EU Data Act for Connected Products: Access by Design, User Data Rights and What Makers Must Do

What is covered

Term	Meaning	Article
Connected product	An item that obtains, generates or collects data about its use or environment, can communicate product data (via a network, a physical connection or on-device access), and whose primary function is not storing or processing data for others	2(5)
Related service	A digital service, including software, connected with the product so that its absence would prevent the product from performing a function, or added later to add to, update or adapt its functions	2(6)
Product data	Data generated by the use of the product that the manufacturer designed to be retrievable	2(15)
Related service data	Data representing the digitisation of user actions or events related to the product, recorded during the provision of a related service	2(16)
User	Whoever owns the product, has contractual rights to use it, or receives related services, whether a consumer or a business	2(12)
Data holder	Whoever has the right or obligation to use and make available the data, typically the manufacturer or the related service provider	2(13)

Think smart home devices, wearables, connected cars and machinery, industrial sensors and the companion apps and platforms that run them.

The dates

Date	What applies	Article
12 September 2025	Users' rights to access and share data (Articles 4 and 5) and the pre-contract information duties	50
Products placed on the market after 12 September 2026	Access by design: the product and related service must make data directly accessible by default (Article 3(1))	50

Access by design (Article 3(1))

Connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data, with the metadata needed to interpret and use them, are by default:

easily and securely accessible, free of charge;
in a comprehensive, structured, commonly used and machine-readable format;
where relevant and technically feasible, directly accessible to the user, for example through an app, an API or on the device.

Information before the contract

Before a sale, rental or lease, the seller, which may be the manufacturer, must tell the user at least: the type, format and estimated volume of product data, whether it is generated continuously and in real time, whether it is stored on the device or a remote server and for how long, and how the user can access, retrieve or erase it (Article 3(2)).

Before a related service contract, the provider must give more: the data it expects to obtain and generate, whether it will use the data itself and for what, whether third parties will use it, its identity and contact details, how to request sharing with a third party, the right to complain to the competent authority, any trade secrets in the data, and the contract duration and termination (Article 3(3)).

The user's rights

Access (Article 4(1)): where the user cannot access data directly, the data holder must make readily available data and metadata accessible without undue delay, of the same quality as it has, free of charge, in a structured, commonly used and machine-readable format, and where relevant and feasible continuously and in real time, on a simple electronic request.
Sharing with third parties (Article 5(1)): on the user's request, the data holder must make the data available to a third party of the user's choice, for example an independent repair shop or a competing service, free of charge to the user. Compensation from the third party is governed by Chapter III.
No gatekeepers (Article 5(3)): companies designated as gatekeepers under the Digital Markets Act are not eligible third parties.

Limits that protect the data holder

Trade secrets (Article 4(6) to (8)): they are disclosed only with agreed confidentiality measures. Without agreement, or if the user breaches them, the data holder may withhold or suspend sharing, notifying the user and the competent authority. In exceptional cases, where serious economic damage is highly likely, it may refuse a specific request, with a substantiated decision.
No competing products (Article 4(10)): the user may not use the data to develop a competing connected product, or to derive insights about the manufacturer's economic situation, assets or production methods.

Limits on the data holder's own use

A data holder may use readily available non-personal data only on the basis of a contract with the user, and must not use it to derive insights that could undermine the user's commercial position (Article 4(13)). It must not make non-personal product data available to third parties other than to fulfil its contract with the user (Article 4(14)). Personal data remains subject to the GDPR in full.

Who is exempt

Chapter II does not apply to data from connected products manufactured or designed, or related services provided, by microenterprises and small enterprises that have no partner or linked enterprise above that size and are not subcontracted to manufacture or design the product. Medium-sized enterprises get a one-year grace period after qualifying as medium-sized, and for one year after placing a product on the market (Article 7(1)). Contract terms that exclude or vary users' rights to their detriment are not binding (Article 7(2)).

Proposed change: the Commission's Digital Omnibus proposal of November 2025 (COM(2025) 837) would also amend parts of the Data Act. In October 2026 it had not been adopted; plan on the rules as they stand.

Checklist for manufacturers and service providers

Inventory which products and services are in scope, and check the size exemption, including partner and linked enterprises.
Map the product data and related service data you can retrieve, and the metadata needed to use it.
For new products: build user access into the device, app or API by default, in a machine-readable format, free of charge.
Update pre-contract information for sales and for related service contracts with every Article 3(2) and (3) item.
Set up a request process for access and for sharing with third parties, including identity checks and secure delivery.
Identify trade secrets in the data and prepare confidentiality terms in advance.
Put contracts with users in place for your own use of non-personal data, and check your GDPR basis for personal data.

Secure the data flows. The Vendor Security Assessment Pack helps you assess the cloud and app providers in your product's data chain, with a security questionnaire, a requirements addendum, a risk register and a data processing agreement.