The EU Data Act – Navigating Through the New EU Digital Standards

The EU Data Act came into effect on 12 September 2025. Even though its enforcement is subject to national authorities and dispute resolution bodies, companies have started reforming their internal procedures to meet the new “way” of managing the data assets.

In practice, the EU Data Act sets the landscape regarding access to data among private entities and access to private companies’ data from public-sector bodies, to enhance the digital power and footprint of EU entities. Sharing data would facilitate the sharing of know-how and information, with the goal of co-creating and empowering the European Union’s mission to shape Europe’s digital future.

Companies now must face standard rules on access to and sharing of data solely generated by connected products and related services. Some examples include digital apps, connected lab equipment, IoT-enabled manufacturing lines, remote monitoring devices, and medical devices used by pharmaceutical companies, among others. Such data must be considered as “creation” of such connected products. Still, it should only contain commercial information, which means that the Act does not include special provisions for personal data whose processing continues to be subject to GDPR requirements. In other words, the Act serves to govern the process, sharing, and transfer of non-personal data.

Key takeaways:

Data access obligations: the “data holders”, those who hold and own the data, are obliged to provide access to private bodies when they submit a request on the condition that the user/requester’s access is necessary to use or maintain a product or service themselves.

Switching between data processing and data portability: The Act establishes rules that enable data users to switch from data processing to data portability.

Public sector access: mechanisms that allow public sector entities to access data in exceptional circumstances, such as public emergencies. In this case, the emergency must be real and easily provable, and the private bodies are not able to deny access, unless other exceptions might apply (e.g., trade secrets) that could overcome the necessity of the public body’s access.

Power to deny access in case of Trade Secrets and IP: The Act expressly recognizes trade secrets and IP protection and includes a practical “trade-secret handbrake”. The companies, however, must prepare themselves beforehand by creating access request policies, establishing procedures, and organizing the data into categories that are covered by the Act, specifically addressing the use cases and types of data that fall under the trade secret and IP exception. Moreover, companies can clearly set provisions regarding the protection of information and access to the covered data in third-party agreements by requesting Technical and Organizational Measures (TOMs) in contracts. The companies can withhold or suspend any sharing if such TOMs are missing, if identified gaps could cause severe economic harm, or if the vendor cannot provide adequate safeguards.

What’s next for private companies: 

1. Identify the applicability of the Act, including identifying:

• all connected products
• data in scope
• Who is the data holder, and who is the “user” in each product, as different responsibilities might arise

2. Classify the datasets and the exceptions:

• Mark any data that is potentially trade secrets/IP
• Set the minimum standards, the technical and organizational measures to protect trade secrets
• Data mapping exercises might help the companies to understand the data flows, types of data, and measures to be in place

3. Develop policies and procedures to operationalize access requests. Follow the local regulations and the guidance of local authorities in implementing the Act locally.
4. Review and update the contractual clauses:

• Data access clauses: define the data that can be shared, timelines

By Aggeliki Smyrnaiou