Trade Secrets under the Data Act: Identification, Protective Measures, the Handbrake and the Notification Duty

These safeguards sit in Chapter II of Regulation (EU) 2023/2854, the EU Data Act.

The Regulation has been in force since 11 January 2024, and its trade-secret paragraphs have applied since 12 September 2025 (Art. 50), also to connected products already on the market.

This page uses "handbrake" as a short label for withholding, suspending and refusing, after a term used by Germany's Bundesnetzagentur. The table sums up the mechanism in nine points.

Readings of the Commission FAQ (frequently asked questions, version 1.4 of 22 January 2026) are not binding.

How the Data Act Treats Trade Secrets in Shared Product Data

Chapter II of Regulation (EU) 2023/2854 protects trade secrets inside the two sharing rights it creates: access by the user under Article 4 and sharing with a third party under Article 5, each with its own set of trade-secret paragraphs. The same four steps run through both rights, which form the core user rules for connected products under the Data Act.

The table maps each user paragraph to its third-party twin.

What Counts as a Trade Secret and Who Holds It

A trade secret under Article 2(18) is information as defined in Article 2(1) of the Trade Secrets Directive: secret, of commercial value because it is secret, and subject to reasonable steps to keep it secret. Article 2(19) takes the trade secret holder from Article 2(2) of Directive (EU) 2016/943: any natural or legal person lawfully controlling a trade secret, who need not be the data holder.

Article 3(2) of the Directive makes disclosure lawful to the extent that Union or national law requires or allows it, and recital 31 asks that the Data Act be interpreted so as to preserve the protection the Directive affords. The interplay is set out in the Data Act vs the Trade Secrets Directive.

Disclosure Is the Rule, Refusal the Exception

Data holders cannot, in principle, refuse a request solely because the data is considered a trade secret (recital 31). Article 4(6) and 5(9) preserve trade secrets through measures agreed before disclosure, and refusal is reserved for the exceptional case of Article 4(8) and 5(11).

How Are Trade Secrets Identified and Protected before Disclosure?

Before any disclosure, the data holder or, where they are not the same person, the trade secret holder identifies the data protected as trade secrets, including in the relevant metadata, and agrees proportionate technical and organisational measures with the user or third party (Article 4(6) and 5(9) Regulation (EU) 2023/2854). Under Article 4(6), trade secrets are disclosed only where the data holder and the user take all necessary measures prior to the disclosure.

Identifying Protected Data, Including in the Metadata

Identification covers both the data protected as trade secrets and the relevant metadata (Art. 4(6), 5(9)). It comes first because the handbrake of Article 4(7) and 5(10) pauses only the sharing of "data identified as trade secrets". The pre-contractual information already states whether the prospective data holder holds trade secrets in the data and, if not, who does (Art. 3(3)(h)).

Proportionate Technical and Organisational Measures

Article 4(6) and 5(9) name five example measures:

• Model contractual terms.
• Confidentiality agreements.
• Strict access protocols.
• Technical standards.
• Codes of conduct, through their application.

The measures must be proportionate and necessary to preserve the confidentiality of the shared data, under Article 4(6) in particular in relation to third parties. The Commission's model contractual terms are a draft Recommendation approved by C(2025) 7750 of 19 November 2025, with formal adoption pending as of 5 November 2026; the four draft sets are described under Data Act model contractual terms.

The Stricter Test for Disclosure to a Third Party

A third party receives trade secrets only to the extent that disclosure is strictly necessary to fulfil the purpose agreed between the user and the third party (Art. 5(9)). Article 4(6) sets no such purpose test for the user, and Article 5(9) asks the data holder to agree "all" proportionate technical and organisational measures with the third party.

When Can Sharing Be Withheld or Suspended?

A data holder may withhold or suspend the sharing of data identified as trade secrets under Article 4(7) and 5(10) Regulation (EU) 2023/2854 when the agreed measures fail; with the refusal option, this is the mechanism the Bundesnetzagentur calls the "Geschäftsgeheimnis-Handbremse" (trade secret handbrake).

Three Triggers for Withholding or Suspending

Three situations allow the handbrake under Article 4(7) and 5(10):

• No agreement: the parties do not agree on the necessary measures.
• No implementation: the user or third party fails to implement the agreed measures.
• Undermined confidentiality: the user or third party undermines the confidentiality of the trade secrets.

The data holder may "withhold or, as the case may be, suspend" sharing: withholding fits the first trigger, and suspension fits the other two.

A Substantiated Written Decision without Undue Delay

The decision must be duly substantiated and provided in writing to the user or third party without undue delay (Art. 4(7), 5(10)). The Regulation sets no number of days. In the same step the data holder notifies the competent authority designated under Article 37.

When Can a Trade Secret Holder Refuse Access Altogether?

Only a data holder who is itself the trade secret holder may refuse a request for specific data, and only in exceptional circumstances where it demonstrates that it is highly likely to suffer serious economic damage despite the measures taken by the user or third party (Article 4(8) and 5(11) Regulation (EU) 2023/2854).

Serious Economic Damage, Highly Likely, Case by Case

Serious economic damage implies serious and irreparable economic loss (recital 31). The refusal is decided on a case-by-case basis for the specific data in question (Art. 4(8), 5(11)), and the damage must be highly likely despite the measures taken by the user under Article 4(6) or the third party under Article 5(9). Recital 31 asks the substantiation to show "the concrete risk of serious economic damage expected to result from a specific data disclosure and the reasons why the measures taken to safeguard the requested data are not considered to be sufficient". The demonstration goes to the user or third party in writing, and a possible negative impact on cybersecurity can be taken into account (recital 31).

Objective Elements That Substantiate a Refusal

The demonstration rests on objective elements, in particular these three (Art. 4(8), 5(11)):

• Enforceability of trade secret protection in third countries.
• Nature and level of confidentiality of the data requested.
• Uniqueness and novelty of the connected product.

The words "in particular" keep the list open. Article 49(1)(f) requires the Commission to evaluate the Regulation by 12 September 2028, including its impact on trade secrets and the refusal mechanism of Article 4(8) and 5(11).

How Is the Competent Authority Notified?

Every withholding, suspension and refusal on trade-secret grounds is notified to the competent authority designated under Article 37, in the Member State where the data holder is established (Art. 4(7), 4(8), 5(10), 5(11), recital 31). The table sets the two decision types side by side.

What Each Notification Must Contain

A withholding or suspension notice states that sharing was withheld or suspended, which measures were not agreed or implemented and, where relevant, which trade secrets had their confidentiality undermined (Art. 4(7), 5(10)). A refusal is notified without a listed content. The data coordinator informs the Commission once a year of refusals notified under Article 4(2), 4(8) and 5(11), not of withholdings or suspensions (Art. 37(6)(c)); a data coordinator is mandatory only where a Member State designates more than one competent authority (Art. 37(2)).

The Bundesnetzagentur Online Forms

As of 5 November 2026, the Bundesnetzagentur, the competent authority under § 2(1) of the Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz (DADG), takes trade-secret notifications from data holders with their main establishment in Germany through its online form Form03, which covers Article 4(7), 4(8), 5(10) and 5(11), not by e-mail. Form02 covers the Article 4(2) safety handbrake and Form10 follow-up submissions, while the Bundesnetzagentur obligations page sends holders with their main establishment in another Member State to that state's data coordinator. The German procedures are covered under the Data Act in Germany.

How a Decision Can Be Challenged

A user or third party that disputes a refusal, withholding or suspension can lodge a complaint with the competent authority under Article 37(5)(b) or agree with the data holder to refer the matter to a dispute settlement body under Article 10(1), without losing the right to go to court (Art. 4(9), 5(12)).

On a complaint, the competent authority decides without undue delay whether and under which conditions data sharing is to start or resume. Article 37(5)(b) names complaints in relation to trade secrets among the authority's tasks.

How to Build a Trade Secret Procedure for Data Requests

A data holder runs the trade-secret mechanism in eight steps and keeps a written record of each one:

1. Confirm who holds the data and who holds the trade secrets; see data holder obligations.
2. Identify the trade-secret data and metadata for each product.
3. State the trade secret holder in the pre-contractual information; see the Data Act transparency declaration.
4. Prepare templates for the confidentiality measures.
5. Set the three triggers and a template for the written decision.
6. Define the refusal test with its objective elements.
7. Route notifications to the competent authority; as of 5 November 2026, in Germany through Form03 for main establishments there.
8. Check whether Article 7(1) applies; see Article 7 for micro and small enterprises.

Article 7(1) takes data from products and related services of micro and small enterprises out of Chapter II, unless they have a partner or linked enterprise that is not micro or small or are subcontracted to make or design the product or provide the service.

The Data Act sets no EU-wide fine amount (Art. 40(1)). As of 5 November 2026, Germany caps fines at EUR 50,000 for breaches of the Article 4(7) or 5(10) notification duty (§ 15(2) No. 4 with § 15(4) DADG) and of the written demonstration under the second sentence of Article 4(8) or 5(11) (§ 15(2) No. 5 with § 15(4) DADG) (§ 15 DADG; Data Act penalties and fines).

The other duties of a data holder are set out in the Data Act compliance checklist.

What the Pending Omnibus Proposal Would Change for Trade Secrets

The Digital Omnibus proposal COM(2025) 837 of 19 November 2025 would replace Article 4(8) and 5(11) with a wider refusal ground, and as of 5 November 2026 it is pending: Council mandate agreed by Coreper on 21 October 2026 (ST 14756/26 of 22 October 2026), European Parliament at committee stage with no committee vote. The Commission proposal (procedure 2025/0360(COD)) is not law.

The Proposed Third-Country Refusal Ground

The proposal would let a trade secret holder also refuse where disclosure poses a high risk of unlawful acquisition, use or disclosure to third-country entities, or to entities in the Union under their direct or indirect control, subject to jurisdictions offering weaker or non-equivalent protection. It would also replace "in particular" with "such as" before the objective elements.

Proposed recital 12 would keep refusals tailored to each case, not applied systematically across an entire third country, with no full-scale third-country analysis required. Proposed recital 13 would read control as decisive or dominant influence, possible even without majority ownership.

What the Council Mandate Adds

The Council mandate ST 14756/26 inserts further text into the proposed Article 4(8) and 5(11): the word "significant" in relation to the risk, a reference to trade secrets representing industrial manufacturing know-how for entities in listed sectors, a duty to notify "all instances of refusal" to the competent authority every three months, and Commission guidelines, in consultation with the European Data Innovation Board, on serious economic damage, critical economic sectors, third-country enforceability and control by third-country entities.

The Council mandate also contains replacement text for Article 4(6) and 5(9). The full procedure is tracked under Data Act amendments.

Where the Trade Secret Safeguards Sit among Other Data Act Rules

The trade-secret paragraphs connect to five other rules of the Regulation, from the rights they limit to the duties of public sector bodies:

• Rights: the access and sharing rights of Article 4 and 5; see the user's right of access and data sharing with third parties.
• Third-party duties: no onward sharing without a contract with the user and the agreed measures, and no disregard of the Article 5(9) measures (Art. 6(2)(c), (g)); see prohibited uses for data recipients and third parties.
• Business-to-business (B2B) rule: an obligation to make data available does not oblige the disclosure of trade secrets, unless Union law, including Article 4(6) and 5(9), or national law provides otherwise (Art. 8(6)); see B2B data sharing under the Data Act.
• Remedies: the misuse remedies also apply where a user does not maintain the agreed measures (Art. 11(4); B2B data sharing under the Data Act).
• Public sector: bodies that receive data in business-to-government sharing protect trade secrets (Art. 19); see B2G data sharing.

The Article 4(2) safety handbrake is a separate mechanism.

Questions about Data Act Trade Secrets

Five questions recur about the trade-secret mechanism.

Can access be refused only because the data is a trade secret?

No: a data holder cannot, in principle, refuse solely on that ground (recital 31). A refusal needs the Article 4(8) or 5(11) test of highly likely serious economic damage.

Is there a fixed deadline for the written decision?

No number of days applies: the decision or demonstration goes to the user or third party in writing without undue delay (Art. 4(7), 4(8), 5(10), 5(11)).

Does the handbrake apply to data the user can access directly?

The Commission FAQ v1.4 (Q24) reads the statutory handbrake as not applying to data made directly accessible by design; protection there rests on contract, within Article 7(2). The Commission's FAQ is not binding; direct access is explained under data access by design.

Who receives a withholding or refusal notification?

The competent authority designated under Article 37 in the Member State where the data holder is established (recital 31). As of 5 November 2026, in Germany the Bundesnetzagentur takes it through Form03 from data holders with their main establishment in Germany.

Has the Digital Omnibus already changed the trade secret rules?

No: as of 5 November 2026 COM(2025) 837 is pending, and Article 4(6) to 4(9) and 5(9) to 5(12) still apply in their 2023 wording. Under the proposal, the amendments would enter into force on the third day after publication in the Official Journal, with no separate application date.