First Question: Who Are You Under the Data Act?

Most compliance material treats a regulation as one obligation on one kind of company. The Data Act isn’t built that way, and that’s what makes it easy to get wrong.

It creates roles — data holder, user, data recipient, third party, provider of data processing services — and attaches different chapters, with different deadlines, to each. A single company usually holds several at once, and holds different roles for different products and different counterparties.

So the first question isn’t “do we comply.” It’s “what are we, and in relation to what.” An organisation that answers that as a connected-product manufacturer and stops there routinely misses that it’s also a data processing service under Chapter VI, or a data recipient under Article 6, with a separate set of obligations and a separate clock.

The free document in this pack answers exactly that question. Start there.

Does Data Act Apply to You?

You impose standard terms on other businesses. Chapter IV makes certain contract terms about data access, use or liability non-binding if they’re unilaterally imposed and unfair — whether or not you make a connected product.

You sell software as a service. “Data processing service” is defined by function, not by size. If your service offers on-demand access to scalable computing resources, Chapter VI applies — the switching clauses, functional equivalence, and the withdrawal of egress and switching charges from January 2027. This is not a hyperscaler-only problem, though it’s widely assumed to be.

Your business runs on data from other companies’ products. Aftermarket services, maintenance providers, insurers, analytics firms — if you receive data at a user’s request, Article 6 constrains what you may do with it.

Most organisations in this position prepare to exercise the access right and forget they must also comply with its conditions.

What Data Act Requires From You

It depends on your role — which is the point — but the core duties are these:

If you make connected products or related services: data must be accessible to the user by design, you must tell buyers before they contract what data the product generates and how to get it, and you must respond to access and sharing requests without undue delay and in the same quality you hold yourself.

If you’re a data holder making data available: your terms must be fair, reasonable and non-discriminatory; your compensation must be justifiable against real costs; and any trade-secret protection must be prepared in advance — a claim first raised when a request arrives is weak.

If you provide a data processing service: you must remove obstacles to switching, put specified clauses in your contracts, ensure functional equivalence where it applies, withdraw switching charges on the timetable, and hold safeguards against unlawful third-country access to non-personal data.

What You Get in the Data Act Template Pack

Role & Chapter Applicability Assessment — The entry document. Works out which roles you hold, for which products, services and relationships, and which chapters follow. Produces a role map that tells you which of the other three documents you actually need. Completed first.

Connected Product Data Access & Sharing Record — Chapters II and III. Access-by-design assessed against each of the nine qualities the Regulation requires, pre-contract information duties, a request-handling process that can verify entitlement and resolve the personal-data and trade-secret positions, and the Article 6 conditions where you’re the one receiving data.

Data Processing Services Switching Record — Chapters VI and VII. Obstacle removal, the mandatory contract clauses, functional equivalence, the switching-charge withdrawal with a field to quantify your egress exposure, and the safeguards against third-country governmental access — including a procedure for handling a foreign order under time pressure.

Contractual Terms, Compensation & Trade Secrets Record — Chapters III and IV. FRAND terms, a defensible compensation basis, trade-secret protection prepared ahead of a request, and a Chapter IV contract-remediation review tracked across your agreement estate.

Every document follows the structure of the European Commission’s own explanatory notices and templates.

38 pages. Word format, editable.

Start With the Free One

The Role & Chapter Applicability Assessment is free, complete, and requires no email address.

Work through it. It will tell you which roles you hold and which chapters bind you — which, for the Data Act, is most of the battle. If it turns out only one chapter applies to you, you’ll know that too, and you won’t have paid for documents you don’t need.

Download the Role Assessment

Who Wrote This

Drafted by a qualified lawyer working in EU AI regulation, not assembled from a template library.

Commissioning the equivalent from a law firm is 15 to 40 hours of specialist time. At prevailing rates that is €6,000 to €18,000.

What the Price Covers

€1,249 — the full pack, including twelve months of updates.

The Data Act’s phased deadlines and the precise scope of permitted switching charges were heavily negotiated and remain subject to the EU’s wider review of its digital rulebook. When the position moves, you get the revised documents.

After twelve months, updates continue for €300 a year (billed separately), or keep the version you have.

Part of the European Compliance Suite Documentation

The Data Act rarely arrives alone. A connected product that uses AI, or a data processing service that runs AI systems, sits under more than one regime at once.

If your product uses AI, the EU AI Act applies alongside the Data Act. Consider these:

High-Risk AI Deployment Template Pack

AI Chatbot & Agent Disclosure Pack (Article 50 (1))

Synthetic Content Marking Evidence Pack (Art. 50(2))

Biometric & Emotion Recognition Disclosure Forms (Article 50(3))

If You Need More Than Documents

Pack with review — €4,500. You complete the role assessment and the records, we review them — with particular attention to your Chapter IV contract exposure and your data-processing-service classification — and write up what’s weak and what’s missing.

Product assessment — from €9,000. We do the assessment and deliver the completed pack.

Authorised representative and ongoing support. On enquiry

What This Is Not (Important)

It is documentation, not advice on your particular circumstances.

It does not decide your role for you. Whether your service is a “data processing service,” whether a contract term is “unilaterally imposed,” whether data qualifies as a trade secret — these turn on your specific facts. The pack structures the questions and records your reasoning; it does not supply the answer.

It is not a substitute for contract review. The Chapter IV analysis flags terms that may be unenforceable; acting on that across your live agreements is legal work, and that’s what the review tier is for.

It does not make you compliant. It records what you’ve done and why, in the form an authority or a counterparty is likely to expect.