Understanding New Compliance Obligations Under the EU Data Act

The EU Data Act, adopted in January 2024 and effective as of September 12, 2025, marks a significant step in the European Union’s regulation of data use and governance. As explained by Hanna Hewitt and Kelly Hagedorn of Alston & Bird, the legislation builds on frameworks such as the General Data Protection Regulation (GDPR) and the Data Governance Act. Its scope is broad, impacting companies handling data from connected devices, ranging from smart appliances to industrial machinery and vehicles, as well as cloud service providers. For compliance teams, the law introduces obligations that require immediate attention.

At its core, the EU Data Act sets standards for fair access to and use of data. It empowers users, both individuals and businesses, to access and share data co-generated by connected products. It also introduces rules to address unfair contractual terms in data-sharing agreements, strengthens switching rights between cloud providers, and establishes provisions for public sector access to data during emergencies. Importantly, it protects EU-stored non-personal data from unlawful foreign access, creating a new compliance dimension for cross-border businesses.

Organizations within the Act’s scope must now ensure user rights to data access and sharing, implement clear protocols for handling requests, and review contractual terms to eliminate unfair practices, especially where market dominance exists. Compliance also requires preparing for obligations around cloud interoperability, data protection safeguards, and internal process alignment, including IT systems and employee training.

For compliance professionals, Hewitt and Hagedorn stress that proactive preparation is critical. By auditing contracts, strengthening governance, and ensuring technical readiness, organizations can mitigate risk and adapt effectively to the EU Data Act’s new regulatory landscape.