EU Data Act Guide
  1. Home
  2. B2B Data Sharing under the Data Act

B2B data sharing

B2B Data Sharing under the Data Act: FRAND Terms, Non-Discrimination and Technical Protection Measures

Data Act Chapter III: FRAND terms under Article 8, non-discrimination, Article 11 technical protection measures and which sharing duties are covered.

Last updated 5 November 2026 · By the EU Data Act Guide Editorial Team · How statements are checked · Print this page

Summary

Chapter III of the Data Act, Regulation (EU) 2023/2854, sets the terms on which a data holder obliged by Article 5, by other Union law or by national legislation adopted in accordance with Union law to make data available to a business must do so: fair, reasonable and non-discriminatory (FRAND) terms, a transparent manner, no discrimination between comparable recipients and technical protection measures within Article 11.

Chapter III has been in force since 11 January 2024 and has applied since 12 September 2025, for obligations in other laws only where they enter into force after that date (Article 50). How Chapter III fits into the rest of the EU Data Act is explained on the home page.

This page covers the scope, the Article 8 conditions, Article 11, the dates and the two business-to-business (B2B) section pages.

What Chapter III of the Data Act Requires When Data Must Be Made Available

Chapter III of the Data Act, Articles 8 to 12, does not create new data-sharing obligations; it sets the conditions that apply whenever a data holder is already obliged, in business-to-business relations, to make data available to a data recipient. Its five articles, under the title "Obligations for data holders obliged to make data available pursuant to Union law" in Regulation (EU) 2023/2854, are:

  • Article 8: conditions for making data available.
  • Article 9: compensation.
  • Article 10: dispute settlement.
  • Article 11: technical protection measures.
  • Article 12: scope and mandatory nature.

Both roles are defined in the Regulation: the data holder in Article 2(13) and the data recipient, a business other than the user, in Article 2(14).

Which Sharing Obligations Chapter III Covers (Article 12)

Chapter III applies where, in business-to-business relations, a data holder is obliged under Article 5 or under applicable Union law or national legislation adopted in accordance with Union law to make data available to a data recipient (Article 12(1)). Article 5 obligations, sharing with a third party at the user's request, have been covered since 12 September 2025.

For other laws, Article 50, fourth paragraph, sets the limit: "Chapter III shall apply in relation to obligations to make data available under Union law or national legislation adopted in accordance with Union law, which enters into force after 12 September 2025." Specific obligations in Union acts that entered into force on or before 11 January 2024 remain unaffected (Article 44(1); non-binding Commission FAQ version 1.4 of 22 January 2026, Q3).

Why Chapter III Cannot Be Contracted Away

A term in a data sharing agreement that, to the detriment of one party or of the user, excludes Chapter III, derogates from it or varies its effect is not binding on that party (Article 12(2)). Under Article 8(2), a term on data access and use, liability or remedies is also not binding if it is unfair under Article 13 or if, to the user's detriment, it excludes or varies the user's Chapter II rights; the data holder steps are listed in the Data Act compliance checklist.

FRAND Terms and Transparency under Article 8(1)

Under Article 8(1) of the Data Act, a data holder obliged to make data available must agree the arrangements with the data recipient on fair, reasonable and non-discriminatory terms and conditions and in a transparent manner, in accordance with Chapter III and Chapter IV. The Regulation sets no formula; the standard attaches to the arrangements that the parties agree.

The Commission's draft guidelines on reasonable compensation of 2 February 2026, not adopted as of 5 November 2026, state in paragraph 8 that case law on FRAND terms for standard-essential patents "cannot be automatically extrapolated" to the Data Act.

Under recital 42, the non-binding model contractual terms may help parties conclude FRAND contracts (a draft Recommendation approved by C(2025) 7750 of 19 November 2025, formal adoption pending as of 5 November 2026), but the right to share data with third parties is not conditional on a contract and, where none is concluded, is enforceable in national courts or tribunals. The black and grey lists are explained under unfair contractual terms under Article 13.

Non-Discrimination between Comparable Categories of Recipients

Article 8(3) of the Data Act forbids a data holder to discriminate in the arrangements for making data available between comparable categories of data recipients, including its own partner enterprises or linked enterprises. The burden of proof sits with the data holder. Where a data recipient considers its conditions discriminatory, the data holder must, without undue delay and upon the recipient's reasoned request, provide information showing that there has been no discrimination.

Differences justified by objective reasons are not unlawful discrimination, and the rule applies whether the parties are large enterprises or small and medium-sized enterprises (SMEs) (recital 45). The Commission's non-binding FAQ (version 1.4, Q38) says that comparability is assessed case by case.

No Exclusive Arrangements and the Limits of Disclosure

A data holder may not make data available to a data recipient, including on an exclusive basis, unless the user requests it under Chapter II (Article 8(4) of the Data Act). Neither data holders nor data recipients have to provide information beyond what is necessary to verify compliance with the agreed contractual terms or with their obligations under the Regulation or other Union or conforming national law (Article 8(5)).

An obligation to make data available does not oblige the disclosure of trade secrets, unless Union law, including Articles 4(6) and 5(9), or national legislation adopted in accordance with Union law provides otherwise (Article 8(6)). Identification, protective measures and the refusal ground are explained under trade secrets under the Data Act.

Technical Protection Measures under Article 11

Article 11 of the Data Act lets a data holder protect shared data with technical measures and gives it remedies against recipients and third parties that obtain or use the data unlawfully. The table below sets out the five triggers of Article 11(3) and the four remedies of Article 11(2) of Regulation (EU) 2023/2854; any trigger opens all four remedies, point (b) only under its condition.

Trigger Provision Remedy Provision
false information, deceptive or coercive means, or abuse of gaps in the data holder's protective infrastructure, to obtain data Art. 11(3)(a) erase the data made available and all copies Art. 11(2)(a)
use for unauthorised purposes, including the development of a competing connected product Art. 11(3)(b) end production, offering, placing on the market or use of derived goods, derivative data or services, and destroy infringing goods, where a serious risk of significant harm exists or the measure is not disproportionate Art. 11(2)(b)
unlawful disclosure to another party Art. 11(3)(c) inform the user of the unauthorised use or disclosure and of the measures taken Art. 11(2)(c)
agreed Article 5(9) measures not maintained Art. 11(3)(d) compensate the party suffering from the misuse or disclosure Art. 11(2)(d)
protection measures altered or removed without the data holder's agreement Art. 11(3)(e) all four remedies above Art. 11(2)
users who alter or remove the measures or do not maintain agreed measures, and parties receiving data from the user through an infringement Art. 11(4) users have the data holder's rights against a data recipient breaching Art. 6(2)(a) or (b) Art. 11(5)

Which Protection Measures Are Allowed and Where the Limits Lie

A data holder may apply appropriate technical protection measures, including smart contracts and encryption, to prevent unauthorised access to data, including metadata, and to ensure compliance with Articles 4, 5, 6, 8 and 9 and with the agreed contractual terms (Article 11(1)).

The measures must not discriminate between data recipients or hinder the user's right to obtain a copy of, retrieve, use or access data, to provide data to third parties under Article 5, or any right of a third party under Union law or conforming national law. Users, third parties and data recipients may not alter or remove the measures unless the data holder agrees.

When Data Must Be Erased and Production Stopped

A third party or data recipient that obtained data by deception, used it for unauthorised purposes, disclosed it unlawfully, dropped the agreed Article 5(9) measures or altered the protection measures must comply without undue delay with the data holder's requests under Article 11(2). Point (b) covers a competing connected product within the meaning of Article 6(2), point (e); the full recipient duties are explained under obligations of data recipients and third parties.

Requests may also come from the trade secret holder or the user where they are not the data holder. Article 11(4) reaches users and parties receiving data from them through an infringement; Article 11(5) gives users the data holder's rights against a data recipient breaching Article 6(2), point (a) or (b).

Chapter III Dates and Pending Changes

Chapter III has been in force since 11 January 2024 and has applied since 12 September 2025, for obligations in other laws only where they enter into force after that date. The table below gives the dates as of 5 November 2026; the pending Digital Omnibus is not law.

Date What happens Provision
11 January 2024 entry into force of the Regulation, Chapter III included Art. 50, first paragraph
12 September 2025 Chapter III applies to Article 5 obligations and to Union or national obligations entering into force after this date Art. 50, second and fourth paragraphs; Art. 12(1)
12 September 2028 Commission evaluation of the Regulation Art. 49(1)

The Article 49(1) evaluation ends in a report to the European Parliament, the Council and the European Economic and Social Committee.

The Commission's Digital Omnibus proposal, COM(2025) 837 of 19 November 2025, is pending as of 5 November 2026: the Committee of Permanent Representatives (Coreper) agreed the Council's negotiating mandate on 21 October 2026, and the European Parliament is at committee stage. What the proposal would change is tracked under Data Act amendments: the Digital Omnibus.

The B2B Data Sharing Pages in This Section

This section has two pages, one for each Chapter III article that needs more than a summary: reasonable compensation under Article 9 and dispute settlement under Article 10. Compensation must be non-discriminatory and reasonable and may include a margin (Article 9(1)); for an SME or not-for-profit research organisation without partner or linked enterprises that do not qualify as SMEs, it may not exceed the Article 9(2)(a) costs (Article 9(4)). Certified dispute settlement bodies decide within 90 days of receipt of a request, and a decision is binding only if the parties explicitly consented before the proceedings started (Article 10(9), (12)).

Page What it answers Provision
reasonable compensation for data sharing cost and margin factors, the SME and research cap, the draft guidelines Art. 9
Data Act dispute settlement bodies competence, certification, fees, the 90-day decision Art. 10

What Chapter III Does Not Cover

Chapter III governs the terms of obligations to share that exist elsewhere; it does not cover sharing that parties agree voluntarily, and it does not itself give anyone a right to data.

Is Voluntary Data Sharing Covered by Chapter III?

No: voluntary data sharing remains unaffected by the Chapter III access rules (recital 42), although unfair-terms control under Chapter IV still applies to it. The general access rules also do not apply to obligations to make data available under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR) (recital 42).

How Chapter III Relates to Sharing Requested by the User

When the user asks the data holder to share data with a third party under Chapter II, that obligation is one of the obligations Chapter III governs (Article 12(1)). Who may receive the data and the gatekeeper exclusion are explained under data sharing with third parties at the user's request. The exclusivity ban of Article 8(4) gives way only to such a user request.

Questions about B2B Data Sharing under the Data Act

Three questions on contract terms, protection measures and older Union acts close this page.

Is a contract term that waives Chapter III binding?

No: a term that excludes Chapter III, derogates from it or varies its effect to the detriment of one party or of the user is not binding on that party (Article 12(2)).

Can a recipient remove a technical protection measure?

Not without the data holder's agreement (Article 11(1)); altering or removing the measures without it triggers the remedies of Article 11(2), such as erasure of the data and its copies (Article 11(3)(e)).

Does Chapter III apply to sharing duties in Union acts adopted before 2024?

No: Chapter III applies to obligations that enter into force after 12 September 2025 (Article 50), and the specific obligations in Union acts in force on or before 11 January 2024 remain unaffected (Article 44(1)). The wider relationship is set out under Data Act and other EU laws.

Sources