The Data Act and Other EU Laws: GDPR, Data Governance Act, Digital Markets Act, ePrivacy, Trade Secrets and Database Right Compared

Regulation (EU) 2023/2854 has been in force since 11 January 2024 and has applied since 12 September 2025 (Article 50). It covers personal and non-personal data alike (Article 1(2)). How the rest of the EU Data Act works is explained on the home page.

The sections below cover the relation clauses, the three paragraphs of Article 44, the six compared laws, the further acts that Article 1 names and the changes the pending Digital Omnibus proposal would make, as of 5 November 2026.

How the Data Act Fits into the EU's Data Laws

The Data Act relates to the other EU data laws through five kinds of provision: data protection and privacy law prevails in a conflict (Article 1(5)), older Union acts on data access keep their specific obligations (Article 44(1)), sector and research law may add requirements or stay in place (Article 44(2) and (3)), three acts lend it definitions or a body, and further acts stay unaffected or are complemented (Article 1(6) to (10) and recital 116). The Data Act uses the GDPR definition of personal data (Article 2(3)) and does not constitute a legal basis for the collection or generation of personal data by the data holder (recital 7). Where users are data subjects, the rights of Chapter II complement the rights of access and data portability under Articles 15 and 20 GDPR (Article 1(5), second sentence).

Three acts are linked to the Data Act by definitions or a shared body rather than by conflict rules. A data intermediation service is the service defined in Article 2(11) of the Data Governance Act (Article 2(10)), a trade secret has the meaning given in Article 2(1) of Directive (EU) 2016/943 (Article 2(18)), and any undertaking designated as a gatekeeper under Article 3 of the Digital Markets Act is not an eligible third party (Article 5(3)). The European Data Innovation Board of the Data Act is the expert group set up under Article 29 of the Data Governance Act (Article 42). Table 1 sets out the five kinds of provision.

Table 1: how Regulation (EU) 2023/2854 relates to other Union law, as of 5 November 2026.

Article 44: Union Acts on Data Access That Remain Unaffected

Article 44 of the Data Act, the first article of Chapter XI, decides how the Regulation relates to other Union acts that govern rights and obligations on data access and use: it leaves older specific obligations unaffected, allows sector law to add requirements and keeps research access law in place. Table 2 sets out its three paragraphs.

Table 2: Article 44 Regulation (EU) 2023/2854; the examples are older acts whose data-access rules stay in place.

The pending Digital Omnibus proposal would not amend Article 44, as of 5 November 2026. Each article of the Regulation and the page that explains it are listed in Data Act articles 1 to 50.

The Cut-Off of 11 January 2024

Article 44(1) keeps unaffected the specific obligations to make data available between businesses, between businesses and consumers, and on an exceptional basis between businesses and public bodies, in Union acts that entered into force on or before 11 January 2024, including their delegated and implementing acts. The date is the Data Act's own entry into force (Article 50), not its application date of 12 September 2025.

The Commission's frequently asked questions (FAQ), version 1.4 of 22 January 2026, read Article 44(1) in Q3 as meaning that "previous legal obligations (including those laid down in delegated or implementing acts) prevail". For acts adopted between 11 January 2024 and 12 September 2025, the same answer says "best efforts should be made to ensure alignment, but there is no legal obligation to do so". Both points are the Commission's non-binding reading. Newer obligations follow a different route: the Chapter III conditions for making data available between businesses apply to obligations in Union law, or national law adopted in accordance with Union law, that enter into force after 12 September 2025 (Article 50, Article 12(1)).

What Sector-Specific Union Law May Add (Article 44(2))

Article 44(2) lets Union law adopted for the needs of a sector, a common European data space or an area of public interest set further requirements, in particular on the technical aspects of data access, on limits to data holders' rights to access or use certain data provided by users, and on aspects beyond data access and use. Recital 115 gives examples: interfaces for data access, access provided directly from the product or via data intermediation services, and governance aspects or security requirements, including cybersecurity requirements.

Three older sector regimes are examples: the vehicle repair and maintenance information duties of Articles 61 to 66 and Annex X of Regulation (EU) 2018/858, the customer metering-data rights of Articles 20 and 23 of Directive (EU) 2019/944, and the battery data duties of Article 20a of Directive (EU) 2018/2001, as inserted by Directive (EU) 2023/2413. All three entered into force before the cut-off, so Article 44(1) leaves their obligations unaffected; how each sector applies the rules is set out under the Data Act by sector.

Scientific Research Access and the Chapter V Exception (Article 44(3))

Article 44(3) leaves Union and national law that provides for access to and authorises the use of data for scientific research purposes unaffected, with the exception of Chapter V. Chapter V is the Data Act's regime for making data available to public sector bodies, the Commission, the European Central Bank and Union bodies on the basis of an exceptional need.

The Data Act Compared with Six EU Laws

Six EU laws touch the same data as the Data Act closely enough to need their own comparison: the GDPR, the Data Governance Act, the Digital Markets Act, the ePrivacy Directive, the Trade Secrets Directive and the Database Directive. Each row of Table 3 gives the act's number, what it governs, the Data Act provisions where the two meet and the status as of 5 November 2026. Each comparison page then sets out scope, actors, conflict rules and enforcement in full.

Table 3: status as of 5 November 2026; Commission FAQ positions are non-binding.

Other Union Acts Named in the Data Act's Relation Clauses

Beyond the six compared laws, Article 1 of the Data Act names further acts that it leaves unaffected or complements: the free flow of non-personal data Regulation, the intellectual property directives, the consumer protection directives, and the acts on criminal law enforcement, customs and taxation, while recital 116 keeps competition law untouched. Article 1(10) adds that the Regulation does not preclude voluntary lawful data sharing contracts, including reciprocal ones, which comply with its requirements. Article 1 as a whole, with the scope rules, is explained under who the Data Act applies to.

Table 4 lists each act or area with its provision and relation. One further clause sits outside Article 1: the switching contract terms of Article 25(2) apply without prejudice to the Digital Content Directive, Directive (EU) 2019/770.

Table 4: Article 1(6) to (10), Article 25(2) and recital 116 of Regulation (EU) 2023/2854.

Pending Changes to the Interplay under the Digital Omnibus Proposal

The Digital Omnibus, Commission proposal COM(2025) 837 of 19 November 2025, would change how several of these laws relate to the Data Act, but it is pending as of 5 November 2026: the Council mandate was agreed by the Committee of Permanent Representatives (Coreper) on 21 October 2026 and the European Parliament is at committee stage. The proposal would fold Regulation (EU) 2018/1807, the Data Governance Act and Directive (EU) 2019/1024 into the Data Act and repeal them, and it would delete Article 1(7). Its procedure file 2025/0360(COD) reads "Awaiting committee decision".

The proposal would also amend the GDPR, adding a new Article 88a, and Article 5(3) of the ePrivacy Directive. The full proposal and its legislative status are tracked under Data Act amendments under the Digital Omnibus.

Articles 43 and 44 are not among the points the proposal would amend. A separate ePrivacy Regulation is not pending either: the Commission withdrew its 2017 proposal COM(2017) 10 on 6 October 2025 (procedure 2017/0003(COD)).

Building One Programme across Several EU Data Laws

A Data Act programme that touches other EU laws starts with four checks: whether the data includes personal data, whether an older Union act already sets a data-access obligation for the product or sector, whether the data contains trade secrets, and whether a requesting third party is a designated gatekeeper. Each check rests on its own provision:

1. Personal data: where the user is not the data subject, personal data are made available only with a legal basis under Article 6 GDPR and, where relevant, the conditions of Article 9 GDPR and Article 5(3) of the ePrivacy Directive (Article 4(12) and 5(7)); data protection law prevails in a conflict (Article 1(5)).
2. Older sector obligations: the specific obligations of Union acts that entered into force on or before 11 January 2024 remain unaffected (Article 44(1)).
3. Trade secrets: they are disclosed only with agreed confidentiality measures, and a data holder that is the trade secret holder may refuse only in exceptional circumstances where it shows that serious economic damage is highly likely (Article 4(6) to (8) and 5(9) to (11)).
4. Gatekeepers: an undertaking designated under Article 3 of the Digital Markets Act is not an eligible third party, and third parties must not pass data on to it (Article 5(3) and 6(2)(d)).

Supervision follows the same split. The supervisory authorities responsible for the GDPR monitor the application of the Data Act insofar as the protection of personal data is concerned (Article 37(3)), while the competent authorities that each Member State designates under Article 37 cover the other parts.

A programme records, per product or service, which law governs each data flow. The tasks for manufacturers, data holders, cloud providers, users and public bodies are in the step-by-step Data Act compliance programme.

What This Comparison Does Not Cover

This page compares the Data Act with the EU laws it names; it does not explain national data protection acts, privacy laws outside the EU or the European Health Data Space. National legislation adopted in accordance with Union data protection law also prevails in a conflict (Article 1(5)); its content is not covered here.

Other EU product and digital rules, such as those on artificial intelligence and on the cybersecurity of products with digital elements, are separate regulations and are not compared here.

Is the Data Act the EU's Data Protection Law?

No: the GDPR, Regulation (EU) 2016/679, is the EU's data protection law, while the Data Act gives rights to access and use data from connected products and related services, whether personal or not. In a conflict between the two, the data protection law prevails (Article 1(5)). The GDPR row of Table 3 gives the meeting points and the status.

Questions about the Data Act and Other EU Laws

Four short answers on how the Data Act relates to other Union law.

Does the Data Act override older data access rules in Union law?

No: the specific obligations to make data available in Union acts that entered into force on or before 11 January 2024, and in their delegated and implementing acts, remain unaffected (Article 44(1)). The Commission FAQ v1.4 (Q3), a non-binding reading, says that these earlier obligations prevail.

Does the Data Act cover criminal investigations, customs or tax data?

Article 1(6) states that the Data Act does not affect Union or national acts on the sharing of, access to and use of data for preventing, investigating, detecting or prosecuting criminal offences, executing criminal penalties, or customs and taxation purposes. It also does not affect the competences of the Member States concerning public security, defence or national security, or customs and tax administration.

Does the Data Act affect intellectual property rights?

The Data Act is without prejudice to intellectual property law, in particular Directives 2001/29/EC, 2004/48/EC and (EU) 2019/790 (Article 1(8)). Article 43 sets a specific rule for one right: the sui generis right of Article 7 of Directive 96/9/EC does not apply to data obtained from or generated by a connected product or related service within the Data Act's scope.

Does the Data Act change EU competition law?

No: recital 116 states that the Data Act should not affect the competition rules, in particular Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU). Its measures should not be used to restrict competition in a manner contrary to the TFEU.