Cloud Switching Under the Data Act
Cloud switching has become a statutory right: since September 2025, the Data Act has required cloud providers to remove obstacles to switching, set out exit rights in writing and limit switching charges, which disappear entirely from 12 January 2027. This guide explains the rules, the exemptions, the technical duties and enforcement in Germany.
Key takeaways
- Cloud contracts must allow switching with at most two months’ notice and normally 30 days’ transition.
- Switching charges are limited to direct costs until 12 January 2027 and prohibited afterwards.
- Customers have at least 30 days to retrieve data after the transitional period.
- Custom-built services and test versions are partly or fully exempt.
- The Federal Network Agency can fine breaches under § 15 DADG.
Cloud switching rights at a glance
Cloud switching is one of the most concrete changes the Data Act brings for business customers. Since 12 September 2025, Chapter VI of the Data Act (Regulation (EU) 2023/2854) has required providers of data processing services — infrastructure, platform and software as a service, as well as other cloud and edge services — to remove obstacles that prevent customers from moving to another provider or back to their own on-premises infrastructure. Contracts must give customers a right to switch with a notice period of no more than two months and a transitional period of normally 30 calendar days.
The economic centrepiece is the phasing out of switching charges. Until 12 January 2027, providers may charge reduced switching charges limited to their direct costs. From 12 January 2027, switching charges are prohibited altogether (Article 29). For German companies that buy cloud services, this is the moment to review exit clauses and renegotiate where necessary. For providers, including German SaaS businesses, it means adapting contracts, pricing and technical processes.
Who the cloud switching rules apply to
The rules apply to providers of "data processing services", defined as digital services that enable on-demand network access to a shared pool of configurable, scalable and elastic computing resources (Article 2(8)). This covers most IaaS, PaaS and SaaS offerings, regardless of whether the customer is a business or a consumer and regardless of where the provider is established, as long as the service is offered in the EU.
Some services are partly exempted. Article 31(1) excludes custom-built services — where the majority of main features has been custom-built for an individual customer, or all components have been developed for that customer, and the service is not offered at broad commercial scale via the provider's catalogue — from the obligations on functional equivalence, switching charges and certain technical requirements. Non-production versions offered for testing and evaluation for a limited time are excluded from Chapter VI entirely (Article 31(2)). Providers must inform customers before contracting which obligations do not apply (Article 31(3)).
Chapter VI applies from 12 September 2025 without a separate transitional regime for existing contracts in Article 50, unlike Chapter IV on unfair terms. Existing cloud contracts should therefore already comply.
Mandatory contract terms for cloud switching
Article 25 requires the customer's switching rights and the provider's obligations to be set out clearly in a written contract, made available before signing in a way the customer can store and reproduce. The contract must include at least the following:
| Element | Requirement under Article 25 |
|---|---|
| Maximum notice period | Not more than two months to initiate the switching process |
| Transitional period | Switching without undue delay and no later than 30 calendar days after the notice period; extendable by the provider to a maximum of seven months if 30 days are technically unfeasible, with justification within 14 working days |
| Customer's extension right | The customer may extend the transitional period once for a period it considers more appropriate |
| Provider's duties during transition | Reasonable assistance, business continuity, information on known risks, high level of security |
| Exportable data | Exhaustive specification of data and digital assets that can be ported, including at least all exportable data |
| Data retrieval | At least 30 calendar days after the transitional period |
| Erasure | Full erasure of exportable data and digital assets after the retrieval period, once switching is complete |
| Termination | Contract ends on successful switching or at the end of the notice period if the customer chooses erasure |
| Charges | Any switching charges permitted under Article 29 |
The provider must also support the customer's exit strategy and provide information on switching procedures, methods, formats and known limitations, together with a reference to an up-to-date online register of data structures and formats (Article 26). All parties, including the destination provider, must cooperate in good faith (Article 27).
Check your existing cloud contracts against Article 25 now. Missing exit clauses, notice periods longer than two months or vague definitions of exportable data are common gaps — and they matter most when a switch is actually planned under time pressure.
Abolition of switching charges from January 2027
"Switching charges" are charges, other than standard service fees or early termination penalties, imposed by a provider for the actions the Data Act requires for switching (Article 2(36)). Under Article 29:
- From 11 January 2024 to 12 January 2027, providers may impose only reduced switching charges that do not exceed costs directly linked to the switching process.
- From 12 January 2027, no switching charges may be imposed at all.
- Before contracting, providers must inform customers about standard fees, early termination penalties and any reduced switching charges, and about services where switching is highly complex or costly.
Two points need attention. First, early termination penalties remain permissible in principle because they fall outside the definition of switching charges, but they must not be used to recreate an obstacle to switching, which Article 23 prohibits. Second, data egress charges for in-parallel use of several cloud services may still be charged, but only to pass on egress costs actually incurred (Article 34(2)). Customers should read pricing schedules carefully, as some costs may be re-labelled.
Illustration
Illustration (hypothetical): a German manufacturer uses a SaaS platform for production planning under a three-year contract concluded in 2024. In 2026 it decides to move to another provider. It gives notice of its decision to switch; the provider may require up to two months' notice and must then complete the switch within 30 days, unless it justifies a longer period within 14 working days.
The provider may invoice its direct costs of the switching process if the switch takes place before 12 January 2027, but not a flat exit fee. If the fixed term has not yet expired, an early termination penalty agreed in the contract may still be payable, but it must not be so high that it effectively prevents switching.
Technical obligations and interoperability
Infrastructure providers (IaaS) must take all reasonable measures to help customers achieve functional equivalence after switching to a service of the same type (Article 30(1)). Other providers must make open interfaces available free of charge to customers and destination providers, and must ensure compatibility with common specifications or harmonised standards for interoperability at least 12 months after their publication in the central Union repository (Article 30(2) and (3)).
Where no such specifications have been published, the provider must export all exportable data in a structured, commonly used and machine-readable format on request (Article 30(5)). Providers are not required to develop new technologies or to disclose intellectual property or trade secrets (Article 30(6)).
Providers must also publish on their websites the jurisdiction to which their ICT infrastructure is subject and the measures taken to prevent unlawful international governmental access to non-personal data (Article 28).
Drafting and negotiating cloud switching clauses
For customers, the Data Act provides a statutory floor, not a complete exit plan. Practical steps include:
- Inventory cloud services and classify each as IaaS, PaaS, SaaS or custom-built.
- Compare the contract with the Article 25 checklist and request missing terms.
- Define the scope of exportable data and digital assets, formats and documentation.
- Plan the transitional period, including support from the destination provider.
- Align switching rights with GDPR data processing agreements and, in regulated sectors, with outsourcing and DORA requirements.
- Check pricing for switching charges, egress fees and early termination penalties.
For providers, cloud switching compliance affects standard terms, order forms, product documentation and support processes. Providers should also consider the interaction with German standard business terms law (§§ 305–310 BGB) and with the unfair terms test for data-related terms in Article 13 of the Data Act. The Commission's draft standard contractual clauses for cloud computing contracts, approved on 19 November 2025, include clauses on switching and exit, termination, and security and business continuity, and can serve as a benchmark. See our insight on SaaS and cloud contracts under German law.
Interaction with data protection and regulated sectors
Cloud switching usually involves personal data. The GDPR continues to apply in full: the data processing agreement under Article 28 GDPR must provide for the return or deletion of personal data at the end of the service, and the destination provider needs its own processing agreement. Where the new provider processes data outside the EU, transfer rules apply. Cloud switching therefore requires coordination between the procurement, IT and data protection functions.
In the financial sector, the Digital Operational Resilience Act (Regulation (EU) 2022/2554, DORA) requires exit strategies for ICT services supporting critical or important functions, and banks and insurers are subject to outsourcing requirements. The Data Act's switching rights help to make these exit strategies workable, but they do not replace the specific contractual requirements of financial regulation. Operators of critical infrastructure and entities covered by NIS2 should also make sure that security and business continuity during the switch are documented.
Supervision, fines and the Digital Omnibus
In Germany, the Federal Network Agency is the competent authority under the Data Act Application and Enforcement Act (Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz, DADG), which entered into force on 30 May 2026.
Under § 15 DADG, it is an administrative offence, among other things, to impose obstacles contrary to Article 23, to fail to provide the contract under Article 25(1), to fail to provide the information required by Article 26, to fail to make open interfaces available or to export data contrary to Article 30, and to fail to inform customers under Article 31(3). Depending on the infringement, fines range up to EUR 50,000 or EUR 100,000. Customers can also enforce switching rights in the civil courts.
Customers who meet resistance from a provider may also lodge a complaint with the Federal Network Agency, which has powers to investigate, request information and order compliance under §§ 6 to 9 DADG. In practice, a well-documented switching request that cites the relevant provisions of Articles 23 to 30 and sets clear deadlines is often the most effective first step, both for negotiations and for any later complaint or court proceedings.
The Digital Omnibus proposal of November 2025 (COM(2025) 837) would introduce a lighter regime for custom-made services and for services provided by SMEs and small mid-caps under contracts concluded before 12 September 2025, and would clarify that such providers can agree early termination penalties in fixed-term contracts. At the time of writing, the proposal had not been adopted. See our insight on the Digital Omnibus.
How TRW & Co helps with cloud switching
We advise cloud customers on reviewing and renegotiating contracts, planning exits and enforcing cloud switching rights, and we advise providers on adapting terms, pricing and processes to Chapter VI of the Data Act. Our work covers SaaS and outsourcing contracts, data processing agreements, regulated-sector requirements and disputes with providers. See also our pages on the Data Act and commercial contracts, our insight on data sharing contracts, or contact us.
Frequently asked questions
From when are switching charges prohibited?
From 12 January 2027, providers of data processing services may not impose any switching charges on customers for the switching process (Article 29(1) Data Act). Until then, they may charge reduced switching charges that do not exceed costs directly linked to the switch. Standard service fees and early termination penalties are not switching charges.
How long is the notice period for cloud switching?
The contract must provide a maximum notice period of two months to initiate the switching process. The switch itself must then be completed without undue delay and within a transitional period of 30 calendar days, which the provider can extend to up to seven months if 30 days are technically unfeasible. The customer may extend the period once.
Do the rules apply to existing cloud contracts?
Yes. Chapter VI of the Data Act has applied since 12 September 2025, and Article 50 contains no separate transitional regime for existing cloud contracts. The Digital Omnibus proposal would relax certain obligations for custom-made services and SME providers under older contracts, but it had not been adopted at the time of writing.
Are SaaS services covered?
Yes. Data processing services include infrastructure, platform and software as a service, provided the service gives on-demand network access to scalable and elastic computing resources. Custom-built services not offered at broad commercial scale are exempt from some obligations, and time-limited test versions are excluded entirely.
Who enforces cloud switching rights in Germany?
The Federal Network Agency supervises the Data Act under the DADG and can impose fines, for example for obstacles to switching or missing contract terms. Customers can also enforce their contractual and statutory rights against providers in the civil courts.
Sources
General information only, not legal advice. References to statutes, courts and authorities describe published law and practice at the date shown.