Data Act Check

Check the Data Act: data access, cloud switching, data contracts

This interactive checker helps companies, manufacturers of connected products, providers of related services, SaaS and cloud providers, data holders, data users and B2B contract partners to pre-check typical obligations and risk signals under the EU Data Act in a structured way. Data access, cloud switching and data contracts can be assessed in advance.

Start the check

Connected products Related services Cloud/SaaS B2B data clauses GDPR interface

What the Data Act Check is for

Key parts of the Data Act have applied since 12.09.2025. Since 12.09.2026, new connected products and related services are in particular subject to the obligation of data accessibility by design (Art. 3(1) Data Act). This check does not replace legal advice, but it shows whether the data inventory, role mapping, technical access, cloud exit, data contract clauses, trade secrets, security or data protection should be reviewed as a priority.

Data Act Access Board

Data access as a reviewable control path

The visualisation shows the Data Act review path as an access board: data is generated, controlled, requested, checked by protection gates and only then made available technically, contractually or in a cloud exit.

Active data path

Data Act Readiness Map

Data is generated

A connected product, machine, vehicle, sensor, app or related service generates usage data.

Data is controlled

The data holder, provider or service provider determines access, storage location, interfaces and technical availability.

Access is requested

A user, customer or authorised third party wants to view, export, forward or use data.

Provision is managed

API, export, dashboard, cloud exit, contract and logging determine how data is made available in practice.

Protection gate

GDPR, trade secrets, cybersecurity, product integrity and risks of misuse are checked before release.

Contract gate

B2B data clauses, purpose of use, compensation, liability, purpose limitation, exit rules and unfair terms are reviewed.

Cloud exit gate

Portability, export formats, switching support, transition, deletion and interoperability are put into practice.

Overview: first map the data source, data holder, users, third parties, cloud role, contractual position and protection limits.

Orientation

Review path for Data Act readiness

1Determine the role

Manufacturer, provider of related services, data holder, user, third party, cloud provider or B2B contract partner.

2Inventory the data

Record product data, service data, raw data, derived data, personal data, operating data and storage locations.

3Check access

Structure user access, sharing with third parties, formats, API, dashboard, authentication, deadlines and documentation.

4Set protection limits

Take GDPR, trade secrets, cybersecurity, product integrity, purpose limitation and risks of misuse into account.

5Adapt contracts

Review data clauses, cloud exit, interoperability, fees, rights of use, liability and escalation processes.

Assessment

What this check delivers

The check provides structured initial orientation on typical Data Act topics. It is particularly helpful where data access, connected products, related services, cloud switching, B2B data clauses or mixed datasets containing personal data are involved.

When is the Data Act relevant?

The Data Act can be relevant if connected products or related services generate data, users request access, third parties are to receive data on behalf of a user, cloud or SaaS switching must be supported or B2B data contracts contain unilaterally imposed data clauses.

How does the Data Act relate to the GDPR, trade secrets and IT security?

The Data Act does not displace data protection law. For personal or mixed data, legal bases, roles, information obligations, data subject rights and DPA questions must also be reviewed. Trade secrets and security interests may require protective measures, but generally do not justify a blanket refusal.

What are the limits of the check?

The check does not replace a review of the individual case. National enforcement, competences, sanctions, technical standards and authority practice may change. For specific data requests, disputes, cloud exit deadlines or product launches, the legal and technical situation should be reviewed separately.

Interactive check

Create a Data Act risk profile

Answer the following questions. At the end you receive a preliminary assessment with priority, reasons, next review points and a list of documents for an inquiry.

Step 1 of 5

1. Which role best describes your company? Manufacturer or provider of connected productsIoT devices, machines, vehicles, sensors, smart devices, industrial plants or other connected products. Provider of related servicesApp, portal, dashboard, maintenance, analytics, monitoring or control service for a connected product. Data holderYou control or hold data generated by the use of products, services, platforms or systems. User or customer seeking data accessYou want to obtain data from products, machines, plants, vehicles or digital services. Third-party data recipientYou are to receive data at a user's request, for example for maintenance, repair, analytics, insurance or optimisation. Cloud, SaaS or data processing serviceYou offer cloud, SaaS, PaaS, IaaS, hosting, platform operation, data processing or exit and migration processes. Public body or B2G data requestIt concerns data access by public bodies, exceptional need, a crisis or an official request. B2B data contract or data licenceThe focus is on data provision, data licences, data pooling, data cooperation, API access or data clauses.

2. Which data or systems are involved? Product usage data from connected productsData is generated by using a product, device, vehicle, sensor, machine or plant. Data from a related serviceData is generated in an app, dashboard, portal, control, monitoring, maintenance or analytics service. Industrial, machine or operating dataProduction data, performance data, maintenance data, sensor data, plant or process data. Vehicle, mobility or telematics dataFleet, charging, location, condition, usage or diagnostic data. Cloud, SaaS or data processing serviceData portability, switching to another provider, interoperability, exit, migration, deletion or lock-in. B2B dataset or data cooperationData provision between companies, API access, data licence, data room or shared use of data. Mixed personal and non-personal dataTechnical, operational or aggregated data also contains personal data or allows conclusions about individuals. Unclear / no data inventoryIt has not yet been reliably clarified which data is generated, who controls it and who can request access.

4. What has already been implemented?

Please select everything that is reliably implemented or documented.

Data inventory and data flows documentedData types, storage locations, access points, recipients, formats and data categories are recorded. Roles under the Data Act and GDPR assignedData holders, users, third parties, service providers, controllers, processors and recipients are mapped. Technical access, API or export process in placeUser access, export function, API, dashboard, authentication and logging are prepared. Contract clauses and data access terms preparedData licence, purpose of use, compensation, liability, confidentiality, security and onward sharing are regulated. Trade secret and security conceptProtective measures, access restrictions, non-disclosure agreements and a misuse log are defined. GDPR review carried outPersonal data, legal bases, information obligations, DPA, third-country transfers and data subject rights have been reviewed. Cloud/SaaS exit and switching process in placeExport formats, switching support, transition, deadlines, deletion and interoperability are regulated. Internal process for Data Act requestsResponsibility, deadlines, review, documentation, approval and communication are regulated. No structured Data Act readiness yetIndividual aspects exist, but no robust overall concept.

5. Is there specific urgency?

Please select everything that applies.

A product launch, relaunch or new data feature is coming upA connected product, app, dashboard, API, data service or cloud offering is about to go live. A user or customer is requesting data accessA customer, buyer, lessee, operator or business partner demands data access or an export. A third party is requesting data at a user's requestA repair service, maintenance provider, analytics provider, insurer or software partner demands data. An authority or public body is requesting dataThere is a B2G data request, a crisis, an emergency or a public interest. A cloud switch, termination or migration deadline is runningExit, data export, interoperability, deletion or switching support is disputed or time-critical. Contract negotiation or customer demanding Data Act clausesA Data Act annex, data access agreement, terms and conditions, SaaS contract or B2B data licence is being negotiated. Dispute, refusal, warning letter or escalationData access, compensation, trade secrets, cloud exit or rights of use are already disputed. Preventive reviewNo acute request, but applicability and implementation should be clarified.

Deadlines and measures

Typical Data Act review areas

Review area	Typical risk	Orientation	Practical measure
General Data Act scope	Role and data scope are not recognised.	Key parts have applied since 12.09.2025.	Set up a data inventory, role mapping and request process.
Data access by design	The product or service is not technically prepared for data access.	Particularly relevant for new connected products and related services since 12.09.2026.	Plan API, export, dashboard, authentication, logging and formats.
Cloud switching and exit	Lock-in, unclear migration, deletion or switching support.	Review cloud and data processing services separately.	Document the exit plan, export formats, transition process, deletion and contract clauses.
B2B data clauses	Unilateral or unclear clauses on access, use, liability or fees.	Unfair contract terms can be relevant under the Data Act.	Review the data licence, purpose limitation, limits of use, compensation and liability.
GDPR and mixed data	Data access is reviewed without a data protection role, legal basis or DPA.	The Data Act and the GDPR must be reviewed side by side.	Clarify personal data, legal bases, data subject rights, DPA and third-country transfers.
Trade secrets and security	Know-how or security interests are not protected or are used as a blanket excuse.	Protective measures must be specific and robust.	Define a trade secret concept, NDA, access restrictions, a misuse log and a security gate.

Sensible next steps

Related ITMR checkers and follow-up reviews

GDPR Roles SimulatorHelps you classify controllers, processors, joint controllers and recipients for mixed datasets. DPA CheckChecks whether data processing by service providers, cloud providers or platform partners is properly covered by contract. SaaS Contract CheckFits cloud switching, exit rules, data portability, SLAs, liability and data-related contract clauses. CRA CheckUseful for connected products, software and digital elements where Data Act access and product cybersecurity meet. NIS2 CheckComplements the review where data access, cloud services, supply chains or incident processes are also relevant to cybersecurity. Trade Secret CheckHelps you structure know-how, operating data, security information and protective measures before data is released.

Have your Data Act question reviewed in a structured way

If there is a data request, a product launch, a cloud migration, a B2B data contract or an unclear role, ITMR can support the legal assessment, contract drafting and documentation.

Contact ITMR

Note: This checker offers initial orientation and does not replace legal advice in the individual case. Under the Data Act in particular, obligations depend on role, product, data categories, contractual position, technical architecture, personal data, trade secrets and national enforcement practice. How we then implement the obligations is shown on our page Implementing the Data Act; you can find more background in the section Data law.