EU Data Act Cloud Switching Rules: What SaaS and Cloud Providers Must Offer

Who is covered

Chapter VI of the Data Act (Regulation (EU) 2023/2854) applies to providers of data processing services: digital services that give customers on-demand network access to a shared pool of configurable, scalable and elastic computing resources that can be rapidly provisioned and released (Article 2(8)). Recital 81 states that this covers the three common delivery models: infrastructure, platform and software as a service (IaaS, PaaS and SaaS).

Two carve-outs apply (Article 31):

• Custom-built services: where most main features were built for one customer, or all components were developed for that customer, and the service is not offered at broad commercial scale through the provider's catalogue, the rules on functional equivalence, switching charges and the technical interface duties in Article 30(1) and (3) do not apply. The rest of Chapter VI does.
• Trials: non-production versions offered for testing and evaluation for a limited time are outside Chapter VI altogether.

Providers relying on either must tell the customer, before the contract is concluded, which obligations do not apply (Article 31(3)).

The timeline

Switching charges are charges, other than standard service fees or early termination penalties, imposed for the actions the Data Act requires to switch to another provider or on premises, including data egress charges (Article 2(36)). Early termination penalties in a fixed-term contract are a separate question and not abolished by Article 29.

What the contract must contain (Article 25)

The customer's switching rights must be set out in a written contract, made available before signing in a form the customer can store and reproduce (Article 25(1)). At a minimum it must include:

If 30 days is technically unfeasible, the provider must say so within 14 working days of the switching request, justify it and propose an alternative transitional period of no more than seven months, keeping the service running throughout (Article 25(4)). The customer can also extend the transitional period once (Article 25(5)).

Information and technical duties

• Switching information (Article 26): describe the switching and porting procedures, methods, formats and known limitations, and point to an up-to-date online register of data structures, formats and the standards and open specifications in which exportable data is available.
• Fees up front (Article 29(4) to (6)): before contracting, give clear information on standard fees, early termination penalties and any reduced switching charges, and flag services where switching is highly complex or costly. Publish this in a dedicated section of your website or another easily accessible way.
• International access (Article 28): publish on your website the jurisdiction your ICT infrastructure is subject to and a general description of your measures against unlawful third-country governmental access to non-personal data, and list that page in your contracts.
• PaaS and SaaS (Article 30(2) and (3)): make open interfaces available free of charge, to all customers and destination providers equally, with enough information to build software for portability and interoperability; once common specifications or harmonised standards are published, become compatible with them within 12 months.
• IaaS (Article 30(1)): take all reasonable measures so the customer can achieve functional equivalence with the destination service of the same type.
• Good faith (Article 27): all parties, including the destination provider, must cooperate to make the switch effective and keep data secure.

Customers that use several clouds in parallel get similar interoperability protections; providers may only pass on actual data egress costs for parallel use (Article 34).

Enforcement

Member states set the penalties and designate the competent authorities (Article 40). Penalties must be effective, proportionate and dissuasive, and the Commission keeps a public register of national rules. Expect enforcement through national authorities and, just as often, through customers who now have a statutory right to leave.

A proposal to relax the rules for older contracts

The Commission's Digital Omnibus proposal of November 2025 (COM(2025) 837) would lighten the switching regime for certain custom-made services and for SME and small mid-cap providers of non-infrastructure services, for contracts concluded before 12 September 2025. In October 2026 it had not been adopted. Until it is, plan on the rules as they stand.

Checklist for providers

1. Confirm which of your services are data processing services, and whether any fall under the custom-built or trial carve-outs; document why.
2. Update your standard terms with every Article 25(2) clause, and make them available before signing.
3. Publish switching information, your data format register, fee information and the Article 28 jurisdiction page.
4. Build or document export for all exportable data in a structured, commonly used, machine-readable format, and test it on a full account.
5. Remove any switching or egress charge for switching from 12 January 2027, and check that no other fee acts as a disguised switching charge.
6. Write an internal switching runbook: who receives requests, the 14-working-day feasibility check, assistance during the transitional period, and verified erasure at the end.

What customers should ask for

If you buy cloud or SaaS services, the Data Act strengthens your exit position. Check the provider's terms against the table above, ask for its data format register, and test an export before you need it. For financial entities, these rights support the exit plans that DORA requires; see DORA exit strategies.

Plan the exit before you sign. The Vendor Security Assessment Pack includes a vendor exit plan template, a security requirements addendum, a vendor security questionnaire, an onboarding checklist, a risk register and a data processing agreement.

Sources

• Regulation (EU) 2023/2854 (Data Act), Articles 2, 23 to 31, 34, 40 and 50, recital 81, EUR-Lex
• European Commission: proposal for a Digital Omnibus Regulation, COM(2025) 837, EUR-Lex

Related tools