EU Data Act Guide
  1. Home
  2. Who Does the Data Act Apply To? Manufacturers, Data Holders, Users and Cloud Providers

Who it applies to

Who Does the Data Act Apply To? Manufacturers, Data Holders, Users and Cloud Providers

Who the Data Act applies to under Article 1: manufacturers, data holders, users, recipients, public bodies and cloud providers, with exclusions and dates.

Last updated 5 November 2026 · By the EU Data Act Guide Editorial Team · How statements are checked · Print this page

Summary

The Data Act, Regulation (EU) 2023/2854, applies to manufacturers of connected products placed on the EU market and providers of related services, data holders that make data available to recipients in the Union, users and data recipients in the Union, public bodies requesting data in exceptional need, providers of data processing services serving customers in the Union, and participants in data spaces and smart-contract vendors (Article 1(3)).

The Regulation entered into force on 11 January 2024 and has applied since 12 September 2025 (Article 50 of Regulation (EU) 2023/2854). It is directly applicable in every Member State; national acts designate the authorities and set penalties. How the rest of the EU Data Act is built is explained on the home page.

Which obligations bind an organisation depends on the chapter, its role and, for product data, the Article 7 carve-out for micro and small enterprises. The sections below cover Article 1, its hooks, placing on the market, the exclusions, the dates and a decision table by role.

What Article 1 of the Data Act Covers

Article 1 of the Data Act, titled "Subject matter and scope", sets out what the Regulation harmonises, which data each chapter covers and which persons and bodies it applies to, and then lists what it leaves to other law. Article 1 sits in Chapter I next to Article 2, which holds 43 definitions but none for "manufacturer", so the manufacturer is identified through Article 1(3)(a).

The Six Areas the Regulation Harmonises

Article 1(1) lists six areas of harmonised rules, introduced with "inter alia", so the list names the main subjects without closing them:

  • (a) the making available of product data and related service data to the user of the connected product or related service;
  • (b) the making available of data by data holders to data recipients;
  • (c) the making available of data to public sector bodies, the Commission, the European Central Bank (ECB) and Union bodies in exceptional need, for a specific task carried out in the public interest;
  • (d) facilitating switching between data processing services;
  • (e) safeguards against unlawful third-party access to non-personal data;
  • (f) the development of interoperability standards for data to be accessed, transferred and used.

Article 1(2) then fixes the data that each chapter reaches.

Personal and Non-Personal Data in Chapters II to VII

The Data Act covers personal and non-personal data, but each chapter reaches a different set of data (Article 1(2)). Chapter II covers data concerning the performance, use and environment of connected products and related services, "with the exception of content". Chapter V reaches any private sector data with a focus on non-personal data, while Chapter VII covers only non-personal data held in the Union by providers of data processing services. Table 1 gives the data set of each chapter.

Chapter Subject Data covered Provision
II business-to-consumer and business-to-business sharing of product data data, except content, on the performance, use and environment of connected products and related services Art. 1(2)(a)
III data holders obliged by law to make data available any private sector data subject to statutory data sharing obligations Art. 1(2)(b)
IV unfair contractual terms any private sector data accessed and used on the basis of contract between enterprises Art. 1(2)(c)
V data for public bodies in exceptional need any private sector data, with a focus on non-personal data Art. 1(2)(d)
VI switching between data processing services any data and services processed by providers of data processing services Art. 1(2)(e)
VII unlawful international governmental access any non-personal data held in the Union by providers of data processing services Art. 1(2)(f)

Table 1: Article 1(2) Regulation (EU) 2023/2854, the data each chapter covers.

Personal data within these sets stay subject to data protection law, as the exclusions below explain. What counts as a connected product and which of its data is covered is set out under connected products under the Data Act.

Need help working out where your organisation stands?

The Seven Addressee Groups of Article 1(3)

Article 1(3) of the Data Act names seven groups of addressees, and each group is caught by a hook of its own: three points apply irrespective of where the addressee is established, two cover only addressees in the Union, and two turn on an activity, a request in exceptional need or work with data spaces and smart contracts. Table 2 lists each point with its hook and main chapters; an organisation is an addressee only through one of these points.

Point Addressee Hook Main chapters
(a) manufacturers of connected products, providers of related services product placed on the market in the Union; irrespective of establishment II
(b) users in the Union II
(c) data holders make data available to data recipients in the Union; irrespective of establishment II, III
(d) data recipients in the Union II, III
(e) public sector bodies, the Commission, the ECB, Union bodies; data holders answering their requests request in exceptional need V
(f) providers of data processing services customers in the Union; irrespective of establishment VI, VII
(g) participants in data spaces, vendors of smart-contract applications, persons deploying smart contracts for others activity; reduction to data space participants proposed (pending as of 5 November 2026) VIII

Table 2: Article 1(3) Regulation (EU) 2023/2854, as of 5 November 2026.

Bound Irrespective of Place of Establishment

Manufacturers of connected products placed on the market in the Union, providers of related services, data holders that make data available to data recipients in the Union, and providers of data processing services serving customers in the Union are bound wherever they are established (Article 1(3)(a), (c) and (f)). A data processing service is a digital service enabling ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources (Article 2(8)). Recital 81 covers infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS).

A data holder is a person with the right or obligation "to use and make available data" (Article 2(13)); the "use or make available" wording exists only in the Digital Omnibus texts, pending as of 5 November 2026. A micro or small enterprise can still be a data holder for connected products it did not manufacture (recital 41).

Users and data recipients are covered only "in the Union": Article 1(3)(b) reaches users in the Union of connected products or related services, and Article 1(3)(d) reaches data recipients in the Union to whom data are made available. A user owns a connected product, holds contractually transferred temporary rights to use it, or receives related services (Article 2(12)); a data recipient acts for its trade, business, craft or profession and is not the user (Article 2(14)).

The Commission's FAQ on the Data Act (version 1.4 of 22 January 2026, Q15) reads Article 1(3)(b) as requiring a user to be established in the EU, and says the access right applies wherever the data are stored. The Commission's Data Act explained page adds that "there is no obligation under the Data Act for a data holder to share data with third parties based outside the EU", which is not a ban. Both readings are non-binding.

Public Bodies, Data Space Participants and Smart-Contract Deployers

Article 1(3)(e) brings in public sector bodies, the Commission, the ECB and Union bodies that request data in an exceptional need for a task in the public interest, together with the data holders that answer them, and Article 1(3)(g) brings in participants in data spaces, vendors of applications using smart contracts and persons deploying smart contracts for others. Chapter V binds data holders that are legal persons other than public sector bodies (Article 14), and Article 15(2) spares micro and small enterprises the non-emergency requests of Article 15(1)(b). Smart-contract vendors and deployers carry the essential requirements of Article 36, including an EU declaration of conformity.

The Commission's Digital Omnibus proposal COM(2025) 837 of 19 November 2025 would reduce point (g) to "participants in data spaces", delete Article 36 and delete Article 1(7); it is pending, with a Council mandate agreed by the Committee of Permanent Representatives (Coreper) on 21 October 2026 (ST 14756/26 of 22 October 2026) and the European Parliament at committee stage with no committee vote, as of 5 November 2026, and it is not law. The full proposal is tracked under Data Act amendments: the Digital Omnibus.

Placing on the Market: How Products Enter the Regulation's Reach

A connected product falls within the Data Act once it is placed on the market in the Union, which Article 2(22) defines as "the first making available of a connected product on the Union market". Making available on the market means any supply of a connected product for distribution, consumption or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge (Article 2(21)). The Commission's FAQ (Q8) reads placing on the market as referring to each individual product, not to a product type, and a product is placed on the market only once.

The registration of a car, rail vehicle or plane in a Member State indicates placing on the EU market, according to the FAQ (Q9), which also says that data such a product generates inside and outside the EU must be made available. These readings are not binding.

The date of placing also decides the Article 3(1) design duty (Table 3). Placing on the market and making available on the market are among the Article 2 definitions.

What the Data Act Excludes or Leaves to Other Law

Article 1(5) to (10) of the Data Act keep data protection law, criminal law, customs and tax rules, national security, intellectual property and consumer law in place, and leave voluntary data sharing outside or alongside the Regulation. The Data Act is without prejudice to Regulations (EU) 2016/679 (the General Data Protection Regulation, GDPR) and (EU) 2018/1725 and Directive 2002/58/EC; where users are data subjects, the Chapter II rights complement the GDPR rights of access and portability in Articles 15 and 20, and in a conflict data protection law prevails (Article 1(5)). Recital 7 adds that the Regulation does not constitute a legal basis for the collection or generation of personal data by the data holder.

Criminal Law, Customs, Taxation and National Security

The Data Act does not affect Union or national acts on sharing, access to and use of data for criminal investigations and penalties or for customs and taxation, and it does not apply to data under Regulation (EU) 2015/847 and Directive (EU) 2015/849 (Article 1(6)).

The Regulation also does not apply to areas outside the scope of Union law. It does not affect Member State competences concerning public security, defence or national security, whatever type of entity carries out those tasks, nor their competences concerning customs and tax administration or the health and safety of citizens (Article 1(6)).

Intellectual Property, Consumer Protection and Voluntary Contracts

The Data Act is without prejudice to the protection of intellectual property rights, in particular Directives 2001/29/EC, 2004/48/EC and (EU) 2019/790 (Article 1(8)), and it complements consumer law such as Directives 93/13/EEC, 2005/29/EC and 2011/83/EU (Article 1(9)). Article 1(7) adds that the Regulation complements the self-regulatory approach of Regulation (EU) 2018/1807 with generally applicable obligations on cloud switching, a paragraph the pending proposal described above would delete.

The first subparagraph of Article 1(6) keeps voluntary arrangements for the exchange of data between private and public entities outside the Regulation. Article 1(10) allows voluntary lawful data sharing contracts, including reciprocal ones, provided they comply with the requirements of the Regulation.

Temporal Scope: Which Products, Contracts and Obligations Are Caught

The Data Act applies from 12 September 2025, but Article 50 staggers its reach: the Article 3(1) design duty covers only products placed on the market after 12 September 2026, Chapter III only data-sharing obligations entering into force after 12 September 2025, and Chapter IV only contracts concluded after that date until older long-term contracts follow on 12 September 2027. Each date with its source is listed in the Data Act timeline.

Date What is caught Provision Page
11 January 2024 entry into force; only reduced, cost-capped switching charges allowed Art. 50 first paragraph; Art. 29 n/a
12 September 2025 general application; Arts 3(2), 3(3), 4, 5 and 6 also for products already on the market; Chapter VI for existing and new contracts Art. 50 second paragraph n/a
after 12 September 2025 Chapter III for Union or national data sharing obligations entering into force after that date, plus Art. 5 obligations Art. 50 fourth paragraph; Art. 12(1) B2B data sharing under the Data Act
after 12 September 2025 Chapter IV for contracts concluded after that date Art. 50 fifth paragraph n/a
after 12 September 2026 Art. 3(1) design duty for connected products and related services placed on the market after that date Art. 50 third paragraph data access by design under Article 3(1)
12 September 2027 Chapter IV for contracts concluded on or before 12 September 2025 that are of indefinite duration or expire at least 10 years from 11 January 2024 Art. 50 sixth paragraph n/a

Table 3: Article 50 Regulation (EU) 2023/2854; the pending Digital Omnibus proposal would not change these dates (checked 5 November 2026).

Products already on the market had to allow user access from 12 September 2025, directly or under Article 4(1), under the second paragraph of Article 50; the Commission FAQ (Q22) reads it the same way. Chapter VI has no transitional rule and covers existing and new cloud contracts alike.

Scope Decision Table by Role

Being within Article 1(3) does not mean every chapter applies: each role triggers its own set of articles, and size, establishment and dates then narrow the result.

Role Caught when Main articles Explained on
Manufacturer connected product placed on the market in the Union Art. 1(3)(a), 3(1), 3(2) Data Act obligations for manufacturers
Provider of a related service service connected with a product placed on the Union market Art. 1(3)(a), 2(6), 3(3) related services page (see the questions below)
Data holder right or obligation to use and make available data; recipient in the Union Art. 1(3)(c), 2(13), 4, 5 data holder under the Data Act
User owns the product, holds contractual rights to use it or receives the service; in the Union Art. 1(3)(b), 2(12), 4, 5 who is a user under the Data Act
Data recipient or third party receives data in the Union Art. 1(3)(d), 2(14), 6 data recipients and third parties
Gatekeeper designated under Art. 3 Regulation (EU) 2022/1925 Art. 5(3): not an eligible third party third-party sharing and the gatekeeper exclusion
Public sector body and responding data holder request in exceptional need Art. 1(3)(e), 14, 15 B2G data sharing in exceptional need
Enterprise imposing data contract terms term unilaterally imposed on another enterprise Art. 13 unfair contractual terms under Article 13
Provider of data processing services customers in the Union Art. 1(3)(f), 23 to 31 cloud switching under the Data Act
Smart-contract vendor or deployer deploys smart contracts executing data sharing agreements Art. 1(3)(g), 36 (deletion proposed, pending) smart contracts under Article 36
Entity not established in the Union makes connected products available or offers services in the Union Art. 37(11) non-EU companies page (Table 5)
Micro or small enterprise as manufacturer, designer or related service provider, without a non-micro or non-small partner or linked enterprise and not subcontracted Art. 7(1) SME page (Table 5)

Table 4: indicative orientation by article, not legal advice.

One page compares the roles:

Table 4 orients by article and rules on no organisation; holding several roles means carrying the articles of each. The steps for each role are set out in the Data Act compliance checklist.

The Scope Pages in This Section

Two pages carry the scope questions that need more than a row here: the rules for companies established outside the Union and the Article 7 carve-out for micro and small enterprises. For companies outside the Union, an in-scope entity that is not established in the Union and makes connected products available or offers services in the Union designates a legal representative in one of the Member States (Article 37(11)), and until it does it falls under the competence of all Member States (Article 37(13)). The Regulation sets no deadline, form or register for that designation.

For the smallest enterprises, Chapter II obligations do not apply to data from products manufactured or designed, or related services provided, by a micro or small enterprise without a non-micro or non-small partner or linked enterprise and not subcontracted (Article 7(1)); medium-sized enterprises get one year only. Article 13 and Chapter VI have no such carve-out, and neither Digital Omnibus text would amend Article 7 (checked 5 November 2026).

Page What it answers Provision
the Data Act for non-EU companies hooks irrespective of establishment, the legal representative Art. 1(3), 37(10) to (13)
Data Act SME exemptions under Article 7 micro and small carve-out, the medium-sized year, the proposed small mid-cap definition (pending) Art. 7

Scope Questions beyond Article 1

The questions below sit at the edge of Article 1 and point to the pages that answer them in full.

Questions about Who the Data Act Applies To

Four short answers cover data protection, voluntary sharing, data generated abroad and virtual assistants.

Is personal data within the scope of the Data Act?

Yes: the Data Act covers personal and non-personal data (Article 1(2)), and in a conflict data protection law prevails (Article 1(5)). How the two regimes fit together is set out in the Data Act vs the GDPR.

Does the Data Act apply to voluntary data sharing?

Only in part: it does not apply to voluntary private-public data exchange (Article 1(6)) and allows voluntary lawful data sharing contracts that comply with it (Article 1(10)). A term one enterprise imposes unilaterally on another still faces Article 13.

Does the Data Act cover data generated outside the EU?

Yes, for connected products placed on the EU market: the Commission's FAQ (Q9) says data generated inside and outside the EU by such a product must be made available. The FAQ is the Commission's non-binding reading.

Are virtual assistants within the scope of the Data Act?

Yes, insofar as they interact with a connected product or related service (Article 1(4)). Article 2(31) defines them as software that processes demands, tasks or questions and provides access to other services or controls connected products; the related service test is explained under related services under the Data Act.

Sources