Right of the user of a connected product under the Data Act to the data generated through its use, and to have it passed on to third parties of their choice.
The data access right comes from the Data Act (Regulation (EU) 2023/2854), which has applied since September 12, 2025. Users of a connected product are entitled to the data generated by its use, and they can require the data holder to pass it on to third parties of their choice. A user is someone who owns a connected product or has contractual rights to use it temporarily. That includes the operator of an asset. The data holder is usually the manufacturer or the provider of the related service. The requirement that products be designed so the data is directly accessible applies to products placed on the market after September 12, 2026 (Article 3(1)).
If the user cannot access the data directly from the product, the data holder must make it available on a simple request: without undue delay, free of charge, and in a commonly used, machine-readable format (Article 4(1)). At the user's request, the data holder passes it on to a third party (Article 5(1)), for example an independent service provider who evaluates malfunctions with it. A contract can restrict this only if the processing could undermine the product's security requirements and seriously affect the health or safety of people (Article 4(2)). The manufacturer's trade secrets remain protected. Where the data contains personal data, the General Data Protection Regulation also applies.
In contracts, this is a negotiating argument. Contract terms on data access and use that one enterprise unilaterally imposes on another are not binding on the latter if they are unfair (Article 13(1)). Anyone who wants to switch service providers can use the access right to keep malfunction data from staying with the manufacturer. The service company needs a clear assignment for that: tell it which data you need for servicing, troubleshooting and inspection records before you ask for the data to be passed on.
What matters
- For each connected product, check what data is generated and who the data holder is.
- Send data requests to the manufacturer in writing and note the date and deadline.
- Check purchase and service contracts for terms that limit or charge for access to or sharing of data.
- Clarify with the service company which data it needs before you ask for the data to be passed on.
Suppose an operator wants to hand servicing of his asset to an independent service company. So far the manufacturer has delivered fault messages only through its own portal. The operator asks in writing for the available product data including metadata and asks for it to be passed on to the new service company. He also checks whether the purchase contract has a term that rules this out.
In the original wording
“Upon request by a user, or by a party acting on behalf of a user, the data holder shall make available readily available data, as well as the relevant metadata necessary to interpret and use those data, to a third party without undue delay […].”
“A contractual term concerning access to and the use of data or liability and remedies for the breach or the termination of data related obligations, which has been unilaterally imposed by an enterprise on another enterprise, shall not be binding on the latter enterprise if it is unfair.”