Overview
The EU Data Act came into effect in September 2025 and is designed to make data generated by connected products and related services more accessible and fairly shared between businesses and the users who generate the data. It applies to manufacturers and suppliers of connected products and related services, including providers of cloud services, placed on the EU market regardless of where those businesses are established. It sets rules governing who can access and use data, establishes rights for users to share their data with third parties, and prohibits unfair contractual terms in B2B data sharing arrangements. It also includes provisions to make it easier for businesses to switch between cloud service providers, and creates a framework for public sector bodies to access privately-held data in exceptional circumstances.
Sample language
Written to work with Common Paper standard agreements.
Add customer data access and sharing rights under EU Data Act
Cloud Service Agreement version: 2.0, 2.1
Add as Section 3.3:
“3.3 EU Data Act. Provider will at no additional cost, upon Customer’s written request and in any event before deleting Customer Content under Section 5.5(b), make available to Customer all Customer Content and Product-generated data to which Customer has a right of access under the EU Data Act, in a structured, commonly used, and machine-readable format. Provider will respond to such a request within 30 days. In addition, Provider will provide Customer with technical assistance to facilitate switching to an alternative service for at least 30 days. Where technically feasible, Provider will transmit data directly to a third-party service provider nominated by Customer. If Provider receives a request from a public sector body or EU institution to share data under Chapter V of the EU Data Act, Provider will promptly notify Customer of such request to the extent permitted by Applicable Laws, and will not share Customer Content in response to such a request without either Customer’s prior written consent or a binding legal obligation to do so. Where Provider is legally required to share data without prior notice to Customer, Provider will notify Customer as soon as permissible after the disclosure. “EU Data Act” means Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data, as amended or supplemented from time to time.”