Data Act
Does the Data Act apply to my product or service?
Regulation (EU) 2023/2854 (Data Act) creates user data-access rights, B2B data-sharing rules, and cloud-switching obligations. Answer 5 questions to find out which provisions apply to you.
Last updated: 12 May 2026
Do Data Act scope need to comply with Data Act?
Regulation (EU) 2023/2854 (Data Act) creates user data-access rights, B2B data-sharing rules, and cloud-switching obligations. Answer 5 questions to find out which provisions apply to you. If yes: Data Act applies — full duties including GDPR overlay. If not: Data Act likely does…
- Yes path: Data Act applies — full duties including GDPR overlay
- No path: Data Act likely does not apply
- Use the step-by-step decision tree below for your exact situation
Data Act · Question 1
Do you manufacture or supply a 'connected product' (a physical product that generates data through its components or use) placed on the EU market?
Article 2(5) defines a connected product as an item that obtains, generates, or collects data concerning its use or environment and is able to communicate that data via an electronic communications service.
For informational purposes only. Consult qualified legal counsel before making compliance decisions.
Decision tree questions
Do you manufacture or supply a 'connected product' (a physical product that generates data through its components or use) placed on the EU market?
Article 2(5) defines a connected product as an item that obtains, generates, or collects data concerning its use or environment and is able to communicate that data via an electronic communications service.
- Yes: Continue to: Do you also provide a 'related service' (a digital service connected to the product, without which the product cannot perform its functions)?
- No: Continue to: Do you provide a 'data processing service' (cloud computing, edge computing, or related infrastructure service) to customers in the EU?
Do you also provide a 'related service' (a digital service connected to the product, without which the product cannot perform its functions)?
Related services are commonly bundled with connected products (e.g. companion mobile apps, telemetry dashboards). The data-access duties extend to data generated by the related service.
- Yes: Continue to: Does the data generated include personal data (data relating to an identified or identifiable natural person)?
- No: Data Act applies — connected product without related service
Does the data generated include personal data (data relating to an identified or identifiable natural person)?
Personal data triggers GDPR Chapter V transfer rules and Article 6 lawful-basis requirements alongside the Data Act access rights. Article 4(5) of the Data Act preserves GDPR.
- Yes: Data Act applies — full duties including GDPR overlay
- No: Data Act applies — non-personal data access duties
Do you provide a 'data processing service' (cloud computing, edge computing, or related infrastructure service) to customers in the EU?
Article 2(8) defines data processing services broadly to include IaaS, PaaS, and SaaS. These services are subject to cloud-switching obligations under Chapter VIII.
- Yes: Data Act applies — cloud-switching obligations (Chapter VIII)
- No: Continue to: Are you a 'data holder' that receives or controls data generated by another party's connected product (e.g. as a downstream processor or analytics partner)?
Are you a 'data holder' that receives or controls data generated by another party's connected product (e.g. as a downstream processor or analytics partner)?
Article 2(13) defines a data holder. Even without manufacturing the product, you may hold the data and bear the Article 4 on-request access duty.
- Yes: Data Act may apply — downstream data-holder duties
- No: Data Act likely does not apply