. Is the organisation behind the AI disciplined? ISO/IEC 42001 Since 18 December 2023: published In force, at stop 4 and alongside the path. Is the cloud disciplined with my data? SOC 2 · ISO/IEC 27001 No fixed dates In force, at stop 3.

What the owner is owed

No general right. The consumer data right applies only to designated sectors: banking since 1 December 2025. Electricity retail has been decided; its rules are not final. In the EU: The data your building makes is yours to take. Only in designated sectors, to accredited recipients. Building systems are not designated. In the EU: You can send it to anyone — even their competitor. No duty to design products so their data is accessible. In the EU: New devices must be born open. No statutory right to switch cloud providers, and no rule against switching charges. In the EU: Leaving is your right — and the exit fee is dying. No data-specific rule against unfair terms between businesses. In the EU: Take-it-or-leave-it data clauses can't bind you. No duty to publish where non-personal data is held. The Privacy Act's rules on overseas disclosure cover personal information only. In the EU: Your data can't be quietly reached across borders. No equivalent rule. In the EU: The event log isn't their database — it's your data.

What to ask

Is this data about people? Privacy Act 2020 Since 1 May 2026: IPP 3A: notice of indirect collection In force, at stops 0, 2, 3, 4, 5 and alongside the path. Is the organisation behind the AI disciplined? ISO/IEC 42001 Since 18 December 2023: published In force, at stop 4 and alongside the path. Is the cloud disciplined with my data? SOC 2 · ISO/IEC 27001 No fixed dates In force, at stop 3.

What the owner is owed

No general right. The Consumer Data Right covers designated sectors such as banking and energy retail, not building systems. In the EU: The data your building makes is yours to take. Only in designated sectors, to accredited recipients. In the EU: You can send it to anyone — even their competitor. No duty to design products so their data is accessible. In the EU: New devices must be born open. No statutory right to switch cloud providers, and no rule against switching charges. In the EU: Leaving is your right — and the exit fee is dying. No data-specific rule. The general unfair contract terms regime for small businesses applies. In the EU: Take-it-or-leave-it data clauses can't bind you. No duty to publish where non-personal data is held. In the EU: Your data can't be quietly reached across borders. No equivalent rule. In the EU: The event log isn't their database — it's your data.

What to ask

Is this data about people, and does a program decide anything about them? Privacy Act 1988 Since 12 March 2014: Australian Privacy Principles apply · From 10 December 2026: automated-decision transparency Partly in force, at stops 0, 2, 3, 4, 5 and alongside the path. Is the organisation behind the AI disciplined? ISO/IEC 42001 Since 18 December 2023: published In force, at stop 4 and alongside the path. Is the cloud disciplined with my data? SOC 2 · ISO/IEC 27001 No fixed dates In force, at stop 3.

What the owner is owed

No general right to connected-product data in federal law. In the EU: The data your building makes is yours to take. No right to have device data sent to a third party. In the EU: You can send it to anyone — even their competitor. No duty to design products so their data is accessible. In the EU: New devices must be born open. No statutory right to switch cloud providers, and no rule against switching charges. In the EU: Leaving is your right — and the exit fee is dying. No data-specific rule against unfair terms between businesses. In the EU: Take-it-or-leave-it data clauses can't bind you. No duty to publish where non-personal data is held. In the EU: Your data can't be quietly reached across borders. No equivalent rule. In the EU: The event log isn't their database — it's your data.

What to ask

Is this data about people, employees included? California Consumer Privacy Act Since 1 January 2023: CPRA amendments; employee and business data covered In force, at stops 0, 2, 3, 4, 5 and alongside the path. Is the organisation behind the AI disciplined? ISO/IEC 42001 Since 18 December 2023: published In force, at stop 4 and alongside the path. Is the cloud disciplined with my data? SOC 2 · ISO/IEC 27001 No fixed dates In force, at stop 3.