Data Act
The Data Act, Regulation (EU) 2023/2854, is a horizontal EU regulation on fair access to and use of data. Adopted on 13 December 2023 and applicable since 12 September 2025 (with design obligations for new connected products from 12 September 2026), it aims to unlock the value of data generated by connected devices and related services by giving users rights over that data and by setting rules for business-to-business and business-to-government data sharing, cloud switching and interoperability.
Its core provisions oblige manufacturers of connected products and providers of related services to design them so that product data and related service data are accessible to the user by default, and to make such data available to the user and, at the user's request, to third parties, on fair, reasonable and non-discriminatory terms, with protections for trade secrets. It prohibits unfair contractual terms imposed on smaller businesses, allows public bodies to request data in situations of exceptional need, requires cloud and edge providers to remove obstacles to switching (with egress fees phased out by January 2027), and sets interoperability requirements for data spaces. Unlike the GDPR, it applies to personal and non-personal data alike; where personal data is involved, the GDPR prevails and the Data Act's access rights supplement the right to portability.
For MedTech and digital health, connected medical devices, wearables and their companion apps are connected products, so manufacturers must plan for user data access, third-party sharing requests and the interaction with MDR safety requirements and health data rules. For pharmaceutical companies the Act affects cloud contracts and B2B data licences. Together with the Data Governance Act and the European Health Data Space, it forms the EU's data strategy framework, which iliomad addresses through its global data governance services.
