EU Data Act explained: What it means for connected products, services, and IoT devices

On 12 September 2025, the EU Data Act introduced new requirements for connected products and related services. These include smart devices that generate data and the digital services that support them. The law gives users stronger rights over their data and places new duties on the organisations that design, sell, or maintain these products. 

Having first entered into force in January 2024, the Act requires companies to know exactly what data their products produce, where it flows, and how to provide it to users quickly and securely. For businesses, this isn’t just an administrative update — it demands new technical capabilities, redesigned contracts, and tighter governance to deliver real-time, secure data access. 

This blog explains what the EU Data Act means for your business. We outline the key requirements now in force and share practical steps organisations should take to stay compliant and maintain a competitive advantage. 

• What is the EU Data Act?
• How does the EU Data Act differ from the GDPR? 
• Obligations under the EU Data Act 
• Practical steps for organisations 

What is the EU Data Act? 

The EU Data Act aims to promote fair access to, and use of, data generated by connected devices and their related services. Under the Act, users must be able to access and share the data their devices create, securely and without unnecessary delay.  

The Act covers all data created during device use — personal and non-personal alike — including raw outputs, pre-processed information, and metadata. 

What is a connected product or related service? 

• Connected product: Any physical item that collects or generates data and can communicate it through an electronic communications service, physical connection, or on-device access, including medical devices, smart-home technology, connected vehicles, and many Internet of ThingsThe concept of connecting everyday devices to the internet and to each other for the purposes of collecting, receiving and sending data about their use. (IoT)-enabled devices 

• Related service: Any digital service needed to access or processA series of actions or steps taken in order to achieve a particular end. a connected product’s data, such as a cloud platform or mobile appAn application, downloaded by a user to a mobile or other device. 

Who must comply? 

The Act applies to organisations that place connected products or related services on the EU market, even if they are established outside the EU. This includes manufacturers of connected products, as well as service providers or platform operators that manage the data those products generate. 

Within the Act, organisations that have the right or obligation to use data or otherwise make data available are referred to as data holders. Other entities involved in delivering the service or processing the data may also have compliance duties even if they are not formally classified as data holders. 

How does the EU Data Act differ from the GDPR?

Although often mentioned together, the Data Act and General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) serve different purposes. The GDPR sets broad rules for the lawful processing of personal dataInformation which relates to an identified or identifiable natural person., whilst the Data Act focuses specifically on connected products and their related services. Its scope is narrower in subject matter but broader in the data it covers, extending to all device-generated information, including non-personal data. 

Both laws cover areas such as access, portability, and certain design features, but while the GDPR offers a higher-level framework, the Data Act introduces stricter, more prescriptive requirements that businesses must follow. 

Understanding these differences helps organisations avoid the common misconception that meeting GDPR requirements automatically covers the Data Act.  

Obligations under the EU Data Act

From 12 September 2025, organisations marketing connected products or related services in the EU must meet the following requirements: 

Future requirements 

From 12 September 2026, new connected products and related services must be designed so users can directly, securely, and freely obtain their data. Manufacturers will need to build data-access features into product design, and service providers must support cloud switching and interoperability. 

Practical steps for organisations 

Meeting the EU Data Act’s obligations and preparing for future requirements demands both immediate action and long-term planning. 

Approached strategically, these steps will do more than help you achieve compliance. Transparent data access can strengthen customer trust, open the door to new partnerships, and position early movers as leaders in data sharing — turning compliance into a genuine competitive advantage. 

Map and classify data

Identify any connected products or related services and catalogue all personal and non-personal data they generate. A full data inventory and updated Record of Processing Activities (RoPA) will expose gaps and streamline compliance. 

Update contracts and governance 

Revise agreements with customers, suppliers, and partners to incorporate the EU’s model contractual terms and ensure fair clauses, especially when dealing with SMEs. Include portability clauses for cloud services to avoid vendor lock-in and review international transferThe movement of data from one place to another. This could be, for example, from one data controller to another, or from one jurisdiction to another. mechanisms to prevent unlawful foreign access.

Build technical capability

Implement processes that give users real-time, machine-readable access to their data and enable secure third-party sharing. For legacy products, prioritise high-volume or high-risk devices for redesign and develop safeguards to protect trade secrets.

Design for 2026 and beyond

For products placed on the market after 12 September 2026, integrate direct user-access features and interoperability into product architecture from the outset. Schedule regular security testing and compliance monitoring to support continuous access. 

Frequently asked questions 

1. Who does the EU Data Act apply to?
   Any organisation that places connected products or related services on the EU market, even if based outside the EU. This includes manufacturers, service providers, platform operators, and other parties involved in handling device-generated data.
2. When did the EU Data Act take effect?
   The regulation entered into force on 11 January 2024. Its main requirements for connected products and related services took effect on 12 September 2025, with additional access-by-design obligations applying from 12 September 2026.
   
3. What types of data does the EU Data Act cover?
   All data generated during the use of a connected product, both personal and non-personal, including raw sensor outputs, pre-processed information, and metadata.
4. Do users have the right to erasureA qualified right under the GDPR allowing for data subjects to request that their personal data be erased (subject to exemptions). for non-personal data under the EU Data Act?
   The EU Data Act does not create a right to erasure for non-personal data. Users may request deletion only if contractually agreed or if required by other laws. Personal data rights remain governed by the GDPR.
5. Are there penalties for non-compliance with the EU Data Act?
   Yes. Each EU Member State sets its own penalties, which must be effective, proportionate, and dissuasive. Where personal data is involved, GDPR penalties can also apply.
6. Are there exemptions to the EU Data Act?
   Yes. Only ‘readily available’ raw or pre-processed data generated after the Act’s application date is covered. Prototypes, highly enriched or derived data, and creative content (such as photos or films) are out of scope. Trade secrets and safety and security concerns can also justify limiting access under the Act’s ‘handbrake’ safeguards.
7. How does the EU Data Act affect legacy products?
   Products already on the EU market by 12 September 2025 must allow user access to any data they continue to generate. Manufacturers must decide whether to provide direct or indirect access, but no full redesign is required unless necessary to enable reasonable access.
8. Does the EU Data Act apply to connected devices outside the EU?
   Yes, if the device was placed on the EU market. Data generated by that product must be made available to the user even when the device is operated abroad.

If your organisation would benefit from guidance on the EU Data Act, GDPR, or broader UK and EU privacy compliance, The DPO Centre’s team of highly experienced DPOs can help. Contact us for more details. 

In case you missed it…

• DUAA vs UK GDPR: What businesses need to know
• Building a privacy office: Key strategies for EU/UK compliance
• Compliance with the AI Act Part 3: Who must comply and what are the obligations?