What is the Data Act and what changes for your cloud?

The Data Act (Regulation (EU) 2023/2854) is the European law on data access and use, applicable since 12 September 2025. It is a regulation, not a directive: it applies directly, today, even without an Italian implementing decree, because the national decree only designates supervisory authorities and penalties, it does not create the rights the text already grants. For anyone running an IT stack the concrete fronts are two: the right to switch cloud providers without obstacles and access to the data generated by connected products, from industrial sensors to smart appliances and connected machinery on a factory floor. It should not be confused with the 2022 Data Governance Act, which instead regulates data intermediaries, data altruism and the reuse of public-sector data: for most cloud-using companies, the text that actually changes contracts and vendor negotiations is the Data Act, not the DGA.

The switching timeline as an action plan

The dates are an operational calendar, and Article 29 sets only two. Since 11 January 2024 only reduced switching charges are allowed, capped at the costs the provider directly incurs for that switch: an entitlement you can already enforce, not a future deadline. From 12 January 2027 switching charges are banned outright. In parallel, providers must remove pre-contractual, contractual and technical obstacles to switching: reasonable notice periods, migration assistance, exportable formats. What to do now: an audit of your cloud contracts (termination clauses, switching-assistance obligations), an inventory of proprietary formats and managed services with no equivalent elsewhere (real lock-in is rarely the egress fee), and an estimate of the volumes you would migrate. The right the Data Act introduces is a specific case of the broader data portability theme, applied to cloud. The regulation gives you negotiating leverage at renewal, but only if you arrive at the table knowing what to ask for.

IoT data and, in three lines, the DGA

The second front is connected products: their users, companies included, have the right to access the data they generate and to share it with third parties. If you manufacture connected machines or devices, data access has to be designed into the product, and the Art. 3(1) duty covers connected products placed on the market after 12 September 2026, meaning the lines being designed today; if you use them, that data becomes a source you can demand from your supplier, for predictive maintenance or fleet analytics for example. And the DGA? The Data Governance Act is the 2022 sibling: it regulates data intermediaries, data altruism and the reuse of public-sector data. Unless you are a data intermediary, the text that changes your contracts is the Data Act.

This entry is informational and does not constitute legal advice: for decisions on regulated data, involve your DPO or legal counsel.