The law
What the Data Act changes, exactly
This page sets out the mechanism of Regulation (EU) 2023/2854 (the “Data Act”) as it applies to connected products. It is written to be useful even without us: a reader can use it to exercise their rights themselves. It does not constitute legal advice.
The three roles
| Role | Who | What the Regulation grants or imposes on them |
|---|---|---|
| User | Whoever owns or leases the product — an establishment, a company, an individual | Access the data generated by the use of their product; require its transmission to a third party of their choosing (arts. 4 and 5) |
| Data holder | Most often the manufacturer, which operates the product's cloud | Give access to the data without undue delay, of the same quality as available to it, continuously and in real time where technically feasible (arts. 4 and 5) |
| Recipient third party | The provider mandated by the user — our role | Receive the data under mandate, process it solely for the purposes agreed with the user (art. 6) |
What can be required
- The data generated by the use of the product, including the metadata needed to interpret it (arts. 2 and 4).
- Leur mise à disposition sans retard injustifié, free of charge for the user (art. 4).
- Its direct transmission to a third party designated by the user, of equivalent quality (art. 5). The holder may ask that third party for reasonable and non-discriminatory compensation (art. 9).
- For connected products placed on the market after 12 September 2026, a design allowing direct access to the data, by default and easily (art. 3). This obligation does not apply to the installed fleet — for that, only the access rights of articles 4 and 5, in force since September 2025, apply.
What the text does not allow
- Cutting off the flow to the manufacturer. The Regulation creates a right of access, not a right of interruption. The holder continues to receive the data. What you obtain is a copy, not a replacement.
- Competing with the product using its own data. The data obtained may not be used to develop a product competing with the original connected product (arts. 4 and 6).
- Profiling the user. The recipient third party may not use the data received for profiling, unless strictly necessary for the service requested (art. 6).
- Guaranteeing a manufacturer's response. The right exists; exercising it may meet a refusal or a silence. A refusal can be documented and relied upon — that is precisely one of the purposes of our service.
The timetable
| Date | What applies |
|---|---|
| 12/09/2025 | The Regulation applies. The access and transmission rights (arts. 4 and 5) are in force. |
| 12/09/2026 | Design obligation for direct access to data (art. 3) — only for products placed on the market after that date. The installed fleet is not covered; its access rights already exist. What that date actually changes → |
| 01/2027 | Progressive removal of switching charges for data processing providers (art. 29). |
Frequently asked questions
Who is the “data holder”? Is it always the manufacturer?
No. The holder is whoever has the ability to make the data available — most often the manufacturer, because it operates the product's cloud, but it may be a related service provider, a platform operator or an integrator. A single product may have several holders. This is particularly common in building management, where the equipment, the supervision and the hosting are often handled by three different companies. Identifying the right counterpart is the first practical difficulty of a request.
Is my installed fleet covered?
For the access rights (articles 4 and 5): yes, whatever the date the products were placed on the market, since 12 September 2025. For l'design obligation (article 3), which applies from 12 September 2026: no, it covers only products placed on the market from that date. The detail of this distinction, which is the most widespread source of confusion.
How does this differ from the GDPR?
The GDPR protects personal data and gives rights to the data subject. The Data Act organises access to the données générées par l'usage d'un produit connecté, whether personal or not, for the benefit of the user — which may be a company or an establishment. The two texts overlap: where personal data is involved, the GDPR continues to apply in full, and the Data Act does not by itself create a legal basis for processing it.
Can the holder refuse?
It may invoke certain grounds, in particular the protection of trade secrets, under defined conditions, and it may ask for verification of the user's status. A refusal must give reasons. In practice, a reasoned refusal — like the absence of a reply within a reasonable time — is documented: it is the material for any later complaint.
Can the holder charge for making the data available?
Not to the user for access to their own data: that is free of charge. However, where the data is transmitted to a third party designated by the user, the holder may ask that third party for reasonable and non-discriminatory compensation (article 9). That is a business-to-business relationship, distinct from the right of access itself.
What if the holder does not reply?
Keep proof of the request and of its date, follow up, then record the silence at the deadline. The Regulation provides for complaint mechanisms before the competent authority and for dispute settlement. Designating the competent authorities is a matter for each Member State; for the personal-data aspect, the CNIL remains the counterpart in France. A dated, complete file is, in every case, the indispensable prerequisite.
Can I entrust the exercise of these rights to a provider?
Yes: article 5 expressly provides for transmission to a third party designated by the user. That third party may process the data only for the purposes agreed with the user, may not use it to develop a product competing with the original connected product, and must erase it once it is no longer necessary for the agreed purpose. That is our role.
References: Regulation (EU) 2023/2854 of 13 December 2023, in particular articles 2, 3, 4, 5, 6, 9 and 29. Full text on EUR-Lex. The analyses above should be checked against the text and, for any decision, against qualified legal counsel.