EU Data Act: what legal teams must implement on contracts and data access

Short answer: The EU Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. For Data Act compliance, legal teams mainly need to adapt three things: user contracts and information for connected products (Art. 3 to 5), business-to-business data contracts for unfair terms (Art. 13) and cloud contracts for switching rights (Art. 23 to 29). From 12 January 2027, switching charges are prohibited.

This article is for general counsel, heads of legal and compliance leads in Switzerland and Germany. It explains who is affected, which deadlines apply and what contract work is due now.

What is the Data Act about?

The Data Act governs who may use the data generated by connected products and related services, and how customers can switch between cloud providers. Under Art. 1(1), it covers six areas:

• data access for users of connected products and related services,
• making data available from data holders to data recipients,
• making data available to public bodies in cases of exceptional need,
• switching between data processing services (cloud and edge services),
• safeguards against unlawful third-country access to non-personal data,
• interoperability standards for data to be accessed, transferred and used.

For legal teams, the Data Act is above all a contracts topic: it sets information duties, limits contract terms and gives customers mandatory switching rights.

Who is affected?

Manufacturers of connected products and providers of related services placed on the EU market are covered regardless of where they are established (Art. 1(3)). Users, data holders, data recipients in the EU and providers of data processing services to EU customers are covered too. Swiss companies are therefore in scope when they offer connected products or cloud services in the EU.

Under certain conditions, the data access obligations do not apply to data from products made by micro and small enterprises (Art. 7(1)). Where personal data is involved, the GDPR also applies, and for Swiss companies the Swiss Federal Act on Data Protection (FADP).

Deadlines and status of the Data Act

Most obligations already apply; two deadlines are still to come in 2027.

Member States designate competent authorities, with which natural and legal persons can lodge complaints (Art. 37 and 38), and lay down effective, proportionate and dissuasive penalties (Art. 40(1)).

What companies need to do now

Legal teams should review their contract portfolios and update their templates now, ideally in six steps:

1. Establish scope: which products are connected, which services count as related services or data processing services, and in which role does the company act?
2. Implement information duties: before sale, rental or lease contracts for connected products, users must be told, among other things, the type, format and volume of data and how to access it (Art. 3(2)); before contracts for related services, also the purposes of data use, the data holder, contract duration and the right to complain (Art. 3(3)).
3. Set up an access process: users receive readily available data without undue delay, free of charge and in a machine-readable format on a simple electronic request (Art. 4(1)); at their request, third parties do too (Art. 5(1)).
4. Protect trade secrets: agree confidentiality measures in advance and label protected data (Art. 4(6)). Give written reasons for any refusal and notify the competent authority (Art. 4(7) and (8)).
5. Review data contracts: check terms on data access and use in supplier and customer contracts for unfairness under Art. 13, starting with new contracts and, by September 2027, legacy contracts.
6. Update cloud contracts: notice period for initiating a switch of no more than two months (Art. 25(2)(d)), a mandatory transition period of no more than 30 calendar days (Art. 25(2)(a)), and phase out switching charges by 12 January 2027 (Art. 29).

To help, the Commission was to recommend non-binding model contractual terms on data access and use, and standard contractual clauses for cloud contracts, by 12 September 2025 (Art. 41).

Which roles and capacity are needed

Data Act compliance mainly calls for contract capacity in IT and data law, supported by project management and coordination with product and IT teams.

For how an interim team systematically updates a contract portfolio, see the assignment scenario Contract remediation with a team of project lawyers. The interplay with data protection rules is covered in GDPR vs Swiss FADP.

How interim support helps

Interim IT and contracts lawyers add capacity for the contract portfolio without the core team neglecting day-to-day work. Alpinum Solutions provides lawyers for this through staff leasing and freelancing, as individuals or project teams, part-time or full-time. Selected profiles are usually available within 48 hours; the start date of the assignment is agreed between the company and Alpinum.

Direction and responsibility for results stay with the company: under staff leasing, the company gives instructions on the work and the professional is integrated into its team. Alpinum is not a law firm and does not provide legal advice; the legal department remains responsible for the legal assessment of each case.

Frequently asked questions on Data Act compliance

Does the Data Act apply to companies in Switzerland?

Yes, if they are active on the EU market. The Data Act applies to manufacturers of connected products and providers of related services placed on the EU market, regardless of where they are established, and to providers of data processing services with customers in the EU (Art. 1(3)). A Swiss manufacturer with EU customers must therefore comply.

Which contracts need to change because of Art. 13?

Business-to-business contracts with terms on data access and use that one party has unilaterally imposed on the other. If such terms are unfair, they do not bind the other party. This applies immediately to contracts concluded from 12 September 2025, and from 12 September 2027 to older open-ended or long-running contracts.

What changes for cloud contracts?

Providers must enable customers to switch to another provider and remove obstacles to switching (Art. 23). The notice period for initiating a switch may not exceed two months, and the transition period may not exceed 30 calendar days (Art. 25(2)). From 12 January 2027, no switching charges may be imposed (Art. 29(1)).

Do companies have to disclose trade secrets?

Only with safeguards. Trade secrets are disclosed only once the data holder and the user have agreed confidentiality measures in advance (Art. 4(6)). If no agreement is reached, the data holder may refuse or suspend sharing, with written reasons and notice to the authority. In exceptional cases, refusal is possible where serious economic damage is highly likely (Art. 4(8)).

How much capacity does a Data Act project need?

That depends on the number of products, services and contracts. For a large contract portfolio, an interim team of IT and contracts lawyers with an experienced project lead pays off. For smaller companies, one part-time professional who updates templates and reviews new contracts can be enough.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region and provides IT and contracts lawyers for Data Act projects. Discuss your requirements with us and we will show you suitable profiles.

• Data privacy and IT law: project lawyers and IT contract lawyers
• Contract remediation with a team of project lawyers
• Regulatory calendar for legal & compliance
• Regulatory radar: all articles on regulatory change
• Discuss your requirements

Last updated: 10 November 2026.