EU Data Act applies

As of today (September 12, 2025), Regulation (EU) 2023/2854 (Data Act) applies.

What does the Data Act govern?

The Data Act governs data rights. This includes, among other things, data generated by connected devices in the context of Industry 4.0 applications and the Internet of Things (IoT).

Connected devices placed on the EU market must be designed in such a way that they enable the sharing of data. In addition, consumers must have the option of choosing less expensive repair and maintenance service providers or performing these tasks themselves, i.e., they must not be forced to commission the manufacturer to carry out repairs and maintenance by being denied access to data required for repair and maintenance.

Commercial users of equipment must have access to the data generated by that equipment in order to improve its efficiency and operation.

In particular: Cloud Computing

The Data Act is of particular importance for all providers and users of cloud computing. Cloud users must be able to switch to another cloud provider and migrate their data from their previous cloud provider to another cloud provider.

In particular, cloud providers are prohibited from making the switch dependent on payments, thereby effectively preventing the switch. However, until January 12, 2027, providers of data processing services may still charge reduced switching fees, but not after that date.

Model contractual terms and standard contractual clauses missing

Article 41 of the Data Act states that the Commission shall “before September 12, 2025” develop and recommend non-binding model contractual terms for data access and data use, as well as non-binding standard contractual clauses for cloud computing contracts.

However, these are not yet available. In the Commission’s press release of September 12, 2025, it states under “Next Steps” that the Commission will publish model terms for data sharing and standard clauses for cloud contracts – but it is unclear when.

What is available so far is the final report of the Commission’s expert group dated April 2, 2025, which contains proposals for model contractual terms and standard contractual clauses. However, this is not available in German, and it is also unclear whether the clauses proposed therein will ultimately remain unchanged.

A novelty outside Germany: B2B general terms and conditions law

Finally, special attention should be paid to the fact that the Data Regulation introduces, for the first time at EU level, a law on general terms and conditions that also applies to relationships between businesses (B2B). According to Article 13 of the Data Act, contractual terms concerning access to and the use of data or liability and remedies for the breach or the termination of data-related obligations, which have been unilaterally imposed by an enterprise on another enterprise, shall not be binding on the latter enterprise if they are unfair.

Until now, EU-level law on standard terms and conditions has only applied to relationships between businesses and consumers (B2C), such as Directive 93/13/EEC on unfair terms in consumer contracts.

However, the law on standard terms and conditions applicable in Germany is also largely applied by the Federal Court of Justice (BGH) in relations between companies, which is met with great incomprehension internationally in most cases. In Germany, EU directives such as Directive (EU) 2019/770 on certain aspects concerning contracts for the supply of digital content and digital services, have been implemented in Germany in an “excessive” manner in that the regress provisions in the supply chain upstream of consumer transactions in Section 327u of the German Civil Code (BGB) have been made mandatory between companies, whereas according to the directive, only the provisions relating to consumers need to be mandatory.