\nData in scope:<\/strong> Obligations cover \u201craw but usable\u201d data generated by connected products, not highly enriched or purely descriptive information. Historical data from second-hand products may also be accessible under certain limits.<\/p>\n<\/li>\n\nConnected products:<\/strong> The definition is broad, ranging from consumer items like smart fridges and smartphones to industrial machinery and medical devices. Products whose primary purpose is storing, processing or transmitting data on behalf of others are excluded, unless they are owned, rented or leased by the user.<\/p>\n<\/li>\n\nRelated services:<\/strong> Apps and digital services qualify as \u201crelated\u201d only if they exchange data both ways with the product and affect its functions or behaviour.<\/p>\n<\/li>\n\nUser, data holder, third party:<\/strong><\/p>\n\u2013 A user<\/strong> is anyone with a legal right over a product (owners, renters, leaseholders).
\u2013 A data holder<\/strong> is any entity controlling access to data, which could include manufacturers, software providers or sensor suppliers.
\u2013 A third party<\/strong> is someone receiving data at a user\u2019s request, but only if they are established in the EU.<\/p>\n<\/li>\n<\/ul>\nThe FAQs note that companies cannot usually be both data holder and user for the same data, although the Act itself appears to allow for this in certain cases, so who knows.<\/p>\n
Restrictions on data use<\/strong><\/p>\nThe Act significantly reshapes how data can be used:<\/p>\n
\n- \n
Non-personal data:<\/strong> Data holders may only use readily available non-personal data if the user has agreed to this in a contract.<\/p>\n<\/li>\n- \n
Third-party access:<\/strong> Only aggregated non-personal data can be passed to a third party, unless provided directly by the user.<\/p>\n<\/li>\n- \n
Non-compete clause:<\/strong> Data may not be used to develop rival connected products, but competing related services are permitted to encourage innovation.<\/p>\n<\/li>\n<\/ul>\nRelationship with GDPR<\/strong><\/p>\nThe Data Act does not override the General Data Protection Regulation (GDPR). Personal data sharing will still need to comply with GDPR, which the Commission acknowledges may prove challenging in practice.<\/p>\n
The Act does, however, broaden data portability rights. Unlike GDPR, which covers only personal data and applies to individuals, the Data Act extends portability to personal and non-personal data, benefiting both individuals and businesses.<\/p>\n
Any user receiving personal data under the Data Act becomes a controller of that data, and data protection authorities will oversee enforcement.<\/p>\n
IoT data sharing in practice<\/strong><\/p>\nManufacturers must enable either direct access (for example, via a product interface or app) or indirect access (via request to a data holder). Hybrid models are permitted, depending on technical feasibility and cost.<\/p>\n
Products already on the market before 12 September 2025 will not need to be redesigned to provide direct access.<\/p>\n
Recommended reading<\/strong><\/p>\nRegardless of the model chosen, data holders must share data with a third party if a user requests it.<\/p>\n
Transfers of non-personal data<\/strong><\/p>\nThe Act also introduces new rules on non-personal data transfers:<\/p>\n
\n- \n
Restrictions:<\/strong> Providers of data processing services, such as cloud providers, face limits designed to protect data in the EEA from access under foreign legal frameworks.<\/p>\n<\/li>\n- \n
Scope:<\/strong> These restrictions do not apply to internal business transfers or to users choosing providers outside the EEA.<\/p>\n<\/li>\n- \n
Cloud obligations:<\/strong> The compliance burden will fall on service providers themselves, rather than their customers.<\/p>\n<\/li>\n<\/ul>\nThe Data Act represents a major shift in how data generated by connected devices can be accessed and used across the EU.<\/p>\n
For consumers, it promises cheaper repairs and more choice of services. For businesses, it sets out new rights, obligations and market opportunities \u2013 but also raises questions around implementation, especially where personal and non-personal data overlap.<\/p>\n
\n\tRelated<\/p>\n","protected":false},"excerpt":{"rendered":"The EU\u2019s Data Act is now being applied. The legislation is one of the cornerstones of the EU\u2019s…\n","protected":false},"author":2,"featured_media":418333,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5174],"tags":[143310,143311,2000,143312,299,5187,18325,16103],"class_list":{"0":"post-418332","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-eu","8":"tag-data-economy","9":"tag-digital-regulation","10":"tag-eu","11":"tag-eu-data-act","12":"tag-europe","13":"tag-european","14":"tag-gdpr","15":"tag-iot"},"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@uk\/115191121563533004","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts\/418332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/comments?post=418332"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts\/418332\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/media\/418333"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/media?parent=418332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/categories?post=418332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/tags?post=418332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Scot-Secure](\"https:\/\/www.europesays.com\/uk\/wp-content\/uploads\/2025\/09\/1757676914_792_Copy-of-DIGIT.FYI-In-Article-Ads-750-x-210-px-6.jpg\")
<\/a><\/p>\n