5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Implementing the Data Act in your company
Keep data access commercially manageable.
The Data Act has applied since 12 September 2025. You need to clarify which data you make accessible, which usage rights are permitted, how trade secrets stay protected and which contracts change.
Please enter a short description first.
Initial contact is free of charge. Before any costs arise, we will inform you expressly.
Response on working days within 24 hours
As of: 23 October 2026
Data Act check2 of 5
- Role as data holderPresent
- Data access under Art. 4Usage data and metadataReview
- Trade secretsParameters not classifiedMissing
- Cloud switching in the contractReview
- GDPR interfacePresent
Review point: Access request without protection concept
- 1ApplicabilityRoles and data
- 2GapsPrioritise risks
- 3RouteContracts and processes
Schematic illustration. Simplified example.
We advise on the Data Act
- Manufacturers
- SaaS providers
- Cloud services
- Industry
Key points at a glance
- The Data Act, Regulation (EU) 2023/2854, has applied in all Member States since 12
- September 2025.
- It affects products, related services, data access processes, B2B contracts and cloud and SaaS structures.
- For sales, product, legal, data protection and IT it is therefore an operational question that goes beyond pure compliance.
- ITMR reviews scope, data and contracts and builds clauses, information obligations, request processes and responsibilities.
- Your contact is Jean Paul Bohne and his team. He is a specialist lawyer for IT law and for copyright and media law. Response on working days within 24 hours.
- Data Act
- EU data regulation. It governs access to data from connected products and services.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- SLA
- Service Level Agreement. It defines availability, response times and customer service.
Service package
What does it mean to implement the Data Act?
The key question is which role your company takes in the specific data flow.
The outcome is an implementation route you can decide on.
We clarify which data is affected commercially and legally, which contracts need to be adapted and how you will answer requests in future. This shows which obligations apply and which protective positions exist.
Many companies treat the Data Act as a data protection or information obligation topic. In our experience, however, the case is decided by product design, data architecture, contract drafting, cloud exit, trade secrets and internal responsibility.
In our experience, the Data Act rarely becomes urgent through an abstract legal question. Pressure to act arises when data is to be disclosed, refused, promised by contract, made technically accessible or protected as a trade secret.
Implementation becomes strong when data law, IT contract law, data protection law, trade secret protection and governance are brought together. In our experience, that is where the commercially relevant decisions are made.
- In force since
- 12.09.2025
- Product design
- from 12.09.2026
- Existing contracts
- from 12.09.2027
- Provision
- Regulation (EU) 2023/2854
Data law at the core. If data access, data use, disclosure, product data, cloud switching or contractual fairness are at the centre, data law is the most relevant starting point.
IT law for contract and operation. If SaaS, cloud, software operation, SLA, exit or IT projects shape the case, we translate the Data Act line into the IT contracts.
Data protection runs alongside. If data flows contain personal data, we also review legal bases, roles, purposes, transparency and data subject rights.
Protection architecture for secrets. If data access touches know-how, parameters, process knowledge or security information, a mere confidentiality clause is not enough.
The former Data Act monitor on this page classified the review areas of the regulation. These include data access for connected products, sharing with third parties, interfaces, cloud switching, unfair B2B terms, trade secrets, public bodies, model contractual terms and product design from September 2026.
In practice, the Data Act links contract drafting, product development, data strategy, cloud contracts, SaaS architecture, IoT business models, aftermarket services, maintenance, data licences, data protection and trade secret protection. Users of connected products gain access to the data generated by their use, and cloud customers should be able to switch more easily.
Initial assessment
Send your reason and documents via the form. We will respond on working days within 24 hours.
How it works
How do we implement the Data Act with you?
Three steps to a basis for implementation.
01
Applicability We review roles, products, services, data types, user groups, contracts and cloud and SaaS structures.
02
Gaps We condense data access, trade secrets, GDPR, contract clauses, exit paths and responsibilities into specific risks.
03
Route You receive a legally structured basis for contracts, processes, documentation and the response to data access requests.
The six modules of implementation
- 1
Scope check We review whether connected products, related services and roles as data holder, user, data recipient, cloud or third-party provider are affected. What counts is the actual business model.
- 2
Data mapping We assess product data, service data, metadata, machine and usage data, personal data, security information and trade secrets separately. This avoids both blanket release and blanket blocking.
- 3
Contract review We review terms and conditions, SaaS contracts, cloud terms, supply contracts, data licences, data sharing rules, SLA, exit and confidentiality clauses for robustness and vulnerability.
- 4
Access process You need a process for receipt, identification, claim review, third-party access, format, deadlines, refusal, restriction, communication and documentation of data access requests.
- 5
Protection concept We bring together data access, confidentiality, purpose limitation, access restrictions, personal data and protective measures. Otherwise protection only arises once the conflict is under way.
- 6
Governance Implementation needs owners, approvals, standard texts, escalation paths, contract lines and evidence. A good result is legally correct and usable in everyday work.
How long does it take? Most work steps are completed within a few working days. How quickly it goes depends on the scope and on your feedback. Do you have a fixed date, such as a launch? Tell us when you send your enquiry and we will plan for it.
Result
What should be clarified after the advice?
Service package: Data Act
Scope and data mapping ITMR reviews whether and in which role you are affected, which products, services, cloud or SaaS structures and data flows are relevant and which data categories need particular attention.
Contract risks and clause needs We review existing and planned B2B data contracts, usage rights, exclusions, fees, access conditions and protective clauses for compliance with the Data Act.
Data access and trade secret protection You receive a clear line on how data access requests are reviewed, answered, limited or refused, and when trade secrets, security interests or third-party rights apply.
GDPR and roadmap of measures The Data Act does not replace a GDPR review. We bring obligations, data protection, technology, responsibilities and prioritised measures together so that legal, IT, product and sales can act.
- For whom
- Manufacturers, service providers, SaaS, cloud, industry, platforms
- First response
- on working days within 24 hours
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Technical implementation of the interfaces. On request.
Who delivers what and who decides
- Product and service description
- Data types and access paths
- Contracts and reason
- Scope and data mapping
- Contract and clause review
- Access process and protection concept
- You, on implementation and response
- In a dispute, the authority or the court
How does instructing us work?
- 1
First assessment You send your reason and documents via the form. We assess whether you are affected. Initial contact is free of charge.
- 2
Offer Before work begins, we tell you the scope and costs transparently.
- 3
Court steps separately Regulatory and court proceedings and disputes over data access are agreed separately.
Acute pressure to implement
When should implementation not wait?
Six situations in which companies contact us. In each of them we first clarify the claim, scope and protective limits before you reply or commit.
Customers, users, partners or third parties request product, usage, service or machine data. It must be clear whether a claim exists, which data is affected and where the protective limits lie.
For devices, machines, sensors, apps or related services, data access belongs in the product, contract, information and governance before a dispute arises.
Old clauses on data access, use, liability, exit, confidentiality and portability may be commercially intended and still no longer hold up legally.
Export, migration, interoperability, switching support and contract end must fit together legally and technically, otherwise the exit becomes a point of conflict.
Data access must not lead to uncontrolled disclosure of parameters, product design, security information, process knowledge or commercially sensitive data.
Without responsibilities, approvals, standard replies and documentation, implementation gets stuck in day-to-day operations.
Applicability
For whom does the Data Act quickly become relevant?
The regulation particularly affects these six groups. Whether you are affected depends on your role in the data flow, not on your sector or company size.
Devices, vehicles, machines, sensors, embedded systems or hardware that generate data or make it usable during use.
Apps, portals, maintenance services, analytics functions, dashboards or add-on services that work with product or usage data.
When data export, provider switching, interoperability, contract end or switching support are negotiated.
Companies that want to use, receive or share data from plants, supply chains, production or service relationships.
Data portals, data spaces, API strategies, partner access, data products or cooperation models.
Companies outside the EU whose products, services or data models are aimed at the European market.
Data Act review areas
Which ten review areas does the Data Act cover?
The overview sorts the main review areas of the regulation by provision and typical question. For your business model we review which areas apply and in which order you should tackle them. Editorial classifications are not official measurements.
| Review area | Provision or date | Typical question | Classification |
|---|---|---|---|
| General application | 12.09.2025, Art. 50 | Which processes must be running now? | Starting point of implementation |
| User access | Art. 4 | Which product and service data must the user receive? | Central access right |
| Third-party access | Art. 5 | Who may receive data at the user's request? | Aftermarket, service, maintenance |
| Product design | Art. 3(1), from 12.09.2026 | Must the product be built for data access? | Obligation for engineering and product |
| B2B data sharing | Chapter III | How are compensation and protection regulated? | Negotiation and contract question |
| Unfair terms | Chapter IV | Are data clauses unilaterally disadvantageous? | Review of terms and contracts |
| Existing contracts | 12.09.2027, Art. 50 | When are long-running existing contracts covered? | Contract inventory needed |
| Cloud switching | Art. 23 to 31 | How is provider switching made technically and contractually possible? | Exit and portability review |
| Trade secrets | Several protective mechanisms | Which data may be protected or restricted? | Protection concept instead of blanket refusal |
| Public bodies | Chapter V | When may authorities request data in cases of exceptional need? | Review of access by authorities |
Decision situations
What matters before release, rollout or reply?
Six situations, their core legal question and the benefit of the review. For each situation we set a documented line with you.
| Criterion | Core legal question | Benefit of the review |
|---|---|---|
| Data access request | Is there a claim, to what extent and with which protective limits? | No premature disclosure, no blanket refusal, a documented line of response. |
| Product launch | Must data access be prepared technically, contractually or through information? | Data Act questions feed into product, user information and contracts before market launch. |
| Contract rollout | Do data, liability, usage, exit and confidentiality clauses hold up? | Standard contracts are repaired before a customer conflict. |
| Cloud or SaaS exit | Which obligations on portability, export, migration or interoperability apply? | Switching processes become legally and operationally manageable. |
| Trade secrets | Which information is only protected, restricted or accessible under conditions? | Know-how protection becomes concrete before disclosure. |
| GDPR interface | Is personal data involved, and which roles, purposes and legal bases are affected? | Data Act and data protection are implemented without contradictions. |
Contract focus
Which clauses fail during implementation?
Many Data Act risks lie in contracts, terms and conditions, product terms, data agreements and exit rules. That is why contract review is at the core. We review your templates and propose specific wording that fits your data model and business model.
Which data becomes accessible, in which format, via which path, with which metadata and under which technical conditions?
Who may use, share, analyse, combine or exploit data? Purpose, duration and reach should be fixed.
If users have data transferred to third parties, identification, role, protective duties, liability and misuse risks must be regulated.
Fees, additional services, technical assistance, migration and interface effort must be reflected in a traceable way.
Contracts should protect know-how, security information and sensitive parameters without blocking legitimate data access across the board.
For SaaS and cloud, export, migration, switching support, performance limits, responsibilities, liability and documentation count.
Typical mistakes
What should companies avoid during implementation?
We see these six mistakes in our mandates. Each of them can be avoided with a clear line before the first request.
- Committing too early Sales or customer service promise data access before claim, scope, format, third-party access, personal data and secret protection have been reviewed.
- Refusing too broadly A request is refused out of a protective reflex, although differentiated disclosure, restriction or contractual safeguards would be possible.
Weak know-how protection Trade secrets are only asserted once access is requested. A protection concept documented in advance is better.
Outdated clauses Terms and framework agreements contain data, exit and confidentiality rules that no longer fit the data model.No owners Legal, IT, product, data protection, sales and purchasing assess the same data flow differently, without a joint approval.Unclear GDPR interface Personal and other data are not separated. Roles, purposes and legal bases remain open.
Official basis
Which official sources is the implementation based on?
The legal baseline should rest on official sources. For implementation, what then counts is which data, contracts, roles and protective positions are affected in your business model.
Under Art. 50 of the regulation, the Data Act has applied since 12 September 2025. Art. 3(1) applies to products and services placed on the market after 12 September 2026. In Germany, the Federal Network Agency is designated as the competent authority.
Deadlines. Since 12.09.2025. Affected companies should review scope, data categories, roles, access processes, information obligations, GDPR interfaces and contracts. They must now be able to answer data access requests in a structured way.
Deadlines. Key date 12.09.2026. For connected products and related services placed on the market after this date, data access by design is mandatory. Product, legal, IT, data protection and sales should map this together before every launch.
Deadlines. From 12.09.2027. Certain existing contracts fall under the rules on unfair terms, above all open-ended or very long B2B contracts. Anyone who has regulated data access, use, fees or secret protection in the long term should review in good time.
- Regulation (EU) 2023/2854 Data Act on EUR-Lex.
- European Commission Data Act and the European data strategy.
- Data Act explained Commission explanations.
- Data Act Legal Helpdesk Commission helpdesk.
- Federal Network Agency (Bundesnetzagentur) Data Act in Germany.
Limits
What does implementation advice not cover?
We say openly where our work ends.
- 1
No engineering Your IT or service providers build interfaces and export functions. We define the legal requirements.
- 2
Interpretation still evolving The Commission's guidelines and model contractual terms keep evolving. We review against the current state.
- 3
No official values Editorial classifications such as relevance or risk are not official measurements.
What you should avoid before the request
- Promising data access before the line is set.
- Refusing requests across the board without review.
- Naming trade secrets only once a conflict arises.
Your contact
Lawyer and mediator · Partner · Specialist lawyer for IT law · Specialist lawyer for copyright and media law
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
TOP lawyer 2027 · Business lawyers · Intellectual property
F.A.Z.-Institut and QuantiQuest. Based on recommendations from peers and assessments by in-house counsel. Source (opens in a new tab)
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Complex topics are always explained clearly and supplemented straight away with specific, workable proposals when it comes to solving the problem. Mr Bohne's expertise and reliable way of working give us the certainty that we are ideally positioned on data protection and IT law.” (translated from German)
“Mr Bohne is an excellent lawyer. He really took his time, listened carefully and gave me clear recommendations on how to set up my app in Germany in line with the GDPR, including tips on typical pitfalls. …” (translated from German)
“Mr Bohne gave me excellent advice on data protection for my website. Professional, friendly and tailor-made solutions. Any time again! Highly recommended!” (translated from German)
FAQ
What do companies ask about implementation?
When should you have the Data Act reviewed by a lawyer?
When a connected product, a related service, a SaaS or cloud model, a data contract, an access request, a launch or a trade secret is affected. Ideally before a contract rollout, a customer reply, a product release or a cloud exit. Send us the reason and we will name the next steps and a realistic order.
Do companies have to hand over all data?
No. We review disclosure, format, scope, purpose, third-party access, personal data, technical availability, security and trade secrets case by case. Implementation should not boil down to blanket approval or refusal. For each data category we define whether you disclose, restrict or refuse, and how you justify it.
Which contracts should you review?
Terms and conditions, SaaS and cloud contracts, supply contracts, data licences, data sharing agreements, platform terms, purchasing terms, cooperation agreements, service level rules, exit clauses and confidentiality agreements. We prioritise the contracts by revenue, term and risk so that you start with the most important ones.
Is the Data Act mainly a data protection topic?
No. Data protection matters for personal data. The Data Act also covers product, usage, machine, service and cloud data without personal reference, as well as contractual fairness, portability, interoperability and trade secrets. We combine both reviews so that data protection and data access do not work against each other.
What does the Data Act mean for SaaS and cloud providers?
You should review terms, termination, export, migration, switching support, interoperability, customer information, SLA, availability and exit processes. The legal assessment must fit the technical operation. We translate the obligations into clauses, exit plans and customer information that your operations can actually deliver.
How do you protect trade secrets when granting data access?
Through prior classification, technical and organisational measures, access restrictions, confidentiality rules, purpose limitation, documentation and clear decision paths. The protection must be demonstrable. We help with classification, justification and documentation so that your protection holds up in a dispute.
What do you do first when you receive a data access request?
Check identity, role, data concerned, legal basis of the claim, purpose, format, personal data, third-party access, trade secrets and technical availability. An unstructured commitment can be commercially risky. We provide a checklist and standard replies so that your team handles requests consistently.
What is the result of the implementation?
Depending on the case: scope decision, data mapping, contract review, clause proposals, protection concept, GDPR alignment, request process, responsibility model, risk matrix and prioritised steps for legal, IT, product, sales and management. We agree the scope with you in advance so that the result fits your organisation and your budget.
Does the Data Act also apply to companies without an EU seat?
Yes, if products, related services or data processing services are offered in the EU. We review which role you take on the EU market. What counts is the connection to the EU market, not the company's seat.
What changes on 12 September 2026?
Connected products and related services placed on the market after that date must be designed under Art. 3(1) so that users can easily access their data. This affects development, documentation and user information. We recommend linking product planning and legal review early, because later changes to the product are expensive.
What happens to existing contracts?
From 12 September 2027, under Art. 50, certain open-ended or long-term B2B contracts can fall under the rules on unfair terms. We recommend a contract inventory before that date. We sort your contracts by term and risk and propose amendments.
What role does the Federal Network Agency play?
It is designated as the competent authority for the Data Act in Germany. We link its information page under the official sources. The authority is still building up its supervisory practice. We follow its publications.
May you charge fees for making data available?
In B2B relationships, Chapter III governs the conditions under which reasonable compensation is permitted. We review the amount, calculation and transparency of your fee rules. In our experience, unclear fee rules lead to disputes with customers and partners.
What applies to public bodies?
Under Chapter V, public bodies may request data in cases of exceptional need. We review whether such a request meets the requirements and how you respond. Such requests are the exception. Still, review them carefully and with documentation.
Next step
Is your Data Act line in place before data is promised?
The critical moment comes before visible escalation: before a customer receives an answer, a contract is rolled out, a product launches or a cloud exit is negotiated. That is when it shows whether data access remains manageable or becomes a dispute, audit or deal risk. We will get back to you with an initial assessment of applicability, priorities and the sensible scope of the review for your company.
What speeds up the first review
- Product, service or SaaS and cloud model, and your company's role in the market and supply chain.
- User groups, customer structure, EU market connection and planned launch, rollout, audit or contract change.
- Data types, data sources and metadata, as well as API, export, portal, dashboard or access paths.
- Technical availability, formats and interfaces, personal data, security relevance and trade secrets.
- Terms and conditions, SaaS, cloud, supply or data contracts, and data sharing, licence or cooperation clauses.
- Customer demands, negotiations or data access requests, as well as internal responsibilities and existing processes.
Also tell us which decision is coming up shortly.
Implement the Data Act: clarify whether you are affected
Describe your product, service or contract. We classify role, obligations and priorities.
Helpful are a product or service description, data types, contract situation, cloud or SaaS structure and the reason.
Related services
Data law & Data Act Data access and data contracts.IT law & digitalisation Digital business models.IT contract / software contract SaaS, cloud, licence, exit.Data protection law Personal data.Open source compliance Licences in products.Implement the AI Act Clarify AI obligations.Data transfer Review third-country transfers.Review a SaaS contract Negotiate SaaS contracts.
From our blog: Access by design