Rules on fair access to and use of data (Data Act)

 

SUMMARY OF:

Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)

WHAT IS THE AIM OF THE REGULATION?

The regulation, also known as the Data Act, addresses a number of challenges and opportunities presented by data* in the European Union (EU), emphasising fair access and user rights, while ensuring that personal data is protected. Its aims include:

• guaranteeing a fair distribution of the benefits derived from data amongst stakeholders;
• stimulating a competitive data market;
• opening up opportunities for data-driven innovation; and
• making data, in particular data generated by connected products, more accessible.

KEY POINTS

The regulation ensures fairness in the allocation of the value of data amongst the stakeholders in the data economy. It clarifies who can use what data and under which conditions.

To this end, it includes measures to allow users of connected products, ranging from smartphones and smart household appliances to intelligent industrial machines, to get access to data generated by their use. In addition, it comprises measures to increase legal certainty in relation to data access and use, in particular in the context of connected products, such as:

• clear rules on the permissible use of data and the conditions that apply;
• continued incentives for data holders to invest in high-quality data generation;
• rules facilitating the seamless transfer of valuable data between data holders and data users while preserving confidentiality;
• incentives encouraging more individuals and entities, whatever their size, to participate in the data economy;
• rules on users’ rights to share data with third parties;
• rules on protecting trade secrets and intellectual property rights, with safeguards against abusive behaviour; and
• a system of reasonable compensation for making data available and a dispute settlement mechanism.

Other measures include the following.

• Mitigating the abuse of unfair contracts that impede equitable data sharing. This entails:
  • safeguarding enterprises from unjust contractual terms imposed by parties in stronger market positions; and
  • developing model contract wording to help market participants draft and negotiate fair data-sharing contracts.
• Enabling public sector bodies to access and use certain data held by the private sector, for example to help in their response to public emergencies.
• Facilitating switching between data-processing service providers to unlock the cloud market in the EU, and the gradual withdrawal of switching charges, contributing to more efficient data interoperability*.
• Exempting data acquired through connected products from the provisions of Directive 96/9/EC, the database directive.
• Safeguarding against unlawful third-party government access to non-personal data.
• Enhancing data interoperability, data-sharing mechanisms and services, and common European data spaces.

This regulation does not affect EU or national legal acts providing for the sharing of, access to and the use of data for the purpose of the prevention, investigation, detection or prosecution of criminal offences or for the execution of criminal penalties, or for customs and taxation purposes.

FROM WHEN DOES THE REGULATION APPLY?

The regulation entered into force on 11 January 2024 and applies from 12 September 2025.

BACKGROUND

For further information, see:

• Shaping Europe’s digital future (European Commission)
• Data Act (European Commission)
• European Data Governance Act (European Commission).

KEY TERMS

MAIN DOCUMENT

Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (OJ L, 2023/2854, 22.12.2023).

RELATED DOCUMENTS

Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings (OJ L 191, 28.7.2023, pp. 118–180).

Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 laying down harmonised rules on the designation of designated establishments and the appointment of legal representatives for the purpose of gathering electronic evidence in criminal proceedings (OJ L 191, 28.7.2023, pp. 181–190).

Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, pp. 1–102).

Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 April 2021 on addressing the dissemination of terrorist content online (OJ L 172, 17.5.2021, pp. 79–109).

Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC (OJ L 409, 4.12.2020, pp. 1–27).

Successive amendments to Directive (EU) 2020/1828 have been incorporated into the original text. This consolidated version is of documentary value only.

Directive (EU) 2019/770 of the European Parliament and of the Council of 20 May 2019 on certain aspects concerning contracts for the supply of digital content and digital services (OJ L 136, 22.5.2019, pp. 1–27).

Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union (OJ L 303, 28.11.2018, pp. 59–68).

Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 (OJ L 345, 27.12.2017, pp. 1–26).

See consolidated version.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1–88).

See consolidated version.

Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006 (OJ L 141, 5.6.2015, pp. 1–18).

See consolidated version.

Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, pp. 73–117).

See consolidated version.

Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, pp. 30–47).

See consolidated version.

Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases (OJ L 077, 27.3.1996, p. 20).

See consolidated version.

last update 09.09.2024