EU Data Act Compliance in Germany

The Data Act in brief

The EU Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. It is designed to unlock the value of data generated by connected products such as machines, vehicles, household appliances and industrial equipment, and by related digital services.

The Regulation gives users a right to access that data and to have it shared with third parties of their choice, restricts unfair data clauses imposed on other businesses, creates rules for data requests by public bodies in exceptional situations and requires cloud and other data processing service providers to make switching easier. From 12 September 2026, newly placed connected products must be designed so that their data are accessible to the user by default.

In Germany, the Data Act is enforced by the Federal Network Agency (Bundesnetzagentur) under the Data Act Application and Enforcement Act (Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz, DADG), which entered into force on 30 May 2026. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible for the data protection aspects in relation to private bodies. This page explains who is affected, the key obligations, the timetable and how to prepare. For the wider framework, see our data and digital law overview.

Who is affected by the Data Act

The Regulation affects several groups of companies in different ways:

• Manufacturers of connected products placed on the EU market, and providers of related services, such as apps that control a device. They must design products for data access and are usually "data holders".
• Users of connected products, both consumers and businesses, who gain rights to access and share data.
• Data recipients, such as independent repair, maintenance and analytics providers, who receive data at the user's request.
• Enterprises that agree on data access and use in B2B contracts, which are subject to the unfair-terms test.
• Providers of data processing services, including cloud, platform and software-as-a-service providers, which must enable switching.

Micro and small enterprises are exempt from the user access and data-sharing obligations of Chapter II for data generated by connected products they manufacture or design or related services they provide, as long as they have no partner or linked enterprise that does not qualify, and are not subcontracted to manufacture or design such products (Article 7(1)). The exemption does not apply to the switching rules, and medium-sized companies benefit only from transitional relief in limited cases. Groups should therefore assess their position at group level.

Access by design and user data rights

The centrepiece of the Regulation is the user's right to data. Connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data, including the metadata needed to interpret them, are by default easily, securely and, where relevant and technically possible, directly accessible to the user (Article 3(1)). This obligation applies to products and services placed on the market after 12 September 2026. Before a contract is concluded, the user must be informed about the type, format and volume of data, how to access them and who holds them (Article 3(2), (3)).

Where data cannot be accessed directly, the data holder must make readily available data accessible to the user without undue delay, free of charge and, where possible, continuously and in real time (Article 4). At the user's request, the data holder must make the data available to a third party (Article 5). Gatekeepers designated under the Digital Markets Act cannot be such third-party recipients. Data recipients may only use the data for the purposes agreed with the user and may not use them to develop a competing connected product (Article 6).

Protection of trade secrets

Data holders can protect trade secrets, but only through a structured process. They must identify the data protected as trade secrets and agree on proportionate technical and organisational measures with the user or third party, such as confidentiality agreements and access controls.

Where the user fails to implement agreed measures or undermines confidentiality, the data holder may withhold or suspend sharing. In exceptional circumstances, where a data holder can show that disclosure would be highly likely to cause serious economic damage despite such measures, it may refuse a request on a case-by-case basis, giving reasons in writing and notifying the competent authority. In Germany, those notifications go to the Federal Network Agency, which reports them to the Commission (§ 2(2) DADG).

Data-sharing contracts and unfair terms

Where a data holder must make data available to a business data recipient, it must do so on fair, reasonable and non-discriminatory terms and in a transparent way. It may agree reasonable compensation, which for SMEs may not exceed the costs of making the data available (Articles 8 and 9). The Commission has been tasked with developing non-binding model contractual terms to help parties draft these arrangements.

Chapter IV introduces an unfairness test for terms on data access and use, or on liability and remedies for breach or termination of data-related obligations, that one enterprise has unilaterally imposed on another. Such a term is not binding if it is unfair, meaning that its use grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing (Article 13(1), (3)).

The Regulation lists terms that are always unfair, such as excluding liability for intentional acts or gross negligence, and terms that are presumed unfair. Chapter IV applies to contracts concluded after 12 September 2025 and, from 12 September 2027, also to certain older contracts.

The test sits alongside the German rules on standard business terms in §§ 305 to 310 of the Civil Code (BGB), which already apply between businesses and are applied strictly by German courts. In practice, data clauses in supply, maintenance and licence agreements must pass both tests. See our insight on data-sharing contracts under the Data Act.

Cloud switching under the Data Act

Chapter VI requires providers of data processing services, which includes infrastructure, platform and software services, to remove obstacles that prevent customers from switching to another provider or to on-premises infrastructure. The rights and obligations on switching must be set out in a written contract, including a maximum notice period for initiating switching of no more than two months, a transitional period of generally no more than 30 calendar days to complete the switch, assistance during the process and a specification of the data and digital assets that can be ported (Article 25).

Switching charges are being phased out. Since 11 January 2024, providers may only charge reduced fees not exceeding the costs directly linked to the switching process, and from 12 January 2027 they may not impose any switching charges (Article 29). Providers must also inform customers about the jurisdiction of their ICT infrastructure and about measures to prevent unlawful third-country government access to non-personal data. Customers should use contract renewals to align their cloud agreements with these rules; see our insights on cloud switching under the Data Act and SaaS and cloud contracts.

Public-sector data requests

Chapter V allows public sector bodies, the Commission and certain EU bodies to request data from companies where there is an exceptional need, in particular to respond to a public emergency such as a major natural disaster, or to carry out a specific task in the public interest where the data cannot be obtained otherwise. Requests must be proportionate, specify the data and purpose, and respect trade secrets.

Micro and small enterprises are only obliged in public emergencies. In Germany, the DADG assigns the Federal Network Agency a role in reviewing data requests by federal public bodies. Companies should designate a contact point and a process for handling such requests, which will be rare but urgent.

Interoperability and smart contracts

The Regulation also sets essential requirements for participants in data spaces and for vendors of smart contracts used to execute data-sharing agreements, such as robust access control, safe termination and interruption, and data archiving. These rules matter for companies building industry data platforms, for example in the automotive or manufacturing sector, where several firms pool machine or supply chain data under common rules.

Data Act enforcement in Germany

The DADG makes the Federal Network Agency the competent authority for applying and enforcing the Regulation and the central point of contact for questions, complaints and supervision (§ 2 DADG). The BfDI is the competent data protection authority for monitoring the Regulation's application to personal data held by private bodies, departing from the usual competence of the state authorities, and cooperates with the Federal Network Agency (§ 3 DADG). The Federal Network Agency can investigate, require information, issue provisional orders and approve dispute settlement bodies.

Infringements can be punished with fines. The DADG sets tiers of up to EUR 50,000, EUR 100,000, EUR 500,000 and EUR 5 million depending on the infringement, and for companies with total worldwide turnover above EUR 250 million the most serious category can reach 2% of turnover (§ 15(4), (5) DADG). Failing to design connected products correctly under Article 3(1) and failing to make data available as required are among the listed offences.

Private enforcement also matters: users and data recipients may bring civil claims to enforce access, and unfair terms are simply not binding. Disputes can also be taken to dispute settlement bodies certified under the Regulation, which the Federal Network Agency approves in Germany (§ 5 DADG). For many companies, the realistic risk in the first years is less a fine than a dispute with a large customer or service partner who insists on data access as a condition of continued business.

Personal data within product data remain subject to the GDPR, which prevails in case of conflict. A user's request for data that include personal data of other individuals, such as drivers of a fleet vehicle, therefore requires a GDPR legal basis for the disclosure. See our page on German data protection law.

Preparing for the Data Act: a practical roadmap

Most companies benefit from a phased approach that starts with the products and contracts closest to the deadlines and then extends to the wider portfolio and supplier base. The following steps have proved workable:

1. Scope: list connected products, related services and data processing services, and identify which group companies are manufacturers, data holders or providers.
2. Product design: for products placed on the market after 12 September 2026, implement access-by-design and pre-contractual information.
3. Request handling: build a process and interface for user and third-party requests, including identity checks and response timelines.
4. Trade secrets: classify data, define protective measures and prepare templates for confidentiality agreements.
5. Contracts: review data clauses in supply, licence, maintenance and customer contracts against Chapter IV and §§ 305–310 BGB.
6. Cloud: update switching terms as provider, and review exit rights as customer, ahead of 12 January 2027.
7. Governance: align Data Act work with GDPR, Cyber Resilience Act and AI Act compliance, and assign a single owner for requests and disputes.

Illustration: a hypothetical German agricultural machinery manufacturer launches a new tractor model in October 2026. Because the model is placed on the market after 12 September 2026, its telematics data must be accessible to farmers by design. A farmer asks for the data to be shared with an independent agronomy service. The manufacturer shares the data via an API under standard terms, protects the engine-calibration parameters it has identified as trade secrets through a confidentiality agreement, and ensures that the agronomy service cannot use the data to develop a competing tractor.

How TRW & Co helps

We help manufacturers, service providers, cloud providers and their customers comply with the Data Act. We map products and data flows, draft user information, access terms and trade-secret protection measures, and review and redraft data-sharing, licensing and cloud contracts against Chapter IV and German standard-terms law.

We set up request-handling processes and API terms with your product and IT teams, and train customer service staff to recognise data requests. We advise on the interaction with the GDPR, the Cyber Resilience Act and the AI Act, and represent clients before the Federal Network Agency and in disputes over data access. To discuss your Data Act programme, please contact us. This page is general information and not legal advice.