Home
Data Act Roles

Roles compared

Data Act Roles: Manufacturer, Data Holder, User, Data Recipient, Third Party and Service Providers Compared

Data Act roles compared: manufacturer, data holder, user, data recipient, third party, cloud provider and public body, with the article behind each duty.

Last updated 5 November 2026 · By the EU Data Act Guide Editorial Team · How statements are checked · Print this page

Summary

The Data Act, Regulation (EU) 2023/2854, sets its duties and rights by role: manufacturers and related service providers build access in, data holders make data available, users hold the access and sharing rights, data recipients and third parties use data under conditions, providers of data processing services enable switching, and public sector bodies may request data in an exceptional need.

Regulation (EU) 2023/2854 entered into force on 11 January 2024 and has applied since 12 September 2025 (Article 50).

A role attaches to an activity, not to a type of company, so one organisation can hold several; how the roles fit into the EU Data Act as a whole is explained on the home page.

This page gives a 13-row role matrix, the rules for combined roles, the start dates and the four role pages.

How the Data Act Assigns Roles

The Data Act binds whoever carries out an activity it regulates, such as placing a connected product on the market, holding data or offering a data processing service, so a role follows what an organisation does, not what it is. Article 1(3) lists seven addressee groups, points (a) to (g), from manufacturers of connected products to participants in data spaces.

Under the Commission's non-binding frequently asked questions (FAQ) on the Data Act (version 1.4 of 22 January 2026, Q21), who the data holder is depends on who controls access to the readily available data, not on who produced the hardware or software. The full addressee list is set out under who the Data Act applies to.

Roles the Regulation Defines and Roles It Only Names

Article 2 defines the user (point 12), the data holder (point 13) and the data recipient (point 14), but none of its 43 definitions covers the manufacturer or the third party. The user owns a connected product, holds contractual temporary rights to use it or receives related services; the data holder has the right or obligation "to use and make available data"; the data recipient receives data for its trade, business, craft or profession, including as a third party at the user's request.

The third party, named in Articles 5 and 6, may be a consumer, an enterprise, a research or not-for-profit organisation (recital 33). The pending Digital Omnibus proposal COM(2025) 837 would read "use or make available" instead; as of 5 November 2026, the Committee of Permanent Representatives (Coreper) has agreed the Council mandate (21 October 2026) and the European Parliament is at committee stage.

Where the Role Holder Is Established

Manufacturers and related service providers, data holders and providers of data processing services are covered irrespective of where they are established, while users and data recipients are covered as users and recipients in the Union (Article 1(3)). The Commission's FAQ (Q15) reads point (b) as requiring the user to be established in the EU, a non-binding reading.

A covered entity not established in the Union that makes connected products available or offers services in the Union designates a legal representative in one of the Member States (Article 37(11)); until then, it is under the competence of all Member States (Article 37(13)). The mandate is explained under the Data Act for non-EU companies.

The Role Matrix: Duties and Rights by Article

Each role in Table 1 carries a fixed set of articles, from the manufacturer's design duty in Article 3(1) and the data holder's duties in Articles 4 and 5 to the provider's switching duties in Articles 23 to 31 and the public sector body's request rules in Articles 14 to 22. Roles with their own role page point to Table 3; the others link the topic page for the article.

Table 1: Data Act roles, definitions and duties, as of 5 November 2026
Role	Defined in	Main duties or rights	Explained on
Manufacturer	No definition in Article 2 (Art. 1(3)(a))	Design for access by default for connected products placed on the market after 12 September 2026 (Art. 3(1)); Chapter II does not apply to data from products of micro and small enterprises meeting the Art. 7(1) conditions	Manufacturer page, see Table 3
Seller, rentor or lessor	Art. 3(2)	Four items of pre-contractual information	pre-contractual information duties
Related service provider	Art. 2(6) (related service); Art. 3(3)	Design of the related service (Art. 3(1)); nine items of pre-contractual information	related services under the Data Act
Data holder	Art. 2(13)	Access free of charge for the user (Art. 4(1)); sharing with third parties (Art. 5(1)); own use of non-personal data only under a contract with the user (Art. 4(13)); FRAND and non-discrimination (Art. 8)	Data holder page, see Table 3
User	Art. 2(12)	Access and sharing rights (Arts 4, 5); trade secret measures (Art. 4(6)); no competing product (Art. 4(10)); protection against detrimental terms (Art. 7(2))	User page, see Table 3
Third party	Not defined; Arts 5, 6; recital 33	Purpose limitation and erasure (Art. 6(1)); eight prohibitions (Art. 6(2)(a) to (h))	Data recipient page, see Table 3
Data recipient	Art. 2(14)	Chapter III terms (Arts 8, 9, 11); Art. 9(4) cost cap for recipients that are small and medium-sized enterprises (SMEs) or not-for-profit research organisations without partner or linked enterprises that are not SMEs	B2B data sharing conditions
Gatekeeper	Art. 5(3) with Art. 3 Regulation (EU) 2022/1925	Not an eligible third party; may not solicit users or receive their data (Art. 5(3)(a) to (c)); third parties may not pass data to it (Art. 6(2)(d))	third-party sharing and the gatekeeper exclusion
Enterprise imposing or receiving contract terms	Art. 2(24)	Unfairness test for unilaterally imposed terms (Art. 13)	unfair contractual terms
Public sector body, Commission, European Central Bank, Union bodies, and the data holders they ask	Art. 2(28)	Requests in an exceptional need (Arts 14, 15); requester duties (Art. 19); addressees are legal persons other than public sector bodies (Art. 14)	B2G data sharing in an exceptional need
Provider of data processing services and customer	Art. 2(8), 2(30)	Switching duties (Arts 23 to 31); good faith of all parties (Art. 27); safeguards against international governmental access that would conflict with Union or national law (Art. 32)	cloud switching under the Data Act
Participant in a data space; vendor of applications using smart contracts	Art. 1(3)(g) (no Art. 2 definition for participants)	Essential requirements (Arts 33, 36); deletion of Art. 36 proposed in COM(2025) 837, pending as of 5 November 2026	interoperability under the Data Act
Legal representative	Art. 37(11)	Designated by covered entities not established in the Union	Non-EU companies page, linked above

All defined terms are collected on one page:

All 43 terms of Article 2 in plain language: Data Act definitions

Product, Holder, User and Third-Party Roles in Chapter II

Chapter II splits the product-data duties between the designer, the seller, rentor or lessor, and the party that controls access to the data. Connected products and related services placed on the market after 12 September 2026 must make their data accessible to the user by default and, where relevant and technically feasible, directly (Article 3(1)). As the data holder page sets out, the data holder gives the user access free of charge (Article 4(1)), shares data with third parties, at no cost to the user, on fair, reasonable and non-discriminatory (FRAND) terms against Article 9 compensation (Articles 5(1) and 8), and uses non-personal data only under a contract with the user (Article 4(13)).

The user keeps agreed trade secret measures (Article 4(6)) and may not build a competing product with the data (Article 4(10)); the third party is bound by purpose limitation and erasure (Article 6(1)) and by eight prohibitions (Article 6(2)(a) to (h)). Chapter II does not apply to data from products or related services of micro and small enterprises that have no partner or linked enterprises outside that category and are not subcontracted (Article 7(1)). Which products trigger these roles is explained under connected products under the Data Act.

Recipients, Public Bodies and Cloud Providers in Chapters III to VI

Outside Chapter II, the Data Act adds three role pairs: data holders and data recipients (Chapter III), requesting public bodies and the data holders they ask (Chapter V), and providers of data processing services and their customers (Chapter VI). Chapter III covers sharing duties under Article 5 or under Union or national law entering into force after 12 September 2025 (Articles 12(1) and 50).

Public sector bodies, the Commission, the European Central Bank and Union bodies may request data from data holders that are legal persons other than public sector bodies (Article 14); micro and small enterprises receive requests only in a public emergency (Article 15(2)). The Commission's FAQ (Q51) adds that a public sector body, as a separate legal entity, can become a user under Chapter II. Chapter VI binds providers of infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS) to Articles 23 to 31.

When One Organisation Holds Several Roles

One organisation can hold several Data Act roles at once, but the Commission's FAQ v1.4 reads Question 34 as excluding one combination: a company cannot be both the user and the data holder for the same data. The same FAQ (Q21) reads the manufacturer as typically, but not always, the data holder. Article 3(2) adds that the seller, rentor or lessor that informs the user before the contract "may be the manufacturer".

A processor under Article 4(8) of the General Data Protection Regulation (GDPR) is not a data holder, although a controller may task it with making data available (recital 22). A provider of data processing services that buys services from another provider is a customer for that purchase and benefits from the switching rights, while staying bound by Chapter VI for its own offerings (recital 91). The steps for each role are listed in the Data Act compliance checklist.

Roles are therefore assessed per data set and per product: a data holder for its own product's data can be a data recipient for data it receives from another data holder.

When Each Role's Duties Apply

Most role duties have applied since 12 September 2025, but the manufacturer's design duty in Article 3(1) covers only products and related services placed on the market after 12 September 2026, the switching charges of cloud providers end on 12 January 2027, and unfair-terms protection reaches certain older contracts from 12 September 2027. Reduced, cost-capped switching charges have applied since entry into force on 11 January 2024 (Article 29).

Chapter IV reaches contracts concluded on or before 12 September 2025 only where they are of indefinite duration or due to expire at least 10 years from 11 January 2024 (Article 50). Every date, including the Commission evaluation by 12 September 2028 (Article 49), sits in the Data Act timeline.

Table 2: Start date per role, as of 5 November 2026
Date	Role	What starts	Provision
11 January 2024	Provider of data processing services	Entry into force; only reduced, cost-capped switching charges	Art. 50; Art. 29(2), (3)
12 September 2025	Every role	Application of the Regulation, including Arts 3(2), 3(3), 4, 5, 6, Chapters V and VI (Chapter VI also for existing contracts)	Art. 50
After 12 September 2026	Manufacturer, related service provider	Art. 3(1) design duty for products and related services placed on the market after this date	Art. 50, third paragraph
12 January 2027	Provider of data processing services	No switching charges	Art. 29(1)
12 September 2027	Enterprise	Art. 13 for contracts concluded on or before 12 September 2025 that are of indefinite duration or expire at least 10 years from 11 January 2024	Art. 50
12 September 2028	All roles	Commission evaluation	Art. 49
Pending	Data holder, public sector body	Digital Omnibus COM(2025) 837: data holder definition and Chapter V regime; pending as of 5 November 2026	Data Act amendments: the Digital Omnibus

The Role Pages in This Section

This section has four role pages: the data holder, the user, the data recipient and third party, and the manufacturer, each with the full set of duties, the definition and the open questions for that role. The data recipient page also covers third parties that receive data at the user's request. The cloud provider and public-body roles are explained on their topic pages, linked in Table 1.

Table 3: Role pages under the Data Act
Page	What it answers	Provision
data holder obligations	Who qualifies as data holder and every duty	Art. 2(13), 3(3), 4, 5, 8, 9
who is a user under the Data Act	Owners, lessees and several users of one product	Art. 2(12), 4, 5, 7(2)
data recipients and third parties	Article 6 conditions and prohibited uses	Art. 2(14), 6
Data Act obligations for manufacturers	Design, information and data holder duties	Art. 1(3)(a), 3(1), 3(2)

Roles the Data Act Borrows or Leaves to Other Law

Two roles on this page come from other EU acts, and the GDPR roles of controller and processor stay in the GDPR, which prevails where the two Regulations conflict (Article 1(5)). The trade secret holder comes from the Trade Secrets Directive and the gatekeeper from the Digital Markets Act.

Trade Secret Holders and Gatekeepers

A trade secret holder is any natural or legal person lawfully controlling a trade secret, a definition the Data Act takes from Directive (EU) 2016/943 (Article 2(19)). A data holder that is a trade secret holder may refuse disclosure only in exceptional circumstances where serious economic damage is highly likely (Articles 4(8) and 5(11)), as explained under trade secrets under the Data Act.

An undertaking designated as a gatekeeper under Article 3 of Regulation (EU) 2022/1925 is not an eligible third party (Article 5(3)); the Commission's gatekeeper list names seven gatekeepers as of 5 November 2026. Voluntary agreements between gatekeepers and data holders remain unaffected (recital 40).

The Data Act roles do not replace the GDPR roles of controller and processor: the Regulation is without prejudice to Union data protection law (Article 1(5)). Where the user is not the data subject, personal data are made available only with a valid legal basis under Article 6 GDPR and, where relevant, Article 9 GDPR and Article 5(3) of Directive 2002/58/EC (Articles 4(12) and 5(7)).

The Data Act is not a legal basis for processing personal data (Article 1(5)); the overlaps are set out under the Data Act vs the GDPR.

Sources

Is this page useful?Report a problem with this page