Lawyer for data law: Data Act, data contracts, data governance

Data law and the Data Act for manufacturers, platforms, SaaS and industrial companies

Quick start: what is your matter about?

Your contact: Dominik Skornia

Lawyer with practice areas in data protection law, data law and IT law. Together with Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law).

Send data law enquiry

What happens after your enquiry?

After your enquiry, we will get back to you within 24 hours on working days. The first contact is free of charge. We will expressly inform you before any costs arise.

1. A short description is enough. Briefly describe the product or service, the data types concerned and the contractual situation. A product description, standard contracts and a data flow diagram, if available, are helpful.
2. Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
3. Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.

Typical cases from our data law practice

We regularly encounter the following constellations. They are abstracted and simplified. Which obligations apply always depends on the product, contract and data model.

What you will have at the end

Where the Data Act has a practical impact in companies

This becomes practically relevant wherever connected products, related services, SaaS or platform models and data-based cooperations come together economically. Then it is not enough to consider data protection alone. In addition, it is about access rights, sharing obligations, trade secrets, technical exportability, contractual fairness and alignment with adjacent regulation.

As a law firm at the intersection of IT law, data protection law, compliance, AI law and cybersecurity, we support companies in setting up data models that are commercially usable and legally robust.

Key transition dates for practice

For whom the Data Act already requires action today

The review is particularly urgent for manufacturers of connected products, providers of related services, platform operators, SaaS and cloud providers and industrial companies with data-based service, maintenance or platform models. For connected products and related services, the interactive Data Act check provides initial guidance on data access and obligations.

• You provide or analyse usage, device, telemetry or operating data commercially.
• You use standard contracts, platform terms, purchasing terms or cloud contracts with data clauses.
• You need to cleanly separate data access, trade secrets and the GDPR.
• You want to set up exit capability, provider switching or multi-cloud structures in a legally robust way.
• You are developing new services from product or usage data and need sound governance for them.

Data law is not just data protection

The most common mistake is to read the Data Act merely as an annex to the GDPR. That falls short. For companies, the situation becomes clearer when data protection, data law and contract and governance issues are considered side by side.

When you need us

In practice, clients rarely come with the abstract question of whether the Data Act “somehow applies”. Usually it is about concrete commercial friction points.

• A manufacturer wants to open up data access without revealing trade secrets and product logic.
• A provider of related services must clarify which data must be provided at all and in what form.
• A platform or SaaS company wants to make existing contract sets Data Act-proof without blocking sales.
• An industrial company wants to exploit usage and machine data in cooperations or data spaces.
• A cloud customer or cloud provider must structure exit, migration and lock-in issues properly.
• A company needs a robust line between the Data Act, the GDPR, other EU digital acts and internal governance.

Review Data Act implementation · Review the overall Digital Acts scope

The 5 most common practical mistakes when starting with the Data Act

Many problems arise from classification within the company that comes too late or is too rough. The law itself is rarely the bottleneck.

Which business models are particularly often affected

The scope is broad. What matters is less the industry label than the role in the data ecosystem and the specific technical and contractual structure.

Which obligations count in practice

Companies should not misunderstand the Data Act as a mere information obligation. It reaches deep into product accessibility, contract drafting and operational processes.

Properly interlinking contracts, data clauses and governance

Most commercial risks arise from poorly aligned contracts, product terms and internal responsibilities. The statutory text alone is rarely the trigger.

Especially with standard contracts, data clauses close to standard terms (AGB) and large platform or purchasing structures, the Data Act should be put on the table early. Waiting until a dispute arises gets expensive. It is often more efficient to think about contract restructuring, governance and process design together.

Explore IT law · Terms and standard clauses · Governance and compliance · Data Act implementation · Contract drafting in IT law (in German)

Trade secrets, GDPR and data access

Many companies first ask whether they can withdraw completely by referring to trade secrets or data protection. As a rule, it is not that simple.

Data protection law · Data transfer & third-country transfers · Privacy litigation · Trade secret protection

Properly classifying cloud switching and lock-in risks

Cloud switching is a core legal and organisational question and more than a topic for technicians. It is also relevant whether switching, parallel operation and repatriation actually work. The mere ability to terminate the contract is not sufficient for this.

Among other things, Art. 25 Data Act requires a transition period of no more than 30 calendar days for switching. Especially in multi-cloud, platform or security-critical set-ups, cloud switching should be considered together with the security and governance model.

Cybersecurity · NIS-2 implementation · IT contracts and digital projects · Review a SaaS contract

Interfaces that must not run separately within the company

The Data Act rarely stands alone. Commercially relevant mandates almost always lie at the transitions to other fields of law and regulation.

How we support companies in data law

Our advice goes beyond the statutory text. The aim is a structure with which product, sales, procurement, legal, data protection and IT can work in a manageable way.

Advice is particularly useful if

• You need to reset contract and data logic before or after the market launch of a connected product.
• Your company wants to adapt existing platform, cloud or data contracts.
• Trade secrets, personal data and commercial exploitation must be cleanly separated.
• You want to solve Data Act, GDPR, AI and security requirements as a coherent governance topic.

How a data law mandate works

1. Classification. We clarify roles, products, services and data types.
2. Review. We examine contracts, data flows and technical provision channels.
3. Implementation. We deliver clauses, response letters, processes and priorities.
4. Support. We assist with negotiations, disputes and contact with authorities.

Implementing the Data Act · IT law · Data protection law · Compliance · EU Digital Acts audit

Key terms in data law

Connected product

An item that obtains or generates data about its use or environment and is able to communicate product data (Art. 2(5) Data Act).

Related service

A digital service, including software, that is connected to the product in such a way that the product could not perform functions without it (Art. 2(6) Data Act).

User

A person who owns a connected product, is contractually entitled to use it or receives related services (Art. 2(12) Data Act).

Data holder

A person who has the right or obligation to use and make available data. This is often the manufacturer or service provider (Art. 2(13) Data Act).

Data recipient

A company to which data is made available without itself being a user of the product or service (Art. 2(14) Data Act).

Product data

Data generated by the use of a connected product and designed by the manufacturer to be retrievable (Art. 2(15) Data Act).

Data processing service

A digital service with network access to a shared pool of scalable computing resources, such as cloud and SaaS services (Art. 2(8) Data Act).

Switching charges

Charges for switching to another provider. They have been limited since 11.01.2024 and are abolished from 12.01.2027 (Art. 2(36), Art. 29 Data Act).

Trade secret

Information with commercial value that is protected by appropriate confidentiality measures (§ 2 No. 1 GeschGehG, German Trade Secrets Act).

The terms follow the definitions of Regulation (EU) 2023/2854 and the Geschäftsgeheimnisgesetz (GeschGehG, German Trade Secrets Act). In individual cases, the exact role in the data ecosystem is decisive.

Provisions and sources

The table separates EU law and German law. As an EU regulation, the Data Act is directly applicable. The DADG governs competence and enforcement in Germany.

FAQ – data law and the Data Act for companies

The classification always depends on the specific business model. The following answers provide sound guidance on typical business questions.

Contacts and the next sensible step