Data Act User Rights: The Article 4 Right of Access

The user's right of access under Article 4 Data Act: who may ask, which data, how fast, in which format, free of charge, and the limits.

The right comes from Regulation (EU) 2023/2854, the EU Data Act, and its 14 paragraphs mostly bind the data holder.

The Regulation has been in force since 11 January 2024 and has applied since 12 September 2025 (Art. 50). Article 4 covers connected products already on the market at that date as well as new units.

This page follows a request in the order of the title: who may ask and for which data, how fast and in which form the answer comes, how the requester is verified, and the four limits. The table summarises the right in eight points.

Point	Rule	Legal basis
Who may ask	Any user: the owner of a connected product, a person with contractually transferred temporary rights to use it, or the recipient of a related service; see who is a user under the Data Act	Art. 2(12)
What data	Readily available product data and related service data, with the metadata needed to interpret and use them	Art. 2(17), Art. 4(1)
How to ask	A simple request through electronic means where technically feasible	Art. 4(1); recital 21
How fast	Without undue delay; the Regulation sets no number of days	Art. 4(1)
Format and cost	Same quality as the data holder has; comprehensive, structured, commonly used and machine-readable; free of charge to the user	Art. 4(1)
Since when	12 September 2025, also for products already on the market	Art. 50
Limits	Safety and security restriction, trade secrets, competing product ban, personal data of other people	Art. 4(2), 4(6) to 4(8), 4(10), 4(12)
Remedies	Complaint to the competent authority or referral to a dispute settlement body; courts remain open	Art. 4(3), 4(9)

What Is the User's Right of Access under Article 4?

The right of access is the user's claim under Article 4(1) Regulation (EU) 2023/2854 to have the data holder make readily available data and the metadata needed to interpret it accessible on a simple request, wherever the connected product or related service does not give the user direct access. Article 4 sits in Chapter II between Article 3 (design and pre-contractual information) and Article 5 (sharing with third parties), the user rules for connected products under the Data Act.

Article 4 has 14 paragraphs; the table shows who each binds and where it is explained.

Paragraph	Rule in one line	Bound party	Explained
4(1)	Access to readily available data and metadata on a simple request	Data holder	This page
4(2)	Contractual restriction for safety and security; notification of refusals	User and data holder	This page
4(3)	Complaint or dispute settlement against a restriction	User (right)	This page
4(4)	No making the exercise of choices or rights unduly difficult	Data holder	This page
4(5)	Verification limited to what is necessary; no excess log data	Data holder	This page
4(6) to 4(9)	Identification of trade secrets, protective measures, withholding, refusal, remedies	Data holder, trade secret holder, user	trade secret safeguards
4(10)	No competing connected product, no insights about the manufacturer or data holder	User	prohibited uses for data recipients and third parties
4(11)	No coercive means and no abuse of gaps in the data holder's technical protection	User	This page
4(12)	Personal data of other people only with a GDPR legal basis	Data holder	the Data Act vs the GDPR
4(13) and 4(14)	Data holder's own use of non-personal data only under a contract with the user	Data holder	the data licence agreement

Who Can Make an Access Request

Any user can make the request: a natural or legal person that owns the connected product, holds contractually transferred temporary rights to use it, or receives a related service (Art. 2(12)). Consumers and businesses qualify alike. The Commission FAQ v1.4 (Q14) adds that a user needs a stable right on the product, so a plane passenger is not a user. The same FAQ (Q15) reads Article 1(3)(b) as requiring that a user be established in the EU; both points are the Commission's non-binding reading.

Which Information a Request Covers

A request covers readily available data: product data and related service data that the data holder lawfully obtains or can lawfully obtain without disproportionate effort going beyond a simple operation (Art. 2(17)). Metadata, "a structured description of the contents or the use of data" (Art. 2(2)), include basic context and a timestamp (recital 15). Raw and pre-processed data are in; information inferred or derived through additional investment is out (recital 15).

Data that the design never stores or transmits outside the generating component are excluded, and no duty to store data centrally exists (recital 20). The Commission FAQ v1.4 reads Chapter II as covering only data generated or collected after 12 September 2025. The full boundary is set out under which data the Data Act covers.

How Must an Access Request Be Answered?

Article 4(1) sets seven conditions for the answer: the data must come without undue delay, in the same quality the data holder has, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time. The table pairs each condition with the Commission's reading and an example.

Condition	Article 4(1) wording	Commission reading (FAQ v1.4 of 22 January 2026)	Practical example
Timing	"without undue delay"	Prompt, timely and responsive; delays only for security, technical or legal constraints and only when proportionate (Q22a)	The portal request is answered promptly, and a security delay is explained
Quality	"of the same quality as is available to the data holder"	As accurate, complete, reliable, relevant and up to date as the data holder's own data (Q22a; recital 30)	The export matches the accuracy and timeliness of the data holder's own feed
Ease	"easily"	n/a	n/a
Security	"securely"	n/a	n/a
Cost	"free of charge"	n/a (the Regulation is explicit)	No fee for the request or the export
Format	"comprehensive, structured, commonly used and machine-readable"	XML, JSON and CSV as examples; licensed formats are not commonly used (Q22a)	JSON, XML or CSV export with metadata
Real-time	"where relevant and technically feasible, continuously and in real-time"	Relevant where low latency is beneficial; feasibility assessed objectively on industry standards (Q22a)	Live telemetry for industrial monitoring

Readings from the Commission FAQ are not binding.

A Simple Electronic Request without Clearance

The user starts access with a simple request through electronic means where technically feasible (Art. 4(1), second sentence). Recital 21 describes a mechanism that grants automatic execution without examination or clearance by the manufacturer or data holder. The Commission FAQ v1.4 (Q17) calls access indirect where the user must ask the data holder, for example through a web portal, which is the Article 4 route. Whether the data sit on the device or on a remote server does not matter (recital 22 of Regulation (EU) 2023/2854).

Without Undue Delay: What a Prompt Answer Means

Article 4(1) requires access without undue delay, and the Commission FAQ v1.4 (Q22a) reads this as prompt, timely and responsive, with delays justified only by security, technical or legal constraints and only when proportionate. The Regulation sets no number of days. A delay therefore needs a reason from one of those three categories, such as a pending security check. The FAQ itself states that it "should not be considered as representative of the European Commission's official position".

Same Quality, Machine-Readable Format and No Charge

The data holder hands over the data in the same quality it has itself, which the Commission reads as equally accurate, complete, reliable, relevant and up to date (FAQ v1.4 Q22a, recital 30). The format is comprehensive, structured, commonly used and machine-readable; the FAQ names XML, JSON and CSV and treats licensed formats as not commonly used. Access is free of charge to the user. Compensation arises only when a third party receives data under Article 5 and pays the data holder under Article 9.

Continuous and Real-Time Access Where Relevant

Continuous and real-time access is owed only where it is relevant and technically feasible (Art. 4(1)). The Commission FAQ v1.4 (Q22a) sees relevance where low latency is beneficial, naming IoT systems, connected mobility and industrial monitoring. Feasibility is assessed objectively, on the basis of industry standards.

How Can the Requester Be Verified without Over-Collecting?

A data holder may check that the requester is a user, but Article 4(5) Regulation (EU) 2023/2854 forbids asking for any information beyond what is necessary for that check. Two duties follow: a limit on what is asked and a limit on what is kept.

Proportionate Identity Checks

The Commission FAQ v1.4 (Q30) names the following factors for designing the check.

Product type of the connected product or related service.
User category: consumer or industrial user.
Request volume: likely users and request frequency.
Ownership proof that already exists, such as a car registration.
Cost of differentiated accounts.
Ease of use.

The FAQ names the EU Digital Identity Wallet as one possible means. The Commission's Data Act FAQ offers these as points to weigh; Article 4(5) stays the binding limit.

Log Data and the Ban on Dark Patterns

Data holders keep no information on the user's access, in particular no log data, beyond what is necessary for the sound execution of the request and for the security and maintenance of the data infrastructure (Art. 4(5), second sentence). Article 4(4) adds that data holders shall not make the exercise of choices or rights unduly difficult, including by offering choices in a non-neutral manner.

When Can Access Be Restricted or Refused?

Four limits apply to the right of access: a contractual restriction for safety and security, the trade secret safeguards, the ban on using the data for a competing connected product, and the GDPR condition for other people's personal data. The table compares the four limits.

Limit	Legal basis	Condition	Data holder's duty	User's remedy	Explained on
Safety and security	Art. 4(2), 4(3)	Processing could undermine security requirements laid down by Union or national law, with a serious adverse effect on the health, safety or security of natural persons	Notify a refusal to the competent authority designated under Art. 37	Complaint under Art. 37(5)(b), see Data Act enforcement; or a dispute settlement body under Art. 10(1), see Data Act dispute settlement bodies	This page
Trade secrets	Art. 4(6) to 4(9)	Protective measures fail, or exceptional circumstances with serious economic damage highly likely	Substantiated decision in writing; notify the competent authority	Complaint or dispute settlement body (Art. 4(9))	trade secret safeguards
Competing product	Art. 4(10)	Use of the data for a competing connected product, sharing with that intent, insights about the manufacturer or data holder	None; the limit binds the user	Contract and courts	prohibited uses for data recipients and third parties
Personal data of others	Art. 4(12)	The user is not the data subject	Assess a GDPR legal basis or provide anonymised data	GDPR remedies	the Data Act vs the GDPR

The Safety and Security Handbrake of Article 4(2)

Users and data holders may contractually restrict or prohibit access, use or further sharing where that processing could undermine security requirements of the connected product laid down by Union or national law and result in a serious adverse effect on the health, safety or security of natural persons (Art. 4(2)). The Commission calls this the "safety and security handbrake" (FAQ v1.4 Q25). Sectoral authorities may provide users and data holders with technical expertise in that context (Art. 4(2), second sentence).

A data holder that refuses to share data under Article 4 notifies the competent authority designated under Article 37. The Regulation sets no number of days for that notification. The data coordinator informs the Commission once a year of the refusals notified under Article 4(2), 4(8) and 5(11) (Art. 37(6)(c)).

Trade Secrets as a Narrow Limit on User Access

Trade secrets are no general ground to refuse access: the data holder identifies protected data and agrees proportionate measures with the user (Art. 4(6)), may withhold or suspend only where measures fail (Art. 4(7)), and may refuse only in exceptional circumstances where serious economic damage is highly likely, case by case (Art. 4(8)). Recital 31 rules out a refusal solely because data are a trade secret and equates serious economic damage with "serious and irreparable economic loss". The written decision and the notification are covered under trade secrets under the Data Act.

What the User May Not Do with the Data

The user may not use data obtained under Article 4(1) to develop a connected product that competes with the product the data come from, share the data with a third party with that intent, or derive insights about the economic situation, assets and production methods of the manufacturer or data holder (Art. 4(10)). Nor may the user use coercive means or abuse gaps in the data holder's technical protection to obtain access (Art. 4(11)).

The ban covers competing connected products only, not related services (Commission FAQ v1.4 Q26; recital 32). Recital 32 accepts that reverse engineering may be lawful, for example for repair, a longer product lifetime or aftermarket services.

Personal Data of Someone Other Than the User

Where the user is not the data subject, the data holder makes personal data available only where a valid legal basis under Article 6 GDPR exists and, where relevant, the conditions of Article 9 GDPR and Article 5(3) of Directive 2002/58/EC are met (Art. 4(12)). The Commission FAQ v1.4 (Q25a) states that the Data Act is not itself a legal basis, so the data holder assesses one, such as a contract with the data subject, or provides anonymised data. The GDPR prevails in a conflict (Art. 1(5)), as how the Data Act and the GDPR overlap explains.

How a User Challenges a Restriction

A user who disputes a safety and security restriction can lodge a complaint with the competent authority under Article 37(5)(b) or agree with the data holder to refer the matter to a dispute settlement body under Article 10(1), without losing the right to go to court (Art. 4(3)). The same routes apply to trade secret decisions (Art. 4(9)).

How Data Holders Comply with Article 4 Requests

A data holder meets Article 4 by running seven steps and keeping a record of each decision.

Confirm the role: control of access to the readily available data decides it, not who produced the hardware or software (Commission FAQ v1.4 Q21); see data holder obligations.
Map the data and metadata for each product.
Publish a request channel that matches the access information given under Article 3(2)(d).
Design the identity check against the FAQ Q30 factors.
Limit access logs to what Article 4(5) allows.
Set a handbrake and trade secret procedure with the authority notification; for the German forms, see the Data Act in Germany.
Check Article 7(1), which takes data from products and related services of micro and small enterprises out of Chapter II, unless they have a partner or linked enterprise that is not micro or small or are subcontracted to make or design the product or provide the service; see Article 7 for micro and small enterprises.

A contractual term that excludes, derogates from or varies the user's Chapter II rights to the user's detriment is not binding on the user (Art. 7(2)).

GDPR supervisory authorities may fine Chapter II infringements within their competence up to the Article 83(5) GDPR amount, EUR 20,000,000 or 4 % of total worldwide annual turnover, whichever is higher (Art. 40(4)).

The Data Act sets no EU-wide fine amount (Art. 40(1)). As of 5 November 2026, Germany's Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz (DADG), in force since 30 May 2026, caps fines at EUR 500,000 for Art. 4(1) breaches (§ 15(2) No. 2 with § 15(4) DADG) and EUR 50,000 for Art. 4(5) breaches (§ 15(2) No. 3 with § 15(4) DADG), while the Art. 4(2) notification is not an offence (§ 15 DADG; Data Act penalties and fines).

The other duties of a data holder are set out in the Data Act compliance checklist.

Where Article 4 Sits among the Other Chapter II Rights

Article 4 works beside four connected rules in Chapter II: access by design under Article 3(1), pre-contractual information under Article 3(2) and 3(3), sharing with third parties under Article 5, and the data holder's own use of the data under Article 4(13) and 4(14).

Design: Article 3(1) covers products placed on the market after 12 September 2026; see data access by design.
Information: Article 3(2)(d) requires stating before the contract how the user may access the data; see the Data Act transparency declaration.
Sharing: Article 5 applies even where the user has direct access (Commission FAQ v1.4 Q31); see data sharing with third parties.
Own use: non-personal data only under a contract with the user, with no onward making available beyond it; see the data licence agreement.

As of 5 November 2026, neither the Digital Omnibus proposal COM(2025) 837 nor the Council mandate ST 14756/26 would change Article 4(1).

The proposal would extend the Article 4(8) refusal to a high risk of unlawful acquisition, use or disclosure to third-country entities or to EU entities under their control. Its status is pending: Commission proposal COM(2025) 837 of 19 November 2025, Council mandate agreed by Coreper on 21 October 2026 (ST 14756/26 of 22 October 2026), European Parliament committee stage (ITRE/LIBE, "Awaiting committee decision", no committee vote) as of 5 November 2026; not law (procedure 2025/0360(COD); Data Act amendments).

Article 4 Access Questions

Five questions recur about Article 4 access requests.

Does the user pay for access under Article 4?

No: Article 4(1) makes access free of charge to the user, and only a third party that receives data under Article 5 compensates the data holder under Article 9.

Is there a fixed deadline for answering an access request?

No number of days applies: Article 4(1) requires access without undue delay, which the Commission FAQ v1.4 reads as prompt, timely and responsive.

Does Article 4 apply to products placed on the market before 12 September 2025?

Yes: Article 4 has applied since 12 September 2025 to connected products already on the market as well as new units, while Article 3(1) covers only products placed on the market after 12 September 2026 (Art. 50); the Commission FAQ v1.4 (Q22) reads it the same way. The Commission reads Chapter II as covering only data generated after 12 September 2025 (see the Data Act timeline).

Can a business user give up the right of access by contract?

Not to its detriment: such a term is not binding on the user (Art. 7(2)). In business-to-business relations a user may waive using or sharing data against proportionate compensation (recital 25; Commission FAQ v1.4 Q19).

Which authority receives a handbrake notification?

The competent authority designated by the Member State under Article 37 receives every Article 4(2) notification. As of 5 November 2026, in Germany the Bundesnetzagentur (§ 2(1) DADG) takes notifications from data holders with their main establishment in Germany through its online form Form02, not by e-mail (Bundesnetzagentur Data Act obligations page).

The User's Right to Access Data under Article 4 Data Act: Requests, Timing, Format and Limits

Summary