Data Act (EU) 2023/2854

Yes, if you are a user within the meaning of the Data Act. A user is a person that owns a connected product, has had temporary rights to use it transferred by contract, for instance through renting or leasing, or receives related services. A connected product is an item that obtains, generates or collects data about its use or environment and can transmit it, such as a refrigeration plant, a pump or a conveyor with a controller.

Regulation (EU) 2023/2854 has applied since 12 September 2025. Under Article 4(1), the data holder, in practice often the manufacturer, must make the readily available data accessible to the user, together with the metadata needed to interpret it. This has to happen without undue delay, free of charge and in a machine-readable format, on a simple request by electronic means. The entitlement exists only where the user cannot access the data directly from the product or related service.

“Readily available” means data that the data holder lawfully obtains or can obtain from the product or service without disproportionate effort going beyond a simple operation. In practice, ask your manufacturer in writing which data points the plant generates, where they are stored, in what format and by what route you can receive them. A later request can build on that answer.

Yes. Article 5(1) gives the user the right to require the data holder to make the data available to a third party. A party acting on the user's behalf can make the request as well. For the user, it is free of charge. A service company that is not the manufacturer is exactly the third party the rule has in mind, for instance a refrigeration firm taking over maintenance from the manufacturer that needs the operating history.

The data holder may ask the third party for compensation. Under Article 9 it must be non-discriminatory and reasonable and may include a margin. If the recipient is an SME with no partner or linked enterprises that are not SMEs, it may not exceed the costs of making the data available. For the operator, passing on the data stays free.

The third party is subject to limits. It may use the data only for the purpose agreed with the user, and not to develop a product that competes with the connected product. It may not use the product data to derive insights about the economic situation or production methods of the data holder. The ban concerns products competing with the connected product, and a maintenance service built on the data is not such a product according to the wording. A service contract should settle the purpose of the data use, the scope of the data and deletion after the contract ends.

Product data and related service data are covered, provided they are readily available. Recital 15 explains what that means: raw data and pre-processed data are included, for example sensor readings of temperature, pressure, flow or speed, as well as data indicating hardware status and malfunctions. Information the manufacturer computes from them with additional effort, especially with proprietary algorithms, is not covered, for example a diagnosis derived from several sensor values. If you want it, agree on it in the contract.

The manufacturer can object that the data contain trade secrets. That is not a free pass. Under Article 4(6), it must identify the data protected as trade secrets and agree with the user on appropriate protective measures, such as a confidentiality agreement. Only if there is no agreement, or the user does not implement the measures, may it withhold or suspend the sharing. It must give reasons, notify the user in writing and report to the competent authority.

Only in exceptional circumstances may it refuse a request in an individual case, where it can show with objective facts that it is highly likely to suffer serious economic damage despite all protective measures. Operators do well to offer confidentiality measures on their own initiative, so that this dispute does not arise in the first place.

Article 3(1) applies to connected products placed on the market after 12 September 2026. They must be designed so that the user can access its product data by default, easily, securely and free of charge in a machine-readable format and, where relevant and technically feasible, directly. Manufacturers do not have to retrofit older models, for which the entitlement to have data made available under Article 4 remains. Products of micro and small enterprises that are not linked to larger companies are also exempt (Article 7).

If you are buying a new plant, put in the contract by what route, in what format and with what metadata the data will be provided, and whether access continues after the warranty ends.

Conversely, the data holder needs a contract with the user if it wants to use non-personal product data itself, for product improvement or its own services, say. Under Article 4(13), it also may not use the data to derive insights about the economic situation or production methods of the user where that could undermine the user's position on its markets. If you grant such usage rights in a purchase or service contract, know what you are giving away and what you receive in return.

Article 13 applies between businesses. A contractual term on access to and use of data, or on liability and remedies for data-related obligations, that one enterprise has unilaterally imposed on another is not binding on the latter if it is unfair. A term is unfair if applying it grossly deviates from good commercial practice in data access and use or contravenes good faith. It counts as unilaterally imposed if the other party, despite trying to negotiate, could not influence its content. The party that introduced the term bears the burden of proving it was not unilaterally imposed.

Article 13(5) lists examples presumed to be unfair: terms that prevent a party from using the data it generated, that deny it a copy of the data when the contract ends, or that give the other side access to data in a way that significantly harms the first party's legitimate interests. An unfair term drops out, and the rest of the contract stays binding if the term is severable.

In time, Chapter IV applies to contracts concluded after 12 September 2025. For older contracts it applies from 12 September 2027 if they are of indefinite duration or run at least ten years beyond 11 January 2024. On 29 October 2026 the Commission recommended non-binding model terms, published in the Official Journal on 6 November. They are not mandatory, but they offer a template against which manufacturer clauses can be compared.

First, make the request in writing and show your role: you are the user, the manufacturer is the data holder, the data are readily available. If it refuses or does not respond, there are three routes. The first is a complaint: under Article 38, any natural or legal person can lodge a complaint with the competent authority if they consider their rights under the Regulation infringed. In Germany that is the Federal Network Agency (Bundesnetzagentur). The second is a dispute settlement body under Article 10, which users, data holders and data recipients can turn to. The Federal Network Agency certifies such bodies on application (section 5 DADG). The third is going to court, which Article 38 expressly leaves open.

The German implementing act provides for fines. Anyone who fails to provide data under Article 4(1) or Article 5(1), or fails to provide it in time, or places products on the market without data access under Article 3(1), risks up to 500,000 euros under section 15(4) DADG. A fine does not replace the entitlement, though. And the manufacturer can invoke trade secrets under the conditions of Article 4(7) and (8), but has to report that to the authority.

In practice, set deadlines and collect the correspondence. If the case reaches the authority, the request with its date and the answer are your evidence.