EU Data Act Guide
  1. Home
  2. Data Act and other laws
  3. The Data Act vs the GDPR

Data Act and other laws

The Data Act vs the GDPR: Scope, Overlaps and Which Rule Prevails

How the EU Data Act and the GDPR fit together: Article 1(5) prevalence, no legal basis, mixed datasets, portability and the two supervisors.

Last updated 5 November 2026 · By the EU Data Act Guide Editorial Team · How statements are checked · Print this page

Summary

The Data Act and the General Data Protection Regulation (GDPR) apply side by side to connected-product data: the Data Act decides who may access and share product data, personal or not, while the GDPR governs the personal data among them and prevails in a conflict (Art. 1(5) Data Act).

The comparison sets Regulation (EU) 2023/2854, the EU Data Act, beside Regulation (EU) 2016/679, the GDPR.

The Data Act has been in force since 11 January 2024 and has applied since 12 September 2025 (Art. 50). The GDPR has applied since 25 May 2018 (Art. 99(2) GDPR).

The table compares the two Regulations on nine points.

Point Data Act GDPR Example
Identity Regulation (EU) 2023/2854 of 13 December 2023, CELEX 32023R2854 Regulation (EU) 2016/679, CELEX 32016R0679 n/a
Dates In force 11 January 2024; applies since 12 September 2025 (Art. 50) In force 24 May 2016 (Art. 99(1)); applies since 25 May 2018 (Art. 99(2)) n/a
Data covered Personal and non-personal data (Art. 1(2)) Personal data only Vehicle telemetry stored with a driver profile
Key person The user: owner, holder of contractually transferred temporary rights of use, or recipient of a related service (Art. 2(12)); see who is a user under the Data Act The data subject (Art. 4(1) GDPR, adopted by Art. 2(11) Data Act) A fleet operator as user and its drivers as data subjects
Key duty Make product and related service data accessible and shareable on request (Arts 4 and 5) Process personal data only on a legal basis (Art. 6 GDPR) Releasing driving data to a repair shop
Definitions "Personal data" and "non-personal data" by reference to the GDPR (Art. 2(3), 2(4)); see Data Act definitions "Personal data" in Art. 4(1) GDPR n/a
Conflict Yields to data protection law (Art. 1(5)) Prevails n/a
Supervision Competent authorities (Art. 37(1)); GDPR supervisory authorities for personal data (Art. 37(3)) GDPR supervisory authorities n/a
Fines No Union-wide amount (Art. 40(1)); GDPR supervisory authorities up to the Art. 83(5) GDPR amount for Chapters II, III and V (Art. 40(4)) Art. 83(5) tier: up to EUR 20,000,000 or, for an undertaking, 4 % of total worldwide annual turnover of the preceding financial year, whichever is higher n/a

How Far Does Each Law Reach? Personal Data and Product Data

The GDPR covers personal data only, while the Data Act covers personal and non-personal data alike (Art. 1(2) Regulation (EU) 2023/2854), so the two laws overlap wherever product data or related service data relate to a natural person. Chapter II covers data concerning the performance, use and environment of connected products and related services, with the exception of content (Art. 1(2)(a)), and in a vehicle much of it describes the driver. This overlap is one of six covered on the hub for the Data Act and other EU laws.

Personal and Non-Personal Data in One Regulation

The Data Act borrows its personal-data vocabulary from the GDPR: "personal data" means personal data as defined in Article 4, point (1), GDPR (Art. 2(3) Data Act), and "non-personal data" means data other than personal data (Art. 2(4)). "Data subject" (Art. 2(11)) and "profiling" (Art. 2(20)) also take their meaning from Article 4 GDPR. The Data Act "user", by contrast, is the natural or legal person that owns a connected product, to whom temporary rights to use it have been contractually transferred, or that receives related services (Art. 2(12)). A company can therefore be the user while its employees are the data subjects.

Who Is the Controller When Product Data Are Personal

Where the user is an enterprise, including a sole trader, and not in cases of shared household use of the connected product, recital 34 Data Act treats that user as a controller for the personal data of others. A processor as defined in Article 4, point (8), GDPR is not considered to act as a data holder, although the controller can task it with making data available (recital 22). The data holder role and the controller role are therefore assessed separately. The Commission's frequently asked questions (FAQ) on the Data Act, version 1.4 of 22 January 2026 (Q25b), add that each controller must demonstrate its own compliance and share only strictly necessary information.

Which Rule Prevails When the Two Laws Conflict?

Data protection law prevails: in the event of a conflict between the Data Act and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with it, the data protection rule applies (Art. 1(5) Regulation (EU) 2023/2854). Article 1 also sets the scope and addressees explained on who the Data Act applies to.

The Prevalence Rule of Article 1(5)

Article 1(5) works in three sentences. The first makes the Data Act without prejudice to the GDPR, Regulation (EU) 2018/1725 (Official Journal L 295 of 21 November 2018, p. 39) and Directive 2002/58/EC, the ePrivacy Directive; the second makes Chapter II rights complement the GDPR rights of access and portability where users are data subjects; the third reads: "In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with such Union law, the relevant Union or national law on the protection of personal data or privacy shall prevail."

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) asked for that explicit clause in Joint Opinion 2/2022 of 4 May 2022, to which recital 118 refers. Recital 31 adds that the Data Act's exceptions to access rights should not in any case limit the right of access and the right to data portability of data subjects under the GDPR.

The Data Act is not a legal basis for the collection or generation of personal data by the data holder, and where the user is not the data subject it creates no legal basis for providing access to personal data or making them available to a third party (recital 7). In that case, Article 4(12) and Article 5(7) allow personal data to be made available only on a valid Article 6 GDPR basis and, where relevant, under the conditions of Article 9 GDPR and Article 5(3) Directive 2002/58/EC, as set out under the user's right to access data.

The Commission FAQ v1.4 (Q25a) adds that the Data Act is no legal basis in the sense of Article 6(1) GDPR, including Article 6(1)(c); the data holder assesses another basis, such as a contract with the data subject or legitimate interest, or provides anonymised data.

Mixed Datasets with Inextricably Linked Data

Where personal and non-personal data in one dataset are inextricably linked, the GDPR rules apply to the processing (recital 34 Data Act). The Commission FAQ v1.4 (Q1) states the wider principle: "The General Data Protection Regulation (GDPR) is fully applicable to all personal data processing activities under the Data Act." A mixed export, such as engine telemetry stored with a driver identifier, is therefore handled as personal data, while the Data Act duty to give access stays in place.

Two Portability Rights Compared: GDPR and Data Act

Article 20 GDPR and the Data Act access and sharing rights both move data at the request of the person concerned, but the Data Act right reaches all product and related service data, personal or not, whatever the legal basis of processing, and its technical feasibility is ensured (recital 35 Regulation (EU) 2023/2854). The table compares the two rights on eight features.

Feature Art. 20 GDPR Data Act Arts 4 and 5 Legal basis
Data covered Personal data the data subject has provided to a controller Any product data or related service data, irrespective of their nature as personal data Art. 20(1) GDPR; recital 35
Provided or observed Provided by the data subject Actively provided or passively observed alike Art. 20(1) GDPR; recital 35
Legal basis of the processing Consent (Art. 6(1)(a) or 9(2)(a) GDPR) or contract (Art. 6(1)(b) GDPR), carried out by automated means Irrespective of the legal basis Art. 20(1) GDPR; recital 35
Technical feasibility Direct transmission between controllers "where technically feasible" Mandated and ensured Art. 20(2) GDPR; recital 35
Cost n/a Free of charge to the user; reasonable compensation only from third parties, never from the user; see reasonable compensation for data sharing Art. 4(1), Art. 9; recital 35
Format n/a Format requirement modelled after Art. 20 GDPR (Commission FAQ v1.4 Q22a) Art. 4(1)
Special categories n/a A contract does not allow their processing by the data holder or the third party Recital 35
Safeguard n/a Failed transmission arrangements do not hinder Art. 20 GDPR; no profiling by the third party unless necessary for the requested service Art. 5(8), Art. 6(2)(b)

Readings from the Commission FAQ are not binding.

What the Data Act Adds to Portability

Article 20(1) GDPR covers only personal data the data subject has provided, processed on consent or contract by automated means, and Article 20(2) requires direct transmission only where technically feasible. Recital 35 Data Act lifts each of these limits for connected-product data. The Commission FAQ v1.4 (Q18) calls the result "an enhanced portability right specifically for the IoT context", IoT meaning the Internet of Things. Where the user is the data subject, the Commission compares an Article 4 request with an Article 15 GDPR access request and an Article 5 request with an Article 20 GDPR portability request (Q25a).

Safeguards for Data Subjects in Third-Party Sharing

A failure of the data holder and the third party to agree on transmission arrangements does not hinder the data subject's right to data portability under Article 20 GDPR (Art. 5(8) Data Act). The third party, notwithstanding Article 22(2), points (a) and (c), GDPR, may not use the data for profiling unless that is necessary to provide the service the user requested (Art. 6(2)(b)). Both safeguards belong to the rules on data sharing with third parties.

Recital 35 closes a further gap: a contract does not allow the data holder or the third party to process special categories of personal data.

Who Supervises Personal Data under the Data Act?

The GDPR supervisory authorities monitor the application of the Data Act insofar as the protection of personal data is concerned, with Chapters VI and VII GDPR applying mutatis mutandis, and the European Data Protection Supervisor does so for the Commission, the European Central Bank and Union bodies (Art. 37(3) Regulation (EU) 2023/2854). Every other Data Act matter falls to the competent authorities each Member State designates under Article 37(1), and a data coordinator is required only where a Member State designates more than one (Art. 37(2)).

For infringements of Chapters II, III and V, the GDPR supervisory authorities may, within their competence, fine up to the Article 83(5) GDPR amount: EUR 20,000,000 or, for an undertaking, 4 % of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 40(4)). The Data Act itself sets no Union-wide fine amount (Art. 40(1)); national levels sit beside the GDPR fine link on the penalties page.

The table sets out each body's basis, remit and fines.

Body Data Act basis Remit Fines
Competent authority; see Data Act competent authorities Art. 37(1) Application and enforcement of the Data Act outside the personal-data remit National penalties (Art. 40(1))
Data coordinator Art. 37(2) Only where a Member State designates more than one competent authority n/a
GDPR supervisory authority Art. 37(3), first subparagraph Protection of personal data; Chapters VI and VII GDPR apply mutatis mutandis Art. 40(4) route for Chapters II, III and V
European Data Protection Supervisor Art. 37(3), second subparagraph Commission, European Central Bank, Union bodies Chapter V, under Art. 66 Regulation (EU) 2018/1725 (Art. 40(5))
Germany, as of 5 November 2026 § 2(1) and § 3(1) DADG Bundesnetzagentur: competent authority; BfDI: personal data at non-public bodies BfDI imposes the Art. 40(4) fines (§ 16 DADG)

Data Protection Authorities beside the Competent Authority

The Commission FAQ v1.4 (Q2) lists three points a data protection authority assesses: whether a user who is the data subject received, or could port, all requested personal data; whether the data holder correctly qualified data as personal; and whether a user who is not the data subject has a valid GDPR legal basis.

The EDPB and the EDPS had asked in Joint Opinion 2/2022 for the data protection authorities to be the coordinating competent authorities, which the Regulation did not adopt (Art. 37(2)).

How Germany Allocates the Two Supervisory Roles

As of 5 November 2026, Germany's Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz (DADG) makes the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, BfDI) the Article 37(3) authority for non-public bodies (§ 3(1) DADG), by derogation from § 40(1) Bundesdatenschutzgesetz (BDSG), beside the Bundesnetzagentur as competent authority (§ 2(1) DADG). As of that date, the Bundesnetzagentur is bound by the BfDI's assessment of the lawfulness of personal-data processing (§ 3(5) DADG), and the BfDI imposes the Article 40(4) fines as regards personal data (§ 16 DADG, BGBl. 2026 I Nr. 157).

The Bundesnetzagentur's data protection page assigns federal public bodies to the BfDI and Länder public bodies to the Länder data protection authorities under Land law, as of 5 November 2026. The full German allocation is on the Data Act in Germany.

One Programme for Both Laws: Steps That Serve the GDPR and the Data Act

One programme covers both laws when every connected-product dataset is classified once, every release of personal data is checked against a GDPR legal basis, and both supervisors are mapped. Seven steps put that programme into practice:

  1. Classify each data point as personal or non-personal, treating inextricably linked data as personal (recital 34).
  2. Record per dataset whether the user is the data subject or an enterprise acting as controller, using the Data Act definitions.
  3. Document the Article 6 GDPR basis and any Article 9 GDPR conditions before releasing personal data to a user who is not the data subject or to a third party, or release anonymised data (Art. 4(12), 5(7)).
  4. Run one intake for Article 15 and 20 GDPR requests and Article 4 and 5 Data Act requests (FAQ v1.4 Q25a).
  5. Keep Article 20 GDPR transmission open when third-party arrangements fail (Art. 5(8)).
  6. Write the profiling limit and the special-categories rule into third-party terms (Art. 6(2)(b); recital 35).
  7. Map the competent authority and the data protection authority in each Member State of activity, starting from the Data Act competent authorities.

A Data Act exception, such as a trade secret refusal, never shortens the GDPR side of the programme (recital 31).

The reverse holds too: because data protection law prevails (Art. 1(5)), a ground that blocks a release under the GDPR, such as a missing Article 6 basis, also blocks the Data Act release.

The other Data Act duties by role are set out in the Data Act compliance checklist.

Where the GDPR Comparison Sits among the Other Comparisons

The GDPR is one of six EU laws the Data Act meets head-on, and each of the other five has its own comparison:

  • Data intermediation services: the Data Act vs the Data Governance Act.
  • The terminal equipment condition: the Data Act vs the ePrivacy Directive.
  • The gatekeeper exclusion: the Data Act vs the Digital Markets Act.
  • The trade secret definition: the Data Act vs the Trade Secrets Directive.
  • The sui generis database right: the Data Act vs the Database Directive.

Article 1(5) has not been amended as of 5 November 2026. The Digital Omnibus proposal COM(2025) 837 would not amend Article 37; it would replace Article 38, add an Article 40(6) under which Article 40 would not apply to the proposed Chapter VIIc, and add an Article 88a GDPR on terminal equipment. Its status is pending: Commission proposal COM(2025) 837 of 19 November 2025, Council mandate agreed by Coreper on 21 October 2026 (ST 14756/26 of 22 October 2026), European Parliament committee stage (ITRE/LIBE, "Awaiting committee decision", no committee vote) as of 5 November 2026; not law.

The EDPB-EDPS Joint Opinion 2/2026 of 10 February 2026 recommends keeping the statement that the proposed re-use framework creates no obligation to allow re-use of personal data and no legal basis, and re-inserting the current Article 38(3), and it calls the Article 37 allocation ambiguous (paras 163 to 165). The pending changes are tracked under Data Act amendments.

Questions about the Data Act and the GDPR

Five questions recur about how the Data Act and the GDPR fit together.

Does the Data Act override the GDPR?

No: in a conflict, Union or national law on the protection of personal data or privacy prevails over the Data Act (Art. 1(5), third sentence).

No: the Data Act creates no legal basis for processing personal data (recital 7); a release to a user who is not the data subject, or to a third party, needs an Article 6 GDPR basis (Art. 4(12), 5(7)).

Does the Data Act replace the right to data portability?

No: insofar as users are data subjects, Chapter II rights complement the GDPR rights of access and portability (Art. 1(5), second sentence), and Article 5(8) protects Article 20 GDPR transmission.

Can a data protection authority impose GDPR-level amounts under the Data Act?

Yes, for infringements of Chapters II, III and V within its competence: Article 40(4) lets it fine up to the Article 83(5) GDPR amount, while the Data Act sets no Union-wide amount of its own (Art. 40(1)).

Does the Data Act cover only non-personal data?

No: it covers personal and non-personal data (Art. 1(2)); only Chapter VII is limited to non-personal data held in the Union by providers of data processing services (Art. 1(2)(f)).

Sources