Data Act Implementation by Country: Competent Authorities, Data Coordinators, Penalty Laws and Status in the 27 Member States and the EEA

Regulation (EU) 2023/2854 entered into force on 11 January 2024 and has applied since 12 September 2025 (Art. 50). National implementing acts only fill the enforcement tasks it leaves open. How the rest of the EU Data Act is built is explained on the home page.

This page sets out those tasks, gives one row per country for the 27 Member States, the EEA EFTA states, Switzerland and the United Kingdom, explains each status entry and the Commission registers, and answers four questions.

What the Data Act Leaves to the Member States

The Data Act leaves three tasks to the Member States: designating one or more competent authorities (Article 37(1)), designating a data coordinator where more than one authority is designated (Article 37(2)), and laying down penalty rules and notifying them to the Commission (Article 40(1) and (2)). Member States may establish new authorities or rely on existing ones (Art. 37(1)), and Article 37 sets no date by which they must be designated. The data coordinator facilitates cooperation between the competent authorities and assists entities in scope (Art. 37(2)). Insofar as personal data is concerned, the supervisory authorities under the General Data Protection Regulation (GDPR) monitor the application of the Data Act (Art. 37(3)).

Penalties must be "effective, proportionate and dissuasive" (Art. 40(1)), and the Data Act sets no EU fine amount. Member States had to notify their penalty rules to the Commission "by 12 September 2025" and must notify later amendments "without delay" (Art. 40(2)), a notification deadline, not a designation deadline.

The obligations of the Regulation apply even where no national authority or penalty rule is in force, because they rest on the Regulation, not on national enforcement law. GDPR supervisory authorities may still, within their competence, fine infringements of Chapters II, III and V up to the amount in Article 83(5) GDPR (Art. 40(4)); Chapters IV and VI fall outside that route. What the authorities do, how complaints work and the EU board are explained under Data Act enforcement: competent authorities, data coordinators and complaints.

Need help with the Data Act in a specific country?

National Implementation Status by Country as of 5 November 2026

The two tables below give one row per country, with the status of the national implementation act or bill, its reference and the authority it names, as of 5 November 2026. A cell reads "Not yet confirmed" until its national source has been checked for this page; the country page link sits in the first column.

The 27 EU Member States

Table 1 lists the 27 Member States in alphabetical order, each linked to its own page. The Regulation has applied directly in each since 12 September 2025, whatever the row says. As of 5 November 2026, Denmark, Finland, Germany and the Netherlands appear with an act in force, Malta with a legal notice in force, and France, Luxembourg and Poland with a pending bill.

National implementation of Regulation (EU) 2023/2854 as of 5 November 2026.

EEA States, Switzerland and the United Kingdom

As of 5 November 2026 the Data Act has not been incorporated into the EEA Agreement, and no EEA Joint Committee Decision exists, so it does not apply as such in Norway, Iceland or Liechtenstein. Companies there, in Switzerland and in the United Kingdom are reached as non-EU entities when they place connected products on the Union market or provide related services (Art. 1(3)(a)), make data available to recipients in the Union (Art. 1(3)(c)) or provide data processing services to Union customers (Art. 1(3)(f)). One EEA-Lex record covers all three EEA EFTA states; Iceland and Liechtenstein have a row but no page.

What Each Status Entry Means and How It Was Checked

Each row records the national position as of 5 November 2026 in one of these forms: an act in force, a bill before parliament with its stage, a government decision or an authority's own statement, or the entry "Not yet confirmed" where the national source has not yet been checked for this page. Each entry rests on a national gazette, parliament or authority:

• Act in force: a published statute, such as the Danish datadelingsloven, shown as "Valid" on Retsinformation, the Danish legal database, as of 5 November 2026.
• Bill: never law. As of 5 November 2026, the French DDADUE bill is at committee stage in the Assemblée nationale, Luxembourg bill n° 8809 is "En commission" at the Chamber of Deputies, and Polish Sejm print 3266 has been referred for first reading in committee.
• Government decision or authority statement: as of 5 November 2026, a Swedish government decision makes PTS the competent authority for 2025 and 2026, and the Lithuanian RRT states that it is the competent authority.
• Ireland: no Data Bill appears among the 2026 bills of the Oireachtas, the Irish parliament, as of 5 November 2026.

A status describes national enforcement only: the duties of manufacturers, data holders and cloud providers apply in every Member State without a national act, so compliance starts from the Regulation. The steps for each role are set out in the Data Act compliance checklist by role.

Rows are rechecked whenever a national act, bill or EU change moves. The Digital Omnibus proposal, COM(2025) 837 of 19 November 2025, would amend the Data Act; as of 5 November 2026 it is pending, with a Council mandate agreed by Coreper on 21 October 2026 and the European Parliament at committee stage.

Is There an Official EU List of National Authorities and Penalty Rules?

The Data Act requires two Commission registers: a public register of the competent authorities and data coordinators that Member States notify (Article 37(7)), and an easily accessible public register of the national penalty measures, regularly updated (Article 40(2)). Recital 107 of the Regulation adds that competent authorities and data coordinators "should be identified in a public register maintained by the Commission".

As of 5 November 2026, the Commission's Data Act policy page, last updated on 5 November 2026, links no register of authorities, data coordinators or penalty measures, so each row in the tables above cites the national gazette, parliament or authority instead. The Commission must evaluate the Regulation by 12 September 2028, including "the efficacy of the enforcement regime required under Article 37" (Art. 49(1)(l)). National fine ceilings are compared under Data Act penalties and national fine levels.

National Implementation within the EU Enforcement Framework

National implementation fills only the gaps the Regulation leaves open: the EU rules on complaints, judicial remedies and the European Data Innovation Board apply in the same way in every Member State. A natural or legal person lodges a complaint with the relevant competent authority in the Member State of their habitual residence, place of work or establishment (Art. 38(1)). Article 39 adds a judicial remedy against legally binding decisions of competent authorities, and the European Data Innovation Board (EDIB) acts under Article 42.

Questions about National Implementation of the Data Act

Four questions come up whenever a country's row is checked.

Does the Data Act have to be transposed into national law?

No: the Data Act is a Regulation that has applied directly since 12 September 2025 (Article 50), and national acts only designate the competent authorities and lay down the penalties (Articles 37 and 40). Its entry into force on 11 January 2024 is a separate date, and national acts are implementing acts, not transpositions.

By when did Member States have to notify their penalty rules?

By 12 September 2025, under Article 40(2) of the Data Act, with any later amendment notified without delay. Article 37 sets no date for designating competent authorities, so the 12 September 2025 deadline concerns penalty rules and measures only.

Must every Member State appoint a data coordinator?

No: Article 37(2) of the Data Act requires a data coordinator only where a Member State designates more than one competent authority. Where no data coordinator has been designated, the competent authority assumes the coordinator's tasks (recital 107). A designated coordinator acts as the single point of contact for all issues related to the application of the Regulation (Article 37(6)(a)).

How are companies outside the EU supervised?

A non-EU entity that makes connected products available or offers services in the Union must designate a legal representative in one Member State (Article 37(11)), and until it does it falls under the competence of all Member States, where applicable (Article 37(13)). The reach of the Regulation is explained under the Data Act for non-EU companies and the legal representative.