Data Act:
operators decide which service provider gets the data

Take a food logistics company that operates a refrigeration system whose controller sends pressures, temperatures and fault messages to the manufacturer's service portal. The maintenance contract with the manufacturer is expiring, and a regional refrigeration specialist offers cheaper maintenance. In a breakdown, though, its technician would have to manage without the operating history, because that sits in the portal. Since 12 September 2025, under the EU Data Act, the operator can demand that the data from its system reach the new service partner.

Regulation (EU) 2023/2854 does not recognize ownership of data. It allocates access rights, and these lie with the user of the connected product. The user is whoever owns the machine or has rented or leased it, as the European Commission explains in its FAQ. For service, this matters because runtimes, error codes and wear values often land with the manufacturer first today.

The right also applies to equipment that has long been running

Article 4 obliges the data holder, usually the manufacturer, to release readily available data together with metadata. This must happen without undue delay and in machine-readable form and must cost the user nothing. Raw and pre-processed data such as measured values, states and events are covered. According to the Commission, the right also applies to machines sold before the cutoff date, but only to data generated since 12 September 2025.

Since 12 September 2026, Article 3(1) additionally requires access by design. Connected products placed on the market since then must be designed so that users can retrieve their data easily and securely by default, and directly where relevant and technically feasible. Manufacturers do not have to retrofit older models, as the law firm Heuking points out. If the machine comes from a micro or small enterprise that is not linked to larger enterprises, these obligations do not apply (Art. 7).

The independent service provider receives the data as a third party

Article 5 applies to the example. At the user's request, the data holder must make the data available to a third party, again at no cost to the user. According to the Commission's FAQ, maintenance and repair count as aftermarket services and are not a related service of the manufacturer. So the independent maintenance business is exactly the third party the rule means. It may still have to pay, because the data holder may demand reasonable compensation from it. For small and medium-sized enterprises, that compensation may not include a profit margin.

The third party may use the data only for the purpose agreed with the operator and not to develop a competing product (Art. 6). The same ban applies to the operator. It covers only the connected product, though. Anyone who offers predictive maintenance with the data competes with the manufacturer in a permitted way, the Commission writes.

Trade secrets delay access but rarely prevent it

Manufacturers can object that operating data reveal design or process know-how. A mere claim is not enough, however, according to the FAQ. The data holder must identify the data concerned and agree protective measures with the user, such as a confidentiality agreement (Art. 4(6) to (8)). If no agreement is reached or the user does not comply, the data holder may withhold the data. It may refuse entirely only in exceptional cases, if serious economic damage is highly likely and it can show this with objective evidence. It must report both steps to the competent authority, in Germany the Federal Network Agency (Bundesnetzagentur).

Refusing data risks a fine of up to €500,000

The German Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz, DADG for short (Data Regulation Application and Enforcement Act), has applied since 30 May 2026, about nine months later than the EU provided for, as Haufe reports. The Bundesnetzagentur is responsible. A data holder that refuses to provide data under Article 4 or 5, or places new products on the market without access by design, risks up to €500,000 under § 15 DADG. Operators can complain via a portal of the authority. The Bundesnetzagentur approves out-of-court dispute settlement bodies on application, but as of mid-November none was listed on its website.

Unfair data clauses are not binding, in existing contracts from September 2027

Between businesses, Article 13 is the most important lever. Clauses on data access and data use that one side imposes unilaterally on the other are invalid if they are unfair. This also applies to data clauses in a purchase or maintenance contract (FAQ). A clause is presumed unfair if, for example, it prevents the contracting party from using the data it generated itself during the term or from getting a copy of it at the end of the contract. This already applies to contracts concluded after 12 September 2025. Older contracts are covered by the rule from 12 September 2027 if they are open-ended or end at the earliest ten years after 11 January 2024 (Art. 50).

Conversely, since September 2025 the manufacturer needs a contract with the user if it wants to use non-personal machine data itself (Art. 4(13)). According to the Commission, this also applies to machines that were sold earlier. In this contract, the operator, as a business, can even waive its own usage rights if it is adequately compensated. Anyone who signs something like this should know what they are giving up.

Model clauses from the Commission have been available since 6 November

How such agreements can look is shown by the Commission's Recommendation (EU) 2026/2394 of 29 October 2026, published in the Official Journal on 6 November. It contains non-binding model clauses, including between data holder and user and between user and third party. The model contract with the user provides for an annex that describes the data by type, volume, collection frequency, storage location and retention period. The data holder may use the data only for agreed purposes, such as warranty or monitoring of function and safety. Operators can use the clauses as a template or measure manufacturer contracts against them.

The Digital Omnibus could give manufacturers another ground for refusal

On 19 November 2025, the Commission presented the so-called Digital Omnibus, which is meant to amend several digital laws (COM(2025) 837). For data access, one new ground for withholding trade secrets matters most: a high risk that they flow to entities in third countries with weaker protection. The Council set its negotiating mandate on 21 October 2026. It sticks to this and wants Commission guidelines in which, for example, industrial manufacturing know-how can count as particularly sensitive. In the European Parliament, the committee vote is still pending, according to the Legislative Observatory). Until an agreement is reached, the Data Act applies unchanged. It is unclear how far manufacturers can later invoke third-country risks.

What operators should settle now in purchase and service contracts

• Request a data list as an annex: which data the equipment generates, in what format, how often and by what route the operator retrieves it.
• Have the data holder named in writing. This can also be a remote monitoring provider or a supplier with its own data connection.
• Specify the transfer to a service partner of your choice, with format and deadline. Anyone who waives this should be paid for it.
• Limit the manufacturer's use of the data to named purposes and allow onward transfers to third parties only with consent.
• Define trade secrets and protective measures in advance so that release is not negotiated only when a fault occurs.
• Agree on a copy of the operating data at contract end, and review long-running maintenance or remote monitoring contracts for data clauses by September 2027.

A gap remains even with a good contract. For maintenance, the diagnosis the manufacturer calculates from the data often matters more than the measured value. The manufacturer does not have to release such derived data; according to the Commission, the obligation is limited to raw and pre-processed data. Where exactly the line runs, authorities and courts must first clarify. The operator gets the finished diagnosis only if the contract provides for it.