Data Act Compliance Checklist: A Step-by-Step Programme by Role for Manufacturers, Data Holders, Cloud Providers, Users and Public Bodies

The Data Act entered into force on 11 January 2024 (Article 50). As a Regulation it is directly applicable in every Member State: national laws only designate the competent authorities and lay down the penalties (Articles 37 and 40). The structure of the EU Data Act itself is explained on the home page.

This checklist fixes scope, role and size first, then gives the dates, the steps for each role and the closing steps on contracts, notifications and enforcement, each with its article.

What a Data Act Compliance Programme Covers

A Data Act compliance programme covers six groups of duties: design and information duties for connected products and related services, access and sharing duties of data holders, contract fairness between enterprises, answers to public-sector requests, switching duties of providers of data processing services, and the interoperability and governance rules of Chapters VIII and IX. The text of Regulation (EU) 2023/2854 has 11 chapters (I to XI), 50 articles and 119 recitals, and no annex. The duties of businesses and public bodies sit in Chapters II to VIII, while Articles 37 and 40 address the Member States, which designate competent authorities and notify their penalty rules.

One organisation often holds two or more roles at once. A manufacturer of a connected product is usually also the data holder for the product data. The roles still separate cleanly for each data set: in the Commission's non-binding reading, a company cannot be user and data holder for the same data (frequently asked questions (FAQ) version 1.4 of 22 January 2026, Q34). No role is exempt from the whole Regulation: Article 7(1) switches off Chapter II only. The table maps each role to its main duties, articles and application date, as of 5 November 2026.

Step 1: Fix Scope, Role and Size before Anything Else

The first step is to establish whether a product is a connected product or a service is a related service or a data processing service, which Data Act role the organisation holds for which data, and whether the micro and small enterprise exemption of Article 7(1) applies. A connected product obtains, generates or collects data on its use or environment and can communicate product data (Article 2(5)). A related service is a digital service connected with the product at purchase, rent or lease so that its absence would prevent one of its functions (Article 2(6)); power supply and connectivity are not related services (recital 17).

The data holder has the right or obligation to use and make available data (Article 2(13)); in the Commission's non-binding reading, whoever controls access to the readily available data holds that role (Commission FAQ version 1.4, Q21). Every term used in these steps is defined under Data Act definitions.

Chapter II does not apply to data from products or related services of a micro or small enterprise (fewer than 10 or 50 persons; turnover or balance sheet not above EUR 2 million or EUR 10 million) without a larger partner or linked enterprise and not subcontracted to make or design them (Article 7(1)); medium-sized enterprises get a one-year window only. A non-EU entity that makes connected products available or offers services in the Union designates a legal representative in one Member State (Article 37(11)); until then every Member State is competent (Article 37(13)).

The Compliance Calendar from 2024 to 2028

Six dates set the order of a Data Act programme: entry into force on 11 January 2024, application on 12 September 2025, access by design for products placed on the market after 12 September 2026, no switching charges from 12 January 2027, Chapter IV for older long-term contracts from 12 September 2027, and the Commission's evaluation by 12 September 2028. Three rules of Article 50 decide what already applies to products and contracts that existed before 12 September 2025:

• Articles 3(2), 3(3), 4, 5 and 6 have applied since 12 September 2025, including to connected products already on the market.
• Chapter VI covers existing and new contracts alike, with no transitional rule.
• Chapter III applies to obligations to make data available under Union or national law that enter into force after 12 September 2025, and to the obligations of Article 5 (Article 12(1)).

Member States had to notify their penalty rules to the Commission by 12 September 2025 (Article 40(2)); Article 37 sets no designation date. The pending Digital Omnibus proposal would not change Article 50 or Article 29; each date with its legal basis sits in the Data Act timeline.

Steps for Makers and Sellers of Connected Devices

Manufacturers of connected products and providers of related services must design products placed on the market after 12 September 2026 so that product data and related service data are accessible to the user by default, easily, securely and free of charge (Article 3(1)), and the seller, rentor or lessor must give the pre-contractual information of Article 3(2) before the contract. The design standard adds a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, direct access. The Article 3(2) information has four minimum items, points (a) to (d), from the seller, rentor or lessor, which may be the manufacturer. A related service provider gives nine items, points (a) to (i) of Article 3(3), including the user's right to complain to the competent authority (point (g)) and whether the prospective data holder holds trade secrets in the data (point (h)).

Placing on the market means the first making available of a connected product on the Union market (Article 2(22)). The manufacturer is usually also the data holder, so the next section applies to it as well.

Steps for Answering Access, Sharing and Public-Sector Requests

A data holder must make readily available product data and related service data available to the user, and at the user's request to a third party, without undue delay, of the same quality as available to the data holder, easily, securely and free of charge for the user (Articles 4(1) and 5(1)). Its own use of readily available non-personal data needs a contract with the user (Article 4(13)), and gatekeepers designated under the Digital Markets Act, Regulation (EU) 2022/1925, are not eligible third parties (Article 5(3)).

Trade secrets are no general refusal ground: a data holder that is a trade secret holder may refuse only in exceptional circumstances where serious economic damage is highly likely (Articles 4(8) and 5(11)), and notifies such refusals to the competent authority without undue delay. Towards data recipients, it shares on fair, reasonable and non-discriminatory (FRAND) and transparent terms, without discriminating against comparable recipients (Article 8(1) and (3)). Compensation may include a margin (Article 9(1)), except that a small or medium-sized enterprise (SME) or not-for-profit research recipient pays at most the costs of making the data available (Article 9(4)). A dispute settlement body decides within 90 days (Article 10(9)).

Public-sector requests are answered without undue delay (Article 18(1)), and the data holder may decline or seek modification within 5 working days for a public emergency or 30 working days for another exceptional need, on three grounds only: no control over the data, a similar request already made for the same purpose, or a request that does not meet Article 17(1) and (2) (Article 18(2)).

Steps for Providers of Data Processing Services

Providers of data processing services, from infrastructure as a service (IaaS) to software as a service (SaaS), must write the switching rights of Article 25 into a written contract, inform customers, remove switching obstacles and stop charging for switching from 12 January 2027 (Articles 23 to 31). The contract sets a notice period of at most two months, a transitional period of at most 30 calendar days (up to seven months where technically unfeasible) and a data retrieval period of at least 30 calendar days (Article 25).

Customers receive switching information and a reference to an online register of formats and standards (Article 26), and the provider's website states the jurisdiction of its information and communication technology (ICT) infrastructure and its measures against international governmental access to non-personal data held in the Union where that access would conflict with Union or national law (Article 28). Functional equivalence binds IaaS providers only (Article 30(1)); other providers make open interfaces available free of charge (Article 30(2)). Custom-built services are exempt only from Articles 23(d), 29 and 30(1) and (3) (Article 31(1)), and Article 32 adds safeguards against international governmental access to non-personal data held in the Union that would conflict with Union or national law.

Steps When You Request or Receive Data

A user of a connected product or related service has the right to access its data and to have it shared with a third party, and in return must not use the data to develop a connected product that competes with the product from which the data originate (Article 4(10)). Contract terms that exclude, derogate from or vary the user's Chapter II rights to its detriment are not binding on the user (Article 7(2)).

A third party that receives data is bound by the eight prohibitions of Article 6(2), points (a) to (h), among them no sharing with a gatekeeper (point (d)) and no use of the data to develop a competing product (point (e)). Complaints go, individually or collectively, to the competent authority of the Member State of the complainant's habitual residence, place of work or establishment (Article 38(1)).

Steps for Requests Made by Public Sector Bodies

A public sector body, the Commission, the European Central Bank or a Union body may request data from a data holder only on the basis of an exceptional need, either to respond to a public emergency or, for non-personal data only, to carry out a specific task in the public interest explicitly provided for by law (Articles 14 and 15). A request carries 10 content items and 9 form items, including the Article 40 penalties (Article 17(1) and (2)), and the data coordinator of the requester's Member State publishes it online (Article 17(2)(g)).

Micro and small enterprises are exempt only from requests for specific public-interest tasks under Article 15(1)(b), not from public-emergency requests (Article 15(2)). Data holders other than micro and small enterprises provide emergency data free of charge; other needs are compensated at cost plus a reasonable margin (Article 20(1) and (2)). The Commission has not published the Article 17(6) model request template as of 5 November 2026, and the pending Digital Omnibus proposal would change Chapter V.

Contracts, Records and Enforcement Readiness for Every Role

Every role closes its programme with three readiness steps: reviewing data contracts against the unfair-terms rules of Article 13, keeping the notifications and declarations the Regulation requires, and knowing which national authority supervises it and which penalties apply. Article 13 protects any enterprise on which a term is unilaterally imposed, with a black list of 3 terms (Article 13(4)) and a grey list of 7 (Article 13(5)), on the dates in the calendar above.

The Data Act sets no EU fine amount: Member States lay down effective, proportionate and dissuasive penalties (Article 40(1) and (3)). Data protection supervisory authorities may impose fines up to the amount of Article 83(5) of the General Data Protection Regulation (GDPR) for Chapters II, III and V only, within their competence (Article 40(4)). A data coordinator is needed only where a Member State designates more than one competent authority (Article 37(2)).

Notifications, Declarations and Records the Regulation Requires

The Data Act requires specific notices and declarations from specific roles, each tied to its article. Data holders notify the competent authority of handbrake refusals, withholdings and suspensions (Articles 4(2), 4(7), 4(8), 5(10) and 5(11)). Providers of custom-built or test services give the Article 31(3) notice, and every provider of data processing services maintains the online register reference of Article 26(b).

Vendors of applications using smart contracts carry out a conformity assessment and issue an EU declaration of conformity (Article 36(2) and (3)); no notified body is involved and no CE marking applies. Participants in data spaces that offer data or data services meet the 4 essential requirements of Article 33(1). No presumption of conformity under Article 33(3) or 36(4) is available as of 5 November 2026.

Instruments Still Pending or in Draft as of 5 November 2026

Three instruments that change how a programme is run are not yet law or final guidance as of 5 November 2026:

• The Digital Omnibus proposal COM(2025) 837 of 19 November 2025 is pending (Council mandate agreed by Coreper on 21 October 2026; European Parliament at committee stage). It would not change Article 7, 29 or 50, and it would delete Article 36.
• The model contractual terms and the cloud standard contractual clauses are a draft Recommendation approved by Commission Communication C(2025) 7750 of 19 November 2025, with formal adoption pending.
• The Article 9(5) guidelines on reasonable compensation exist only as the draft of 2 February 2026.

The FAQ version 1.4 is non-binding, and the Data Act Legal Helpdesk says "we aim to provide a response within 15 working days".

What a Data Act Compliance Programme Does Not Replace

A Data Act programme sits beside, not instead of, data protection compliance, sector rules and contract law. How the GDPR, the Data Governance Act and the other laws interact is compared under the Data Act and other EU laws.

Is a Data Act Checklist the Same as a Privacy Checklist?

No: a privacy checklist organises GDPR duties towards data subjects, while a Data Act checklist organises access, sharing, contract and switching duties for product data, related service data and data processing services. Personal data in a Data Act request still needs a GDPR legal basis (Article 1(5)).

Questions about Data Act Compliance

These four answers settle the legal form, the size exemption, the date for existing products and the position of non-EU manufacturers.

Is the Data Act directly applicable or does it need national law?

It is directly applicable: Regulation (EU) 2023/2854 is binding in its entirety in every Member State, and national laws only designate authorities and set penalties. The text and structure are on the official text of Regulation (EU) 2023/2854 page.

Are micro and small enterprises outside the whole programme?

No: Article 7(1) switches off Chapter II only for data from their own products and services, under its partner, linked-enterprise and subcontracting conditions, and a micro or small enterprise can still be a data holder or face public-emergency requests (recital 41, Article 15(2)).

Which date matters for a product already on the market?

12 September 2025: access, sharing and information duties (Articles 3(2), 3(3), 4 and 5) already apply to it, while the design duty of Article 3(1) binds only products placed on the market after 12 September 2026, a test the Commission's FAQ (version 1.4, Q8) applies to each individual product.

Does a non-EU manufacturer need the same programme?

Yes: in the Commission's reading all requirements must be met when the connected product is placed on the EU market (FAQ version 1.4, Q28), and a non-EU entity designates a legal representative in one Member State (Article 37(11)).