The EU Data Act has applied since 12 September 2025. For companies operating connected products, IoT systems and related digital services, reviewing data-related contracts is no longer a preparation exercise. Existing agreements may have been drafted around a different understanding of who can access, use and share data. They may now contain provisions that are no longer consistent with the Data Act.

Several deadlines make the review more urgent:

since 12 September 2026, new connected products must be designed so that their data are accessible to users;
from 12 January 2027, switching charges between cloud providers are prohibited;
from 12 September 2027, the rules on unfair contractual terms extend to certain contracts concluded before the Data Act applied.

Here are seven areas that deserve particular attention.

1. Your own use of the data

The first question is whether the company can still use the data itself. Under the Data Act, a data holder may use non-personal data generated by a connected product or related service only on the basis of a contract with the user. Manufacturers and service providers should therefore check:

whether such an agreement exists with each user;
whether it specifies which data may be used and for which purposes.

The data must not be used to derive insights about the user’s economic situation, assets or production methods that could undermine the user’s commercial position. This point is often overlooked, but it is decisive for any business model built on product data.

2. Data access and sharing

Contracts should clearly address which data are generated, who can access them and under what conditions. Users of connected products and related services have the right to access the data generated through their use, free of charge. They can also ask for those data to be made available to third parties.

Clauses that treat all data generated by a product or service as controlled exclusively by the manufacturer or service provider should be revised. Contractual arrangements and internal procedures should reflect the access and sharing rights established by the Data Act.

3. Compensation for data sharing

Access by the user is free. Compensation is relevant only when the data holder makes data available to a third-party data recipient in a business-to-business relationship. Article 9 sets the conditions for that compensation:

it must be non-discriminatory and reasonable, and may include a margin;
it is based on the costs of making the data available and on the investment in collecting and producing the data;
where the recipient is an SME or a non-profit research organisation, it may not exceed the costs.

Clauses providing for data-access fees should be reviewed. Companies should adopt a transparent, documented methodology for calculating compensation rather than an assumption about the market value of the data.

4. Confidentiality and trade secrets

Data sharing can involve trade secrets and commercially sensitive information. The Data Act allows the data holder to agree with the user, or the third party, the confidentiality and security measures needed before trade secrets are disclosed. Where such measures are not agreed or not respected, the data holder may refuse or suspend sharing. It may also refuse in exceptional cases where it can show that disclosure is highly likely to cause serious and irreparable economic damage. In either case it must notify the competent authority.

At the same time, confidentiality clauses should not be drafted so broadly that they block mandatory access. The protection of trade secrets must be reconciled with the access and sharing obligations of the Data Act.

5. Permitted use and onward sharing

Once data have been made available, contracts should clearly define how the recipient may use them. Relevant provisions may concern:

the purposes for which data can be used;
whether they can be combined with other datasets;
whether they can be transferred to other parties;
retention periods;
what happens when the contractual relationship ends.

Some limits are set by the Data Act itself:

neither the user nor the third party may use the data to develop a connected product that competes with the one from which the data originate;
third parties may not make the data available to gatekeepers designated under the Digital Markets Act.

This is particularly important in complex data ecosystems, where manufacturers, service providers, platforms and other business partners may interact with the same data.

6. Unfair contractual terms

The Data Act introduces a fairness test for contractual terms on data access and use. Terms unilaterally imposed by one enterprise on another are not binding if they are unfair. This applies to all businesses, not only SMEs. Some terms are always considered unfair, such as those that:

exclude or limit liability for intentional acts or gross negligence;
give one party the exclusive right to decide whether the data supplied or the performance conform to the contract.

Other terms are presumed unfair. The general test is whether a term grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing.

These rules have applied to contracts concluded since 12 September 2025. From 12 September 2027 they also apply to earlier contracts that are of indefinite duration or due to expire at least ten years after 11 January 2024. This gives the review of long-term agreements a concrete deadline.

7. Liability and responsibilities

Contracts should allocate responsibilities between the parties clearly, taking into account the mandatory rules of the Data Act. This covers responsibility for data access, security and use, and responses to access requests and security incidents. Particular attention should be paid to situations in which data pass through several actors before reaching the final recipient.

What should companies do now?

The Data Act already applies, so these issues belong in contractual compliance processes today. A practical review should include at least five steps:

Map data flows. Identify which connected products and services generate data and which contracts govern those data.
Identify the relevant actors. Determine which party acts as data holder, user, data recipient or other relevant actor under the Data Act.
Review existing clauses. Check provisions on your own use of data, access, sharing, confidentiality, onward transfers and potentially unfair terms.
Check compensation mechanisms. Review contractual fees for data access and the basis on which they are calculated.
Document responsibilities. Clarify responsibilities for security, confidentiality, permitted uses and responses to data-access requests.

The Data Act therefore requires more than a review of technical systems or internal compliance procedures. Contracts are part of the Data Act compliance framework.

For companies that have not yet reviewed their data-related agreements, the practical question is no longer “when should we start?”. It is “which contracts should be reviewed first, and which clauses need to be changed?”.

‍