Data Act: obligations for manufacturers of connected products (IoT)

Short answer: The Data Act (Regulation (EU) 2023/2854) requires manufacturers of connected products to design their devices so that users can access generated data free of charge and in machine-readable format. The regulation applies from 12 September 2025; the design obligation for new products (Article 3 §1) applies from 12 September 2026. Micro and small enterprises are exempt from the obligations in Chapter II (Articles 3–6), but not from Chapter III (Articles 8–12).

Scope and definition of connected product

The regulation applies to connected products that collect data on use, performance or environment via their components or operating systems and communicate those data over an electronic communications network, physical connection, or on-device access. Examples include connected cars, medical devices, smart home appliances, industrial machinery and agricultural vehicles. Prototypes fall outside the definition.

Core obligations under Chapter II (Articles 3–6)

Article 3 — Design obligation: Manufacturers must design and manufacture connected products so that product data are, by default, easily, securely and free of charge directly accessible to the user in a structured, commonly used and machine-readable format. Before the contract is concluded, manufacturers must disclose the type of data, estimated volume, and retention period.

Article 4 — User right of access: Where direct access is technically not feasible, the data holder must make the data available immediately and in real time upon user request, free of charge and in machine-readable format.

Article 5 — Onward sharing with third parties: Upon user request, the data holder must transmit the data to a third party of the user's choice. The third party may only use the data for the agreed purpose and must delete it once that purpose has been achieved.

Article 6 sets obligations for the receiving third party: no profiling of natural persons beyond the agreed purpose, no sub-transfer to further third parties without user consent.

Exemption for micro and small enterprises (Article 7)

The obligations of Chapter II (Articles 3–6) do not apply to manufacturers qualifying as micro-enterprises (<10 employees, <€2 million annual turnover) or small enterprises (<50 employees, <€10 million turnover), provided they have no partner or linked enterprises falling outside those thresholds and are not subcontracted by a larger enterprise. Medium-sized enterprises (<250 employees, <€50 million turnover) benefit from a one-year transitional period after market introduction.

Important: Article 7 explicitly limits the exemption to Chapter II. Chapter III (Articles 8–12) — which governs mandatory B2B data sharing under fair, reasonable and non-discriminatory (FRAND) terms — falls outside the Article 7 exemption and applies independently.

Enforcement and penalties

Member States were required to designate competent supervisory authorities by 12 September 2025. The regulation does not prescribe fixed fine amounts; Member States must establish effective, proportionate and dissuasive sanctions. For processing of personal data, data protection authorities have concurrent jurisdiction alongside their GDPR powers.