Data Sharing with Third Parties at the User's Request: Article 5 Data Act and the Gatekeeper Exclusion

The right comes from Regulation (EU) 2023/2854, the EU Data Act, and sits in Chapter II beside the user's own access right.

The Regulation has been in force since 11 January 2024 and has applied since 12 September 2025, also to products already on the market (Art. 50).

What Does Article 5 Require When a User Asks for Data to Be Shared?

Article 5(1) Regulation (EU) 2023/2854 requires the data holder to send the data to the third party the user names, without undue delay, in the same quality the data holder has, easily, securely, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time. Article 5 is a Chapter II right for connected products under the Data Act.

The table maps each paragraph of Article 5 of Regulation (EU) 2023/2854.

Commission readings come from the Commission FAQ and are not binding.

Who Can Ask and Who Can Receive the Data

The request comes from the user or from a party acting on behalf of a user (Art. 5(1)), and the recipient is a third party that becomes a data recipient under Article 2(14). A third party may be a consumer, an enterprise, a research organisation or a not-for-profit organisation (recital 33).

Which Data Reach the Third Party, How and at What Cost

The third party receives readily available data plus the metadata necessary to interpret and use them (Art. 5(1)). Sharing is free of charge to the user; the data holder makes the data available to the third party under Articles 8 and 9, so any compensation is a matter between those two. The boundary of the data is set out under which data the Data Act covers.

Testing Data and Third Parties Established outside the EU

Article 5(1) does not apply to readily available data from testing new connected products, substances or processes not yet placed on the market, unless use by a third party is contractually permitted (Art. 5(2)).

The Commission reads Chapter II as creating no obligation to share with a third party not established in the EU (Commission FAQ v1.4 Q37; "Data Act explained" page),, in line with "data recipients in the Union" (Art. 1(3)(d)); the data holder may still agree.

What Protects the Third Party during the Exchange?

Two rules in Article 5 Regulation (EU) 2023/2854 protect the third party: Article 5(4) limits what the data holder may ask and keep, and Article 5(6) bars the data holder from turning the shared data into market intelligence about the third party. Article 5(4) allows no request for information beyond what verifies the user or third party, and no keeping of access information beyond sound execution of the request and data infrastructure security. Article 5(6) bars insights into the third party's economic situation, assets, production methods or use that could undermine its commercial position, unless it permits them and can easily withdraw that permission.

The Gatekeeper Exclusion of Article 5(3)

Any undertaking designated as a gatekeeper under Article 3 of Regulation (EU) 2022/1925, the Digital Markets Act (DMA), is not an eligible third party under Article 5(3) Regulation (EU) 2023/2854. The exclusion covers the designated undertaking, not only its core platform services. The Commission's evaluation by 12 September 2028 must assess the exclusion of certain categories of enterprises as beneficiaries under Article 5 (Art. 49(1)(d)).

Which Undertakings Are Designated Gatekeepers as of 5 November 2026

As of 5 November 2026, the Commission lists seven designated gatekeepers with 23 core platform services, none of them a cloud computing service.

Commission DMA gatekeepers page, read on 5 November 2026: seven gatekeepers, 23 core platform services, no cloud computing service designated.

Regulation (EU) 2022/1925 presumes gatekeeper status from EUR 7.5 billion Union turnover or EUR 75 billion market capitalisation, with 45 million monthly end users and 10,000 yearly business users (Art. 3(2)). See the Data Act vs the Digital Markets Act.

What a Gatekeeper May Not Do under Points (a) to (c)

Because it is not an eligible third party, a gatekeeper may not use three routes to a user's data (Art. 5(3)):

• Solicit or commercially incentivise a user, including by monetary or other compensation, to make data obtained under Article 4(1) available to one of its services.
• Solicit or commercially incentivise a user to request sharing to one of its services under Article 5(1).
• Receive data that a user obtained under Article 4(1). A third party may not pass Article 5 data to a gatekeeper either (Art. 6(2)(d)).

What Stays Allowed: Voluntary Agreements and Cloud Services

The exclusion removes gatekeepers only from the mandatory mechanisms of Articles 4 and 5: voluntary data-sharing agreements between a gatekeeper and a data holder remain unaffected (recital 40; Commission FAQ v1.4 Q36).

Recital 40 also allows a third party to use data processing services offered by a gatekeeper, but the third party may not subcontract the provision of its service to a gatekeeper.

Which Terms Govern Sharing with the Third Party?

Article 5(1) Regulation (EU) 2023/2854 sends the data holder's terms with the third party into Chapter III: the data are made available in accordance with Article 8 on fair, reasonable and non-discriminatory terms and Article 9 on compensation. The table lists the conditions.

Chapter III Terms and Payment by the Third Party

Chapter III applies to every Article 5 obligation (Art. 12(1)), and a term that excludes or varies it to the detriment of a party or the user is not binding (Art. 12(2)).

Compensation is non-discriminatory and reasonable and may include a margin (Art. 9(1)); an SME or not-for-profit research recipient without non-SME partner or linked enterprises pays at most the Article 9(2)(a) costs (Art. 9(4)). The Commission's draft guidelines on reasonable compensation of 2 February 2026 are not adopted as of 5 November 2026.

Trade Secrets When Data Go to a Third Party

Trade secrets are disclosed to a third party only to the extent strictly necessary for the agreed purpose, under proportionate measures (Art. 5(9)). The data holder may withhold or suspend sharing where measures fail, in writing and with notification (Art. 5(10)), and may refuse only in exceptional circumstances where serious economic damage is highly likely (Art. 5(11)); recital 31 rules out refusal solely because data are a trade secret.

Personal Data in a Third-Party Request

Where the user is not the data subject, personal data go to the third party only with a valid legal basis under Article 6 GDPR and, where relevant, the conditions of Article 9 GDPR and Article 5(3) of Directive 2002/58/EC (Art. 5(7)). The Data Act is no legal basis for processing, and the GDPR prevails in a conflict (Art. 1(5)); see the Data Act vs the GDPR.

How a Third Party Challenges a Withheld or Refused Sharing

A third party that disputes a decision to withhold, suspend or refuse sharing under Article 5(10) or 5(11) can lodge a complaint with the competent authority under Article 37(5)(b) or agree with the data holder to refer the matter to a dispute settlement body under Article 10(1), with courts unaffected (Art. 5(12)).

What the Receiving Third Party May and May Not Do

A third party that receives data under Article 5 may process them only for the purposes and under the conditions agreed with the user and must erase them when no longer necessary, unless otherwise agreed with the user for non-personal data (Art. 6(1) Regulation (EU) 2023/2854). Article 6(2) lists eight prohibitions, points (a) to (h), among them no onward sharing to a gatekeeper (point (d)), no competing product or insights about the data holder (point (e)) and no preventing a consumer user from passing the data on (point (h)). Full duties: data recipients and third parties under the Data Act.

How to Comply with Article 5 Sharing Requests

A data holder meets Article 5 by running six steps for every sharing request and recording each decision.

1. Confirm the role and Article 7(1): data holder obligations, Article 7 for micro and small enterprises.
2. Accept requests from the user or its representative; verify only what Article 5(4) allows.
3. Screen the third party against the gatekeeper list and the non-EU position.
4. Agree Chapter III terms and any compensation.
5. Set trade secret measures and the withhold, suspend or refuse procedure with notification; see the Data Act in Germany for the German form.
6. Deliver data and metadata in the Article 5(1) format, then wall off uses that Article 5(6) forbids.

A term excluding, derogating from or varying the user's Chapter II rights to the user's detriment is not binding on the user (Art. 7(2)).

The Data Act sets no EU fine amount (Art. 40(1)), and GDPR authorities fine personal-data breaches of Chapter II up to the Article 83(5) GDPR amount (Art. 40(4)). As of 5 November 2026, Germany's Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz (DADG) caps fines at EUR 500,000 for Article 5(1) breaches (§ 15(2) No. 2 with § 15(4)) and EUR 5,000,000 for gatekeeper solicitation under Article 5(3)(a) or (b), or 2 % of worldwide total turnover for legal persons above EUR 250 million (§ 15(2) No. 9 with § 15(4) and (5), § 15 DADG); see Data Act penalties and fines.

The other duties of a data holder are set out in the Data Act compliance checklist.

Where Article 5 Sits among the Other Chapter II Rights

Article 5 is the sharing route of Chapter II and works beside four other rules: access under Article 4, design under Article 3(1), information under Article 3(2) and 3(3), and the limit of Article 4(14) on the data holder's own passing on of data.

• Access: the user's right to access data applies beside Article 5.
• Design: data access by design covers products placed on the market after 12 September 2026.
• Information: the Data Act transparency declaration states before the contract how to request sharing (Art. 3(3)).
• Data licence: the data licence agreement governs non-personal product data going to third parties (Art. 4(14)).

As of 5 November 2026, neither the Digital Omnibus proposal COM(2025) 837 nor the Council mandate ST 14756/26 would change Article 5(3) or Article 6. The proposal would extend the Article 5(11) refusal by the same third-country ground it proposes for Article 4(8). Its status is pending: Commission proposal COM(2025) 837 of 19 November 2025, Council mandate agreed by Coreper on 21 October 2026 (ST 14756/26 of 22 October 2026), European Parliament committee stage (ITRE/LIBE, "Awaiting committee decision", no committee vote) as of 5 November 2026; not law (procedure 2025/0360(COD); Data Act amendments).

Questions about Third-Party Sharing under Article 5

Five questions recur.

Does the user pay when data is shared with a third party?

No: Article 5(1) makes sharing free of charge to the user, and any compensation is agreed between the data holder and the third party under Article 9.

Can a gatekeeper still obtain data under a voluntary agreement?

Yes: the Commission FAQ v1.4 (Q36) reads recital 40 as excluding gatekeepers only from the mandatory mechanisms of Articles 4 and 5, so voluntary arrangements remain unaffected.

May a third party use a gatekeeper's cloud service for the shared data?

Yes: recital 40 allows it, but the third party may not subcontract the provision of its service to a gatekeeper.

Must data be shared with a third party established outside the EU?

No: the Commission FAQ v1.4 (Q37) reads Chapter II as not obliging a data holder to give access to an entity not established in the EU; the data holder may still agree.

Does Article 5 apply when the user already has direct access?

Yes: the Commission FAQ v1.4 (Q31) reads Article 5 as applying even where the user has direct access under Article 3(1).