The EU Data Act: Connected Products, Data Sharing and Cloud Switching Explained

The EU Data Act is Regulation (EU) 2023/2854. In the European Commission's words, the Act makes data, in particular industrial data, more accessible and usable, and it "clarifies who can use what data and under which conditions". In practice it covers three areas that finance and operations teams are most likely to meet: data generated by connected products, data sharing between businesses, and switching between cloud and other data processing services. This guide summarises what the Commission's pages say, how the Act is being put into effect in Ireland, and what to check in your own contracts. It is a summary, not legal advice.

The Act sits alongside, not instead of, your existing data protection work. If you have not yet mapped what personal data you hold and why, start with your GDPR records of processing under Article 30, because data sharing decisions are easier when you know what you have.

Key dates, as the Commission states them

The Commission's "Data Act explained" page (last updated 15 December 2025) gives these dates:

• published in the Official Journal on 22 December 2023;
• applies since 12 September 2025;
• switching charges fully removed from 12 January 2027, with a transitional period from 11 January 2024.

The Commission's Data Act policy page (last updated 2 July 2026) confirms that the regulation entered into force on 11 January 2024 and became applicable on 12 September 2025. Because EU data laws are under review, check the current position before relying on any date. The Commission's Data Union Strategy page (last updated 18 May 2026) says that strategy was published alongside a Digital Omnibus proposal to modernise and consolidate EU data laws, including the Data Act.

What the Act covers

The Commission's explainer organises the Act into nine chapters. In summary:

• Connected products and related services (Chapter II): users can access and share the data their connected products or services generate. The page gives connected cars, medical devices and industrial machinery as examples.
• Business-to-business data sharing (Chapter III): sets fair, reasonable and non-discriminatory terms where a law requires one business to share data with another.
• Unfair contract terms (Chapter IV): protects businesses, especially SMEs, from one-sided data-sharing terms.
• Business-to-government sharing (Chapter V): lets public bodies request data in "exceptional need", such as public emergencies.
• Cloud and edge switching (Chapter VI): requires providers to make switching easier. The page says the Act "will make switching free, fast and fluid".
• Unlawful third-country access (Chapter VII): protects non-personal data stored in the EU from unlawful foreign government access.
• Interoperability (Chapter VIII): sets requirements for data spaces, smart contracts and data processing services.
• Enforcement (Chapter IX): Member States designate competent authorities and, where there are several, one acts as a data coordinator.

Who is involved

The Commission's page identifies several roles. Users are businesses or individuals who own, rent or lease connected products. Data holders are typically the product manufacturer or related-service provider. Third parties and data recipients receive data at a user's request or under a legal obligation. Public sector bodies can request data in exceptional need, and cloud and edge providers are data processing service providers. The page notes that micro and small companies face lighter obligations than larger firms.

On data use, the page states that the data holder cannot use any non-personal data generated by the product without the user's agreement. It also states that the Act does not prohibit cross-border data flows.

Connected products and data sharing in practice

For a finance team, the "user" side of the Act can be relevant even if you never manufacture anything. Businesses that lease or own vehicles, machines or other connected equipment may be users of the data those products generate. Our suggestion is to ask three questions of each supplier contract: what data does the product generate, who is entitled to access it, and on what terms. This is a practical review step, not a statement of what the Act requires in any given contract.

The Commission's policy page also says it has published a draft Recommendation on non-binding Model Contractual Terms for data access and use, and non-binding Standard Contractual Clauses for cloud computing contracts, intended to help parties draft fair data-sharing and cloud contracts. It adds that the Commission has published FAQs and a Data Act Legal Helpdesk. Those are useful starting points, but the page describes them as non-binding.

Cloud switching

If your finance systems run on cloud services, the switching rules matter at contract renewal. The Commission's page says switching charges are fully removed from 12 January 2027, with a transitional period beginning 11 January 2024. Our suggestion is to review your cloud and software-as-a-service contracts for exit terms, data export formats and notice periods now, so you know your position before any renewal. The pages we read do not set out the detailed conditions that apply to each provider type, so read the regulation or take advice for your specific contracts.

How it is being implemented in Ireland

The Irish arrangements were still being finalised at the time of the sources we read, so verify the current position:

• ComReg's EU Data Act page (published 14 October 2025, last modified 15 October 2025) says ComReg "expects to be a competent authority" and that the Irish legislation giving effect to the Act and confirming its powers was expected in 2026.
• The Department of Enterprise's draft General Scheme of the Data Bill 2025 sets out how Ireland proposes to give effect to the Act. It proposes that the Competition and Consumer Protection Commission (CCPC) be the Data Coordinator and a competent authority for a number of articles, and ComReg a competent authority for articles on switching between data processing services and interoperability. It is a draft and the pages we read show no publication date.
• The CCPC says on its data regulation page that it will soon take on the role of competent authority and data coordinator for the Data Act. That page shows no date.

A general scheme is an outline of a proposed bill, not law. Check whether the Bill has been enacted, and which bodies are designated, before relying on any of the above.

Internal data access still matters

Sharing data externally is only one side of the picture. Before you share anything, you need to know who inside your organisation can already see it. Our guide to Microsoft 365 Copilot data governance and permissions covers internal data permissions for a widely used workplace tool. Our suggestion is to review who can access which data internally before you start any new data sharing arrangement. That guide is about internal access, not the Data Act itself.

Where personal data comes in

The pages we read for the Data Act explain access and sharing rules for data generated by products and services and focus on non-personal data in the quoted passage above. They do not set out in detail how the Act interacts with the GDPR. If the data in question relates to identifiable people, for example telematics tied to named drivers, take care and get advice. Our guide to the lawful basis for employee data under the GDPR explains how to think about the legal footing for staff data.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

When did the Data Act start to apply?

The Commission says it entered into force on 11 January 2024 and has applied since 12 September 2025. Check the current position, as proposals to consolidate EU data laws exist.

Does the Data Act ban transferring data outside the EU?

The Commission's explainer states that the Act does not prohibit cross-border data flows. It does include provisions on unlawful third-country government access to non-personal data stored in the EU.

Are small businesses treated differently?

The Commission's page notes that micro and small companies face lighter obligations than larger firms. Check the regulation text for the exact conditions.

Who enforces it in Ireland?

Under the draft General Scheme, the CCPC would be the Data Coordinator and a competent authority and ComReg a competent authority for certain articles. Confirm the final position once the legislation is enacted.

Is the Act the same as the Data Governance Act?

No. They are separate regulations, although the Commission presents both as part of its European data strategy.

In short, review your connected-product and cloud contracts with the Commission's guidance in hand, and keep an eye on Irish implementation.