Data Act

Regulation (EU) 2023/2854

Regulation on harmonised rules on fair access to and use of data

In force since September 12, 2025

Who it applies to

  • Manufacturers and suppliers of connected products and related services placed on the EU market
  • Data holders making data available to recipients in the EU
  • Providers of data processing services, including cloud

Consumer rights

  • Access / know — grantedObtain the personal data held about you, and the categories, sources and purposes behind it.
  • Correction — not granted
  • Deletion / erasure — not granted
  • Portability — grantedReceive your data in a portable, machine-readable form, or have it transmitted onward.
  • Opt out of sale / sharing — not granted
  • Opt out of targeted advertising — not granted
  • Opt out of profiling — not granted
  • Limit sensitive data use — not granted
  • Human review of automated decisions — not granted
  • Non-discrimination — not granted
  • Appeal a refusal — not granted
  • Private right of action — not granted

Obligations

Consent model
Mixed
Universal opt-out signal
Not required
Risk assessments
Not required
Data protection officer
Not required
Records of processing
Not required
Processor contract
Required
Right to cure
None — enforcement may follow immediately
Data broker registration
Not required

Breach notification

To individuals
Governed by the GDPR where personal data is involved
To the regulator
Not required by this law
What triggers it
See the GDPR

Penalties

Headline
Set by member states; GDPR-level ceilings apply where personal data is involved
Private right of action
No — enforcement is by the regulator only
Notes
Extends a portability-like right to data generated by connected products — a right to the data your car or thermostat produces, which the GDPR's personal-data framing does not fully reach.

Exemptions

Entities

  • Micro and small enterprises, for most data-sharing duties

Data

  • Trade secrets, subject to safeguards rather than a blanket carve-out

Sources