COMPLIANCE & RIGHT · TREATY
A networked machine generates operational data, a maintenance service wants to evaluate it, the manufacturer protects his technical knowledge. The Data Act changes the legal relationships between these parties. He doesn't create a flat-rate ownership of data. The decisive factor is which data are collected, who can demand access and under what conditions they may be used.
Data access for connected products
Regulation (EU) 2023/2854 has generally applied since 12 September 2025. An important part concerns product data and related services. For example, users can be owners, tenants or lessees of a networked product. The access depends on the respective legal requirements and does not necessarily include all information available from the manufacturer.
In practice, raw data and pre-processed data must first be distinguished from derived findings and further analyses. It is also necessary to clarify which data are accessible to the data holder without disproportionate effort. Exceptions and special rules, especially for certain smaller companies, must be assessed on the basis of the specific business model.
Provision obligations shall be distinguished from the requirements for accessible product design. For Article 3(1), Article 50 provides for a separate transition: it concerns networked products and related services placed on the market after 12 September 2026. Therefore, the time of provision is included in the legal inventory.
Contractual use and disclosure
Manufacturers should be able to describe what data is generated, in which formats they are available and how access is made. Pre-contractual information and usage agreements must be consistent with the technical implementation. A clause which assigns all data to the manufacturer alone is not a reliable starting point.
When passing on to a third party designated by the user, the purpose of determining the scope, permitted use and security measures is to be determined. In addition, where appropriate, there are provisions on reasonable consideration and unfair contractual clauses. The respective chapters of the Data Act have different requirements and transitional rules. Therefore, an admissible B2B agreement cannot be derived solely from a general contract model.
Data protection and trade secrets remain relevant
If the data contains a personal reference, there must also be a data protection basis. In particular, the Data Act does not provide general permission to share personal data of any employee or other person. Roles, purposes and rights of data subjects shall be examined separately.
Trade secrets are not defenceless. The law provides for protective measures and restrictions under tight conditions. Conversely, the mere assertion that all machine data is secret does not justify a flat-rate refusal of access. A comprehensible assignment and appropriate contractual and technical arrangements are required.
Example: The customer commissions a maintenance service
Fictional case for illustrative purposes: A machine operator requires operating data to enable an independent service provider to investigate energy consumption. First, it is checked whether the operator is a user of a collected product and which of the desired data fall within the legal scope. Access, format, recipient and use are then determined.
If a data set contains personal user recognitions or confidential parameters, this must be taken into account in the design. The answer is therefore neither automatically "to release all data" nor "to refuse because of secrecy". A documented decision and a truly usable delivery route are required.
Change from cloud and other data processing services
Another part of the Data Act concerns switching providers. Contracts must take into account technical and contractual obstacles to change, such as the data to be issued, participation, transition phases and deletion. As from 12 January 2027, there shall in principle be no longer any change of rates within the meaning of the Regulation. Other contractual payment obligations shall be clearly delimited.
We review data access and usage agreements, product information and cloud contracts. For a First request provide a description of the product or service, the companies involved, the types of data and the access required.
Legal basis and decisions: Data Act – Regulation (EU) 2023/2854; European Commission: Explanatory notes on the Data Act; GDPR – Regulation (EU) 2016/679.
Situation as at 2 November 2026.
Further reading: Trade secrets and know-how · Mechanical engineering and industry · Contracts and distribution
Four practical examples
The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.
01 · Machine data for the operator
The operator wants to export operating data. User position, data scope, route of delivery and possible protective measures are clarified before the answer.
02 · Independent maintenance service
A user designates a third party as a data recipient. Permission, purpose of use, protection of secrets and personal shares are taken into account in the release.
03 · Change of cloud provider
A company wants to migrate its data. Contracts, data to be disclosed, participation, timetable and, where appropriate, permissible fees shall be examined.
04 · New product generation
A manufacturer is planning a networked device. Information requirements and data access requirements are already planned for architecture and market launch.
Your next step
Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.