What is the Data Act?
The Data Act, Regulation (EU) 2023/2854, is the European law that gives users of connected products, such as machines, vehicles and IoT devices, access to the data those products generate and the right to share that data with third parties. The law has applied since 12 September 2025. For industry this means that machine data no longer automatically belongs to the manufacturer alone: the plant using the machine can request that data and, for example, have it analysed by an independent maintenance provider.
🗓️ When does the Data Act apply?
| Date | Milestone |
|---|---|
| 11 January 2024 | Entry into force |
| 12 September 2025 | Applies: access rights, sharing with third parties, cloud switching |
| 12 September 2026 | Design obligation (Art. 3(1)) for connected products newly placed on the market |
| 12 September 2027 | Rules on unfair contractual terms also cover older contracts |
🧠 What rights does the Data Act grant?
- Access to product data — the user can request the raw and pre-processed data of a connected product, free of charge and in a common, machine-readable format
- Sharing with third parties — the user can require the manufacturer (data holder) to make the data available to a chosen third party, such as a maintenance company or system integrator
- Transparency up front — before purchase it must be clear what data a product collects and how it can be accessed
- Switching between cloud providers — easier migration between cloud and edge services, without high switching charges
- Fair contracts — unfair data terms imposed by a larger party on a smaller one are not binding
🏭 What does the Data Act mean for OT and industry?
| Role | Consequence |
|---|---|
| Machine builder / OEM | Build data access into the design, for example via OPC UA or MQTT; arrange data access contractually |
| Plant (user) | Right to the data of purchased and leased machines, including for OEE analysis and predictive maintenance |
| Service and analytics provider | Can gain access, through the user, to data previously held only by the manufacturer |
| Cloud and IIoT platform | Must make switching to another provider possible |
Trade secrets remain protected: a manufacturer may require additional safeguards and, in exceptional cases, refuse if sharing would demonstrably cause serious economic damage.
🔐 What security considerations are there?
Sharing more data means more connections between OT, IT and external parties. Pay attention to:
- Controlled interfaces — data leaves through a DMZ or IDMZ, never via direct access to the controllers
- Access control and least privilege for third parties
- Third-party risk management for every party that receives data
- GDPR — if machine data can be traced to individuals, such as operators, privacy law applies as well
🔄 How does the Data Act relate to other legislation?
- GDPR — protects personal data; the Data Act covers all product data, including non-personal data
- Cyber Resilience Act — sets security requirements for the product; the Data Act is about access to the data
- AI Act — shared machine data often becomes training data for industrial AI
🛠️ How should a plant or machine builder handle the Data Act?
As a plant (user):
- Map which connected machines send data to the supplier
- Ask what data is collected and how you can access it
- Lay down data access in new purchasing and maintenance contracts
- Decide which third parties, such as a maintenance company or analytics partner, may receive the data
As a machine builder (data holder):
- Inventory which product and service data your machines generate
- Design a standard interface for users, for example an OPC UA server or an export function
- Prepare the mandatory pre-purchase information: which data, which format, how often
- Set up a process for requests from users and third parties, including protection of trade secrets
- Adapt your contracts to the rules against unfair terms
| Data type | Covered by the access right? |
|---|---|
| Raw sensor data and status information | Yes |
| Pre-processed data (e.g. averages, filtered values) | Yes |
| Derived insights from the manufacturer’s own algorithms | No |
| Content such as video or audio created by the user | Out of scope |
❓ Frequently asked questions
When does the Data Act apply?
The Data Act has applied since 12 September 2025. Since that date, users have had the right to access the data of their connected products. The design obligation, requiring new products to make that data accessible by default, applies to products placed on the market after 12 September 2026.
Does the Data Act apply to industrial machinery?
Yes, the Data Act applies to all connected products that generate data about their use or environment, including industrial machines, vehicles, agricultural machinery and IoT devices. A plant using a connected machine has the right to the data that machine generates, even if that data normally only goes to the manufacturer.
May a manufacturer refuse to share data?
A manufacturer may refuse to share data only in exceptional cases, for example if sharing would demonstrably cause serious economic damage by disclosing trade secrets, or if it would endanger safety. The manufacturer must justify the refusal and notify the competent authority.
What is the difference between the Data Act and the GDPR?
The GDPR protects personal data and gives individuals rights over data about them. The Data Act covers all data from connected products, including non-personal machine data, and governs who has access and with whom that data may be shared. Where personal data is involved, both laws apply at the same time.
Must machine data be shared free of charge?
The user gets access to the data of their connected product free of charge. If the user asks the manufacturer to provide the data to a third party, the manufacturer may charge reasonable compensation. For SMEs that compensation may not exceed the actual costs.
📌 In summary
Since 12 September 2025 the Data Act has given users of connected machines and devices the right to their own product data, and requires manufacturers to share that data with third parties on request. New connected products must, since 12 September 2026, be designed so that this data is accessible by default.