Data Sharing Contracts Under the Data Act
Data sharing contracts between businesses must now pass the Data Act’s unfair terms test, and mandatory data sharing must be offered on fair, reasonable and non-discriminatory terms. This guide explains Article 13, the dates that apply to existing contracts, reasonable compensation, the Commission’s model contractual terms and supervision by the Federal Network Agency.
Key takeaways
- Unfair terms unilaterally imposed in B2B data contracts are not binding (Article 13 Data Act).
- The test applies to all enterprises, with a black list and a grey list of terms.
- Older long-term and indefinite contracts are covered from 12 September 2027.
- Mandatory data sharing requires FRAND terms and reasonable compensation; SMEs pay costs only.
- The Federal Network Agency supervises the Data Act in Germany under the DADG.
What the Data Act changes for data sharing contracts
Data sharing contracts between businesses are now subject to a specific fairness test. The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025, and its Chapter IV makes certain unfair terms in data sharing contracts non-binding where one enterprise has unilaterally imposed them on another. Alongside this fairness test, the Data Act regulates the terms on which data holders must make data from connected products available to users and third parties (Chapters II and III), including requirements of fair, reasonable and non-discriminatory (FRAND) terms and reasonable compensation.
For German companies, the practical effect is twofold. First, any template that governs access to and use of data — supply contracts for machinery with data clauses, platform terms, IoT service agreements, research collaborations — needs a review against Article 13. Second, where data must be shared because a user requests it, the contract with the third-party recipient must meet the Data Act's FRAND and compensation rules. Since the German implementing law entered into force on 30 May 2026, the Federal Network Agency (Bundesnetzagentur) supervises the Data Act in Germany.
The unfair terms test in Article 13
Article 13 applies to contractual terms concerning access to and use of data, or liability and remedies for breach or termination of data-related obligations, which an enterprise has unilaterally imposed on another enterprise. Such a term is not binding on the other party if it is unfair. A term is unfair if its use "grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing" (Article 13(3)).
The test applies to all enterprises, not only to SMEs. A term is considered unilaterally imposed if one party supplied it and the other could not influence its content despite an attempt to negotiate. The party that supplied the term bears the burden of proving that it was not unilaterally imposed. Terms that define the main subject matter of the contract, or the adequacy of the price as against the data supplied, are excluded from review (Article 13(8)), as are terms that reflect mandatory EU law. The parties cannot contract out of Article 13.
Black list and grey list
Article 13(4) contains a black list of terms that are always unfair. Article 13(5) contains a grey list of terms that are presumed to be unfair.
| Category | Examples | Effect |
|---|---|---|
| Always unfair (Article 13(4)) | Exclusion or limitation of liability of the imposing party for intent or gross negligence; exclusion of the other party's remedies for non-performance; exclusive right of the imposing party to decide whether data conform to the contract or to interpret terms | Not binding |
| Presumed unfair (Article 13(5)) | Inappropriate limitation of remedies or liability; use of the other party's data in a manner significantly detrimental to its legitimate interests, especially trade secrets; preventing the other party from using or obtaining a copy of data it provided or generated; preventing termination within a reasonable period; termination at unreasonably short notice; unilateral substantial changes to price or data quality without valid reason and termination right | Not binding unless the presumption is rebutted |
| Excluded from review (Article 13(8)) | Main subject matter of the contract; adequacy of the price against the data supplied | No fairness review |
If an unfair term can be severed, the rest of the contract remains binding (Article 13(7)).
Relationship to German standard terms law
German law already contains a strict control of standard business terms in §§ 305–310 of the Civil Code (Bürgerliches Gesetzbuch, BGB), which also applies between businesses. The Data Act test is a separate EU-law test with its own concept of "unilaterally imposed" terms and its own lists. In practice, data sharing contracts governed by German law may need to withstand both tests. Because the German courts' approach to standard terms in B2B contracts is already demanding, many terms that fail Article 13 will also be problematic under § 307 BGB, but the two analyses should be carried out separately.
Which data sharing contracts are covered and when
Chapter IV applies to contracts concluded after 12 September 2025. It applies from 12 September 2027 to contracts concluded on or before 12 September 2025 if they are of indefinite duration or are due to expire at least ten years from 11 January 2024 (Article 50). Long-term framework agreements and evergreen contracts with data clauses therefore need to be reviewed before September 2027.
The scope covers data sharing contracts in a broad sense: any contract term concerning access to and use of data, whether personal or non-personal, regardless of whether the sharing is mandatory under the Data Act or voluntary. Examples include data licences in industrial supply chains, telematics and fleet data agreements, data clauses in maintenance contracts, research and development agreements, and terms of data marketplaces and platforms.
Map your data sharing contracts now: identify which templates contain data access, data use, liability or termination clauses; note when each contract was concluded and when it expires; and flag evergreen and long-term contracts that will be covered from 12 September 2027.
FRAND terms and reasonable compensation
Where a data holder is obliged to make data available to a data recipient — in particular when a user of a connected product asks for data to be shared with a third party under Article 5 — Chapter III requires that this be done on fair, reasonable and non-discriminatory terms and in a transparent manner (Article 8). The data holder and the recipient must agree the arrangements, and the data holder must not discriminate between comparable categories of data recipients.
Article 9 governs compensation in these mandatory cases. Compensation must be non-discriminatory and reasonable and may include a margin. The parties must take into account in particular the costs of making the data available (formatting, dissemination and storage) and investments in collecting and producing the data. Compensation may also depend on volume, format and nature of the data.
Where the recipient is an SME or a not-for-profit research organisation without non-SME partner or linked enterprises, compensation must not exceed the costs of making the data available, without margin (Article 9(4)). The data holder must explain the basis of its calculation in sufficient detail for the recipient to assess compliance (Article 9(7)). The Commission is required to adopt guidelines on the calculation of reasonable compensation (Article 9(5)).
Dispute settlement
Users, data holders and data recipients have access to certified dispute settlement bodies for disputes over FRAND terms and compensation (Article 10). In Germany, the Federal Network Agency certifies these bodies under § 5 of the Data Act Application and Enforcement Act (Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz, DADG). Parties remain free to go to court.
The Commission's model contractual terms
Article 41 required the Commission to develop and recommend non-binding model contractual terms (MCTs) on data access and use, including terms on reasonable compensation and the protection of trade secrets, and standard contractual clauses for cloud computing contracts. On 19 November 2025, the Commission approved a draft Recommendation containing these templates. According to the Commission's page, which was last updated in March 2026, the English text was available and translation into the other EU languages was the next step.
The model contractual terms include separate sets for mandatory data sharing under Chapters II and III (data holder to user, user to data recipient and data holder to data recipient) and a set for voluntary data sharing between businesses designed to comply with Chapter IV. They are voluntary and can be adapted.
For German companies, the MCTs are a useful benchmark: a term that departs significantly from them in favour of the drafting party is more likely to be challenged as unfair. However, the MCTs are drafted for EU-wide use and do not address German law specifics, such as standard terms control, the German Trade Secrets Act (Geschäftsgeheimnisgesetz, GeschGehG) or choice-of-law and forum questions.
Drafting data sharing contracts after the Data Act
Good drafting reduces the risk that key clauses fall away. The following points are particularly relevant:
- Negotiation record: Since the supplying party must prove that a term was not unilaterally imposed, keep records of genuine negotiations and of changes made at the counterparty's request.
- Liability: Do not exclude liability for intent or gross negligence; calibrate caps for ordinary negligence to the risk and the price.
- Data use by the stronger party: Describe permitted uses precisely, protect trade secrets and avoid broad rights to use the other party's data for any purpose.
- Access and copies: Ensure that the counterparty can use and obtain a copy of data it provided or generated during and after the contract.
- Termination and changes: Provide reasonable termination periods and objective reasons for unilateral changes, combined with a right to terminate at no cost.
- Trade secrets: Use the confidentiality and protective measures provided for in Articles 4(6) and 5(9) where trade secrets are involved, and define the consequences if the recipient breaches them.
- Compensation: Document the cost basis and any margin, and check SME status of the recipient.
Personal data remain subject to the GDPR. A data sharing contract does not replace a legal basis for processing or a data processing agreement where one is required. See our insight on intra-group data sharing.
Supervision and fines in Germany
Under § 2 DADG, the Federal Network Agency is the competent authority for the application and enforcement of the Data Act in Germany and acts as the central contact point; the Federal Commissioner for Data Protection and Freedom of Information is the competent data protection authority for questions involving personal data (§ 3 DADG).
Article 13 itself is enforced through civil law: an unfair term is simply not binding. Breaches of other obligations relating to data sharing contracts can, however, be fined under § 15 DADG. Examples include failing to provide information on the basis of compensation under Article 9(7) and using technical protection measures that discriminate between data recipients contrary to Article 11(1). The amounts depend on the infringement and range up to EUR 5 million (or 2% of total worldwide turnover for companies with turnover above EUR 250 million) for the most serious category, which concerns improperly inducing users to share data. See our page on the Data Act.
The Digital Omnibus proposal presented by the Commission in November 2025 (COM(2025) 837) would make targeted amendments to the Data Act, including adjustments to the cloud switching chapter for certain providers. At the time of writing, it had not been adopted, so the rules described here continue to apply. See our insight on the Digital Omnibus.
How TRW & Co helps with data sharing contracts
We review and draft data sharing contracts, data licences, IoT and platform terms against the Data Act's unfair terms test and German standard terms law, and we compare existing templates with the Commission's model contractual terms. We advise data holders and data recipients on FRAND terms, compensation models, trade secret protection and dispute settlement, and represent clients before the Federal Network Agency and in contractual disputes. See also our pages on commercial contracts and data and digital, or contact us.
Frequently asked questions
Do the Data Act unfair terms rules apply only to SMEs?
No. Article 13 of the Data Act, as adopted, protects any enterprise against unfair terms concerning data access and use that another enterprise has unilaterally imposed on it. Size matters elsewhere, for example for compensation: SMEs and not-for-profit research organisations requesting data under a mandatory sharing obligation pay at most the costs of making the data available.
Do existing data sharing contracts have to be renegotiated?
Chapter IV applies to contracts concluded after 12 September 2025. Contracts concluded on or before that date are covered from 12 September 2027 if they are of indefinite duration or expire at least ten years from 11 January 2024. Unfair terms in those contracts will then no longer be binding, so a review before September 2027 is advisable.
Are the Commission’s model contractual terms binding?
No. The model contractual terms on data access and use and the standard contractual clauses for cloud contracts are non-binding recommendations under Article 41 of the Data Act. Companies may use and adapt them. They are a useful benchmark for fairness, but they do not address German contract law specifics such as standard terms control.
What compensation can a data holder ask for?
In mandatory B2B data sharing, compensation must be non-discriminatory and reasonable and may include a margin. It should reflect the costs of making data available and investments in producing the data. For SME and not-for-profit research recipients, it is limited to costs. The data holder must disclose the basis of its calculation.
Who enforces the Data Act in Germany?
The Federal Network Agency, under the Data Act Application and Enforcement Act (DADG), which entered into force on 30 May 2026. The Federal Commissioner for Data Protection and Freedom of Information is responsible for questions involving personal data. Unfair contract terms are dealt with by the civil courts, as the sanction is that the term is not binding.
Sources
General information only, not legal advice. References to statutes, courts and authorities describe published law and practice at the date shown.