Unfair Contractual Terms under Article 13 Data Act: The Black List, the Grey List and Which Contracts Are Covered

The rule protects any enterprise, whatever its size.

The Regulation entered into force on 11 January 2024. Chapter IV has applied since 12 September 2025 to contracts concluded after that date, and it applies from 12 September 2027 to older contracts of indefinite duration or due to expire at least 10 years from 11 January 2024. How Chapter IV fits into the rest of the EU Data Act is explained on the home page.

This page sets out the covered contracts and terms, the unfairness test, both lists, the exclusions, the consequence of unfairness, the dates and the draft model contractual terms.

What Article 13 of the Data Act Does

Chapter IV of the Data Act consists of a single provision, Article 13, which removes the binding force of unfair contractual terms on data that one enterprise has unilaterally imposed on another. The Commission's Frequently Asked Questions (FAQ) (version 1.4 of 22 January 2026, Q42) reads Article 13 of Regulation (EU) 2023/2854 as four conditions for a covered term:

• Subject: the term concerns access to and use of data, or liability and remedies for the breach or termination of data-related obligations.
• Exclusion: the term does not reflect mandatory Union law or the provisions that would apply if the contract were silent.
• Imposition: the term is unilaterally imposed.
• Parties: both parties are enterprises.

Recital 58 gives the reason: enterprises facing a stronger bargaining position may have no choice but to accept take-it-or-leave-it terms on access to data. As a regulation, the Data Act is directly applicable in all Member States (Article 50). The FAQ is non-binding; the Commission states that it "should not be considered as representative of the European Commission's official position".

Which Contracts and Terms Are Covered

Article 13 covers any contract between enterprises in which data is accessed and used, and within it only the terms on data access and use and on liability and remedies for data-related obligations. Chapter IV applies to any private sector data accessed and used on the basis of a contract between enterprises (Article 1(2)(c)), personal and non-personal data alike according to the Commission's Data Act explained page. Coverage turns on the term, the parties, the imposition and the date.

Terms on Data Access, Use, Liability and Remedies

Only the data-related terms of a contract are tested: terms on access to and use of data, and terms on liability and remedies for breach or termination of data-related obligations (Article 13(1), recital 60). The Commission's FAQ (Q42a) applies this to contracts mainly about something else: data clauses in a bank loan are tested, and general liability and duration clauses only insofar as they cover data obligations.

Voluntary data sharing falls outside Chapter III (recital 42) but inside Chapter IV. Where data is shared under Chapter III, Article 8(2) adds that terms on data access and use, or on liability and remedies, are not binding if unfair under Article 13. The conditions Chapter III sets for business-to-business (B2B) sharing beside Article 13 are explained under B2B data sharing under the Data Act.

Any Enterprise, Not Only Small Ones

Article 13 protects any enterprise on which a term is unilaterally imposed, whatever its size. Article 13(1) speaks of a term imposed "by an enterprise on another enterprise", and the Commission's FAQ (Q41) confirms that Chapter IV does not specifically address small and medium-sized enterprises (SMEs). The protection runs between enterprises only, so contracts with consumers are outside Article 13.

When a Term Counts as Unilaterally Imposed

A term is unilaterally imposed when one contracting party supplied it and the other could not influence its content despite an attempt to negotiate it (Article 13(6)). Recital 59 ties this to contractual freedom: a term simply provided by one party and accepted by the other, or negotiated and agreed in amended form, is not unilaterally imposed. A standard term is therefore not caught as such.

The party that supplied the term bears the burden of proving that it was not unilaterally imposed, and it may not argue that its own term is unfair (Article 13(6)). A record of which terms were negotiated therefore matters to both sides.

Contracts Concluded Before and After 12 September 2025

Chapter IV applies to contracts concluded after 12 September 2025 and, from 12 September 2027, to contracts concluded on or before that date that are of indefinite duration or due to expire at least 10 years from 11 January 2024 (Article 50). An older fixed-term contract is therefore covered from 12 September 2027 when its expiry falls on or after 11 January 2034; other older contracts stay outside Chapter IV.

The Commission's FAQ (Q42b) describes the same two steps. This rule belongs to Chapter IV alone; every other application date sits in the Data Act timeline.

The General Unfairness Test of Article 13(3)

A term is unfair under Article 13(3) of the Data Act if its use grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing. Both lists apply this test: Article 13(4) opens "In particular, a contractual term shall be unfair for the purposes of paragraph 3", and Article 13(5) presumes unfairness "for the purposes of paragraph 3". A term on neither list is judged by Article 13(3) alone.

Recital 61 limits the test to excessive terms where a stronger bargaining position has been abused, and recital 62 makes the listed terms "a yardstick to interpret the general unfairness provision".

The Black List: Three Terms That Are Always Unfair

Article 13(4) of the Data Act lists three terms that are always unfair when unilaterally imposed: excluding or limiting liability for intentional acts or gross negligence, excluding the other party's remedies or the imposing party's liability for breach, and reserving the exclusive right to judge data conformity or interpret the contract. Each point looks at the term's object or effect.

Terms always unfair when unilaterally imposed, Article 13(4) Regulation (EU) 2023/2854.

No rebuttal is possible for these three terms. A unilaterally imposed term that meets one of them is not binding on the enterprise on which it was imposed (Article 13(1)).

The Grey List: Seven Terms Presumed Unfair

Article 13(5) of the Data Act lists seven terms that are presumed unfair when unilaterally imposed, and the enterprise that imposed the term may rebut the presumption by showing that the term is not unfair in the specific case (recital 62). The points cover four subjects: liability in point (a); the other party's data in points (b), (c) and (e); termination in points (d) and (f); and unilateral changes in point (g). Point (f) applies "except where there are serious grounds", and the notice is judged by the other party's possibility to switch to an alternative and comparable service and by the financial detriment caused.

Terms presumed unfair, rebuttable, Article 13(5) Regulation (EU) 2023/2854.

The second subparagraph of Article 13(5) limits point (g). A right to change a contract of indeterminate duration unilaterally stays unaffected where the contract specifies a valid reason, reasonable notice of each change is required, and the other party may terminate at no cost.

What Article 13 Leaves Outside the Test

Three kinds of term are never unfair under Article 13 of the Data Act: terms reflecting mandatory Union law, terms reflecting the Union law that would apply if the contract were silent, and terms defining the main subject matter or the adequacy of the price as against the data supplied. The first two come from Article 13(2), the third from Article 13(8).

The price level itself is therefore not reviewed. A term letting one party substantially change the agreed price without a valid reason and a termination right can still fall under grey-list point (g).

What Happens to an Unfair Term

An unfair term is not binding on the enterprise on which it was imposed, and the rest of the contract stays binding where the unfair term is severable (Article 13(1) and (7) of the Data Act). The parties cannot exclude the application of Article 13, derogate from it or vary its effects (Article 13(9)).

The fines that General Data Protection Regulation (GDPR) supervisory authorities may impose under Article 40(4), within their personal-data competence, cover Chapters II, III and V, not Chapter IV. Article 10(1) gives users, data holders and data recipients access to a dispute settlement body certified under Article 10(5) for disputes on the fair, reasonable and non-discriminatory terms and transparent manner of making data available under Chapters III and IV; the Commission's FAQ (Q40) calls recourse voluntary.

The Chapter IV Dates from 2024 to 2028

Four dates frame Chapter IV: entry into force on 11 January 2024, application to contracts concluded after 12 September 2025, application to qualifying older contracts from 12 September 2027, and the Commission's review of the list by 12 September 2028.

As of 5 November 2026; the pending Digital Omnibus proposal would not amend Article 13 or Article 50.

The Digital Omnibus proposal COM(2025) 837 of 19 November 2025 is pending as of 5 November 2026 (Council mandate agreed by the Committee of Permanent Representatives, Coreper, on 21 October 2026; European Parliament at committee stage), and neither the proposal nor the Council mandate would amend Article 13. The proposal and its stage are tracked under Data Act amendments: the Digital Omnibus.

By 12 September 2028, the Commission's evaluation assesses whether the Article 13 list is up to date "in light of new business practices and the rapid pace of market innovation" (Article 49(1)(g)).

Applying Article 13 to Your Own Contracts

A contract review under Article 13 of the Data Act starts by separating the data-related terms from the rest of the contract and recording which of them were negotiated. The review then runs three checks:

1. Check the conclusion date and duration against Article 50.
2. Compare each data-related term with Tables 1 and 2, then with Article 13(3).
3. Set aside terms covered by Article 13(2) or (8).

Older contracts that meet the Article 50 conditions need the same review before 12 September 2027. The contract steps for each role are listed in the Data Act compliance checklist.

The Unfair Terms Page in This Section

One page in this section goes deeper: the Commission's draft model contractual terms for data sharing, which the Commission drafted to comply with Chapter IV. They are a draft Recommendation approved by C(2025) 7750 of 19 November 2025, with formal adoption pending as of 5 November 2026. Article 41 had asked for them before 12 September 2025.

What Article 13 Does Not Cover

Article 13 controls unilaterally imposed data terms between enterprises; it does not reach consumer contracts, does not review the adequacy of prices and does not replace the cloud switching rules of Chapter VI.

How Article 13 Differs from Consumer Contract Rules

Article 13 applies only where an enterprise imposes a term on another enterprise, so a contract with a consumer is outside it. How the Data Act sits beside other Union law is set out in the Data Act and other EU laws compared.

The Commission's draft model contractual terms are written for business-to-business use and suit a consumer contract only with added consumer-law provisions, such as a right of withdrawal.

How Article 13 Relates to the Cloud Switching Contract Rules

A cloud contract between enterprises can contain data terms tested under Article 13 and switching terms required by Chapter VI at the same time. Chapter VI has applied since 12 September 2025 to existing and new contracts alike; the Chapter IV date of 12 September 2027 never applies to switching.

Article 25(1) requires the switching rights and obligations to be set out in a written contract. The switching clauses a cloud contract must contain are set out under cloud contract terms under Article 25.