Data Holder under the Data Act: Who Qualifies and the Full List of Obligations

The role is defined in Article 2(13) of Regulation (EU) 2023/2854, the EU Data Act.

The Regulation has been in force since 11 January 2024 and has applied since 12 September 2025 (Art. 50). It covers data holders irrespective of their place of establishment when they make data available to data recipients in the Union (Art. 1(3)(c)).

The table sums up the role in eight points.

What Is a Data Holder?

The Data Act defines a data holder in Article 2(13) Regulation (EU) 2023/2854 as a natural or legal person with the right or obligation to use and make available data, including, where contractually agreed, product data or related service data it has retrieved or generated while providing a related service. It rests on a legal position towards data, unlike the other Data Act roles.

The Right or Obligation to Use and Make Available Data

The right or obligation may arise from the Data Act itself or from applicable Union law or national legislation adopted in accordance with Union law (Art. 2(13)). Chapter II makes the holder of connected-product data a data holder towards the user; Chapter III covers Article 5 and every Union or national sharing obligation that enters into force after 12 September 2025 (Art. 12(1), Art. 50).

Article 2(13) of Regulation (EU) 2023/2854 reads "to use and make available data", joining both verbs.

A Different Notion from the GDPR and the DGA

A data holder is not a role of the General Data Protection Regulation (GDPR): processors within the meaning of Article 4(8) GDPR are not considered to act as data holders (recital 22), and the GDPR prevails in a conflict (Art. 1(5)). The Data Governance Act (DGA) has its own definition (Art. 2(8) Regulation (EU) 2022/868), and Joint Opinion 2/2022 of the European Data Protection Board and the European Data Protection Supervisor (para. 33) warned that two definitions may create legal uncertainty. The GDPR side is explained under how the Data Act and the GDPR overlap.

Who Qualifies as a Data Holder?

Whoever controls access to the readily available data qualifies as the data holder, which is typically but not always the manufacturer of the connected product (Commission FAQ v1.4, Q21). The sections below apply this non-binding reading of the Commission FAQ of 22 January 2026.

Control over Access Decides, Not Who Built the Product

Determining who the data holder is does not depend on who produced the hardware or software, but on who controls access to the readily available data (FAQ v1.4 Q21). The same answer accepts that the role can be outsourced to another company. Before a related service contract, Article 3(3) treats the service provider as the prospective data holder.

When the Manufacturer Is Not the Data Holder

A manufacturer that does not control access to the data of its product is not the data holder for that data (FAQ v1.4 Q21). It still owes the Article 3(1) design duty for connected products placed on the market after 12 September 2026 (Art. 50). The seller, rentor or lessor, which may be the manufacturer, gives the user four items of information before the contract (Art. 3(2)(a) to (d)), as set out under Data Act obligations for manufacturers.

Processors, Public Undertakings and Small Enterprises

Three edge cases follow from the recitals: GDPR processors are not data holders (recital 22), public undertakings may be (recital 63), and a micro or small enterprise may be a data holder where it is not the manufacturer or related service provider (recital 41). A controller can still task a processor with making data available (recital 22), and public sector bodies are generally not data holders (recitals 25 and 63). Article 7(1) removes Chapter II only for data from a micro or small enterprise's own products or related services, and only without a partner or linked enterprise that is not micro or small and without subcontracting; an enterprise medium-sized for less than one year is treated alike.

One Role per Company for the Same Data

A company cannot be user and data holder for the same data at the same time (Commission FAQ v1.4 Q34). The user owns the connected product, holds contractually transferred temporary rights to use it, or receives related services (Art. 2(12)).

Data Holders Established outside the EU

Establishment outside the Union does not take a data holder out of scope: Article 1(3)(c) covers data holders, irrespective of their place of establishment, that make data available to data recipients in the Union. The Commission sees no obligation to grant access to a third party not established in the EU (FAQ v1.4 Q37; "Data Act explained"). A non-EU entity making connected products available or offering services in the Union designates a legal representative in one Member State (Art. 37(11)); see the Data Act for non-EU companies.

The Full List of Data Holder Obligations

A data holder carries obligations in four directions: towards the user and the third parties the user chooses (Chapter II), towards data recipients under any sharing obligation (Chapter III), in contract terms with other enterprises (Chapter IV), and towards public sector bodies in exceptional need (Chapter V). The table lists each one. Access and sharing are free of charge to the user; compensation comes only from third parties and data recipients (Art. 4(1), 5(1), 9).

Every row applies since 12 September 2025 unless the column says otherwise (Art. 50).

Duties towards the User and the User's Chosen Third Parties

The Chapter II duties of a data holder (Articles 3(3), 4 and 5) have applied since 12 September 2025, also to connected products placed on the market before that date (Art. 50); the Commission FAQ v1.4 (Q22) reads it the same way. Article 7(1) is the only size-based carve-out.

Information as Prospective Data Holder

Before a related service contract is concluded, the provider of the related service, as prospective data holder, gives the user at least nine items of information (Art. 3(3)(a) to (i)). They include its identity, the expected data, its own and third-party use, how to request sharing, the right to complain, trade secret status (point (h)) and contract duration; see pre-contractual information under the Data Act.

Answering the User's Access Requests

Where the user cannot access the data directly, the data holder makes readily available data and metadata accessible without undue delay, in the same quality, easily, securely, free of charge and in a machine-readable format (Art. 4(1)). It must not make the exercise of the user's choices or rights unduly difficult (Art. 4(4)), and it asks for nothing beyond what is necessary to verify the user (Art. 4(5)).

Making Data Available to a Third Party Chosen by the User

At the request of the user or a party acting on the user's behalf, the data holder makes readily available data available to a third party, free of charge to the user, on the terms of Articles 8 and 9 (Art. 5(1)). A gatekeeper designated under Article 3 of Regulation (EU) 2022/1925 is not an eligible third party (Art. 5(3)), and the data holder derives no insights about the third party's economic situation, assets, production methods or use without its easily withdrawable permission (Art. 5(6)). Personal data of someone other than the user need a GDPR legal basis (Art. 4(12), 5(7)).

Own Use Only under a Contract with the User

A data holder uses readily available non-personal data only on the basis of a contract with the user and never to derive insights that could undermine the user's commercial position (Art. 4(13)). It passes non-personal product data to third parties only to fulfil that contract (Art. 4(14)); recital 25 gives it no new right, and the Commission reads the contract as allowing any purpose agreed with the user, subject to the insight ban (FAQ v1.4 Q29). See the data licence agreement.

Protecting Trade Secrets and Product Safety When Sharing

Trade secrets are no general ground to refuse: the data holder agrees protective measures (Art. 4(6), 5(9)), may withhold or suspend with a substantiated written decision and notification (Art. 4(7), 5(10)), and may refuse only in exceptional circumstances where serious economic damage is highly likely (Art. 4(8), 5(11); recital 31). Access may also be restricted by contract where processing could undermine security requirements of Union or national law with a serious adverse effect on the health, safety or security of natural persons, and refusals go to the competent authority (Art. 4(2)), which the data coordinator reports to the Commission yearly (Art. 37(6)(c)).

Duties towards Recipients and Other Contract Partners

A data holder that must make data available to a data recipient follows the Chapter III conditions, and any data-related term it imposes on another enterprise is tested under Chapter IV. Voluntary data sharing falls outside Chapter III but within Chapter IV (recital 42).

Terms for Making Data Available under Chapter III

A data holder that must make data available to a data recipient agrees the arrangements under fair, reasonable and non-discriminatory (FRAND) terms and in a transparent manner (Art. 8(1)). It treats comparable categories of recipients alike, its own partner or linked enterprises included, and shows this on a reasoned request (Art. 8(3)); the Commission assesses comparability case by case (FAQ v1.4 Q38). It makes no data available, including on an exclusive basis, unless the user requests it under Chapter II (Art. 8(4)), and trade secrets need not be disclosed unless Union or national law provides otherwise (Art. 8(6)).

Compensation is non-discriminatory and reasonable and may include a margin (Art. 9(1)); a micro, small or medium-sized enterprise (SME) or not-for-profit research recipient without non-SME partner or linked enterprises pays at most the Art. 9(2)(a) costs, no margin (Art. 9(4)). The data holder states its calculation basis (Art. 9(7)); the Article 9(5) guidelines are a draft of 2 February 2026, not adopted as of 5 November 2026. Technical protection measures must not discriminate between recipients (Art. 11(1)), and terms derogating from Chapter III to a party's or the user's detriment are not binding (Art. 12(2)); see B2B data sharing under the Data Act.

Unilaterally Imposed Contract Terms

A term on access to and use of data, or on liability and remedies, that a data holder unilaterally imposes on another enterprise is not binding if it is unfair (Art. 13(1)). Any enterprise is protected, the black list holds three points and the grey list seven (Art. 13(4), 13(5)), and the supplier of the term must prove it was not unilaterally imposed (Art. 13(6)). Article 13 covers contracts concluded after 12 September 2025 and, from 12 September 2027, certain older contracts (Art. 50).

Answering Public Sector Requests in Exceptional Need

A data holder that is a legal person other than a public sector body makes data available to a public sector body, the Commission, the European Central Bank or a Union body that shows an exceptional need in a duly reasoned request (Art. 14 Regulation (EU) 2023/2854). Exceptional need means a public emergency (Art. 15(1)(a)) or a task in the public interest explicitly provided for by law (Art. 15(1)(b)), compared below.

The data holder anonymises the data, pseudonymising personal data whose disclosure is required (Art. 18(4)), and disputes go to the competent authority of its Member State of establishment (Art. 18(5)); see how to handle a public-sector data request.

How a Data Holder Meets Its Obligations Step by Step

A data holder meets its obligations by confirming the role per dataset first and then setting up one process for each counterparty: users, third parties, data recipients, contract partners and public sector bodies. The process runs in seven steps:

1. Map each dataset and who controls access to it (FAQ v1.4 Q21).
2. Check Article 7(1); see Data Act SME exemptions.
3. Publish the Article 3(3) information.
4. Set a request channel and an identity check within Article 4(5).
5. Sign the Article 4(13) contract with each user.
6. Prepare FRAND terms, a compensation basis and trade secret measures.
7. Set a Chapter V intake with the Article 18(2) clock.

A term that excludes, derogates from or varies the user's Chapter II rights to the user's detriment is not binding on the user (Art. 7(2)).

The Commission FAQ v1.4 is the latest version as of 5 November 2026 and, by its own disclaimer, does not represent the Commission's official position.

The Data Act sets no EU-wide fine amount and leaves penalties to the Member States (Art. 40(1)). GDPR supervisory authorities may fine Chapter II, III and V infringements within their competence up to the Article 83(5) GDPR amount (Art. 40(4)); see Data Act penalties and fines.

The duties of the other roles are set out in the Data Act compliance checklist.

Where the Data Holder Role Sits among the Other Roles

The data holder is one of several Data Act roles, and manufacturer, user, data recipient and provider of data processing services each carry their own duties.

One company can hold different roles for different datasets (FAQ Q34). Related roles and instruments:

• Manufacturer: Article 3(1) design duty; see Data Act obligations for manufacturers.
• User: the counterparty under Article 2(12); see who is a user under the Data Act.
• Data recipient and third party: a third party is bound by the eight prohibitions of Article 6(2); see data recipients and third parties.
• Provider of data processing services: a separate addressee (Art. 1(3)(f)); see cloud switching under the Data Act.
• Model contractual terms: a draft Recommendation approved by C(2025) 7750, formal adoption pending as of 5 November 2026; see Data Act model contractual terms.
• Data Governance Act: its own definition (Art. 2(8) DGA); see the Data Act vs the Data Governance Act.

As of 5 November 2026, neither the Digital Omnibus proposal nor the Council mandate would amend Article 7.

COM(2025) 837 would change Article 2(13) to "use or make available data", and the Council mandate keeps that wording. Status: pending: Commission proposal COM(2025) 837 of 19 November 2025, Council mandate agreed by Coreper on 21 October 2026 (ST 14756/26 of 22 October 2026), European Parliament committee stage (ITRE/LIBE, "Awaiting committee decision", no committee vote) as of 5 November 2026; not law. See Data Act amendments.

Questions about Data Holders

Five questions recur about the data holder role.

Is the manufacturer always the data holder?

No: the manufacturer is typically but not always the data holder, because the role follows control over access to the readily available data (Commission FAQ v1.4 Q21).

Does a data holder charge the user for access?

No: access under Article 4(1) and sharing under Article 5(1) are free of charge to the user; only the third party compensates the data holder under Article 9.

Must a data holder share data with companies outside the EU?

Not under Chapter II: the Commission reads the Data Act as creating no obligation to share with third parties not established in the EU (FAQ v1.4 Q37).

Can a micro or small enterprise be a data holder?

Yes: under recital 41 a micro or small enterprise may be a data holder where it is not the manufacturer or related service provider. Article 7(1) covers only data from its own products or services; see Article 7 for micro and small enterprises.

Would the pending Omnibus proposal change the definition?

As of 5 November 2026, COM(2025) 837 would replace "use and make available" with "use or make available" in Article 2(13), as would the Council mandate ST 14756/26; both are pending, not law.