The EU Data Act takes effect in September 2025. If you're running connected products or cloud services with EU users, you're in scope, regardless of where you're headquartered. This isn't just another disclosure rule. It's a structural rewrite of who owns access to machine-generated data, forcing you to redesign product architectures, contracts, and data governance workflows before next year.
Here's how to get compliant.
Why This Matters Now
The act grants statutory data access rights to users of connected products. If your IoT device, industrial sensor, medical technology, or SaaS platform generates usage data from an EU-based user, that user can now demand access to it in a structured, machine-readable format, at no cost, without delay. By September 12, 2026, new connected products must implement "access by design."
This applies extraterritorially. A U.S. manufacturer selling smart appliances to German consumers must comply. A Canadian SaaS vendor serving French enterprises must comply. The act covers raw sensor outputs, pre-processed telemetry, metadata, and machine-generated insights. It also empowers users to instruct you to share their data with third parties of their choosing, opening your closed ecosystem to competitors, repair shops, and analytics vendors.
The compliance challenge isn't just technical. You're balancing user access rights against trade secret protection, GDPR obligations for personal data, and database rights. Get it wrong and you either expose proprietary algorithms or block legitimate user requests.
What You Need Before Starting
You can't implement what you don't inventory. Before you touch product code or rewrite contracts, assemble this foundation:
Data Flow Map: Document every connected product and related service. For each, identify what data it generates, where that data is stored, and whether it contains personal data subject to GDPR. Use a processing register format: device/service name, data categories, storage location, retention period, third-party processors.
Trade Secret Register: Work with your IP and engineering teams to flag telemetry or operational data that could reveal production methods, algorithmic logic, or design insights. Don't over-designate. The act's "trade secrets handbrake" mechanism requires you to identify specific information and propose proportionate safeguards. Blanket claims won't hold up.
Cross-Functional Team: Assign owners from legal, privacy, product, engineering, IP, and security. The act touches all of them. Legal handles contract updates. Privacy ensures GDPR compliance for personal data. Product and engineering build access mechanisms. IP protects trade secrets. Security validates authentication and encryption.
Baseline Contracts: Pull your current user agreements, B2B contracts, and cloud service terms. You'll need to amend every document that governs data generated by connected products.
Step-by-Step Implementation
1. Design Data Access Mechanisms
If you're launching new connected products before September 12, 2026, build "access by design" from the start. This means:
- Direct API Access: Provide authenticated endpoints where users retrieve their data in JSON, CSV, or another machine-readable format. Use OAuth 2.0 or equivalent for identity verification.
- Data Portability Tooling: If direct API access isn't feasible for legacy systems, build a request-response mechanism that delivers "readily available data" within 24-48 hours.
- Metadata Documentation: Include timestamps, data source identifiers, and processing context so users understand what they're receiving.
Test with a pilot user group. Verify they can authenticate, retrieve data, and parse the output without contacting support.
2. Implement Third-Party Sharing Workflows
Users can instruct you to share their data with third parties. You need a controlled process:
- Authorization Interface: Build a consent management UI where users specify which third party receives access, what data categories are shared, and for what purpose.
- Recipient Validation: Confirm the third party's identity and capture their agreement to restrictions (no competing product development, GDPR compliance for personal data, trade secret confidentiality).
- Audit Trail: Log every sharing request: user ID, recipient, data scope, timestamp, purpose. Retain for compliance audits.
If the requested data contains trade secrets, trigger your handbrake protocol: identify the sensitive information, propose safeguards (NDAs, technical access controls), and document the negotiation. If no adequate protection can be agreed upon, you may refuse disclosure, but only after good-faith efforts.
3. Update Contracts and User Materials
Amend every agreement that governs connected products or related services:
- User Agreements: Add clauses confirming data access rights, third-party sharing processes, and any trade secret protections. Specify response timelines (e.g., "readily available data within 48 hours").
- B2B Contracts: If you're a data holder for business customers, clarify who qualifies as the "user" under the act (typically the business, not its employees). Define fair terms for data access and sharing.
- Cloud and SaaS Terms: Detail migration support obligations if a customer switches providers. The act requires you to facilitate portability.
Run updated terms through legal review in each EU member state where you operate. Data access language that works in Germany may need adjustment for French or Italian law.
4. Separate Personal from Non-Personal Data
The act covers both, but GDPR governs personal data. Where overlaps occur, GDPR takes precedence.
- Classification Tagging: Mark datasets as personal, non-personal, or mixed. Use data lineage tools to track origin and processing steps.
- Minimization Controls: For mixed datasets, apply GDPR minimization principles before fulfilling access requests. Don't disclose more personal data than necessary.
- Privacy Impact Review: If third-party sharing involves personal data, confirm the recipient has a lawful basis under GDPR (typically user consent or legitimate interest).
When in doubt, treat it as personal data and apply the stricter standard.
Validation - How to Verify It Works
Run these checks before September 2025:
User Access Test: Create test accounts representing EU consumers and business users. Submit data access requests through your standard workflow. Measure response time, data completeness, and format usability. Target: structured output delivered within 48 hours, no manual intervention required.
Third-Party Sharing Test: Simulate a user instructing you to share telemetry with a named third party. Verify your authorization UI captures purpose, logs the transaction, and enforces recipient restrictions. Confirm the third party receives only the authorized data scope.
Trade Secret Handbrake Test: Identify a dataset containing proprietary algorithms or production methods. Walk through your handbrake protocol: flag the trade secret, propose safeguards, document the negotiation. Confirm you can refuse disclosure if no adequate protection is agreed upon, and that refusal is logged with justification.
GDPR Overlap Test: For a dataset containing personal data, verify GDPR compliance before fulfilling an access request. Check minimization, lawful basis, and recipient obligations.
If any test fails, loop back to implementation. Don't wait for a user complaint or regulatory inquiry.
Ongoing Tasks
Compliance isn't a one-time build. Schedule these recurring tasks:
Quarterly Product Review: Every time you launch a new connected product or update an existing one, assess whether it generates user data subject to the act. Update your data flow map and access mechanisms accordingly.
Annual Trade Secret Audit: Review your trade secret register with IP and engineering teams. Remove outdated designations, add new protections, and verify safeguards are proportionate.
Bi-Annual Contract Refresh: As case law and regulatory guidance evolve, update user agreements and B2B contracts. Monitor European Data Protection Board opinions and national data protection authority guidance.
Incident Response Drill: Simulate a scenario where a user disputes your trade secret refusal or claims you've delayed access. Practice your escalation workflow, documentation requirements, and legal response.
The act doesn't just impose obligations; it unlocks commercial opportunities. Companies that modernize data architectures and contractual frameworks now can offer premium analytics, expand into after-market services, and compete in multi-vendor ecosystems. But you can't capitalize on those opportunities if you're scrambling to retrofit compliance six months from the deadline.
Start your data flow inventory this quarter. By mid-2025, you should have access mechanisms live, contracts updated, and cross-functional governance in place. That gives you a buffer for testing, fixes, and edge cases before September.
