Regulation (EU) 2023/2854 (“Data Act”), which is set to redefine the data ecosystem in Europe, will be fully applicable from September 12, 2025.

Cloud service providers and manufacturers of connected devices (IoT) will face stringent obligations: “by design” access to data, sharing with third parties on fair terms, portability, elimination of contractual lock-ins, and—from 2027—free migration.

The time to comply is limited: technical and contractual compliance measures must be initiated immediately to avoid penalties that are expected to be severe.

In our Legal Alert, Marco Galli, Vittoria Omarchi, and Giorgia Valsecchi take an in-depth look at the main changes and priority actions for businesses and providers.