EU Data Act Compliance Assessment

Company profile · Art. 1, Recital 10

Does your company operate in or sell into the EU market?

Includes physical products, digital services, apps or platforms used by people or businesses in the EU.

✓ Yes — we operate in or sell into the EU ✗ No — no EU presence or customers

Outside scope

Your company appears to be outside EU Data Act scope.

The EU Data Act applies to companies operating in or selling into the EU market. If this changes — new EU customers, product launches or cloud services — you should re-assess.

↩ Start again

Company profile · Art. 2(6), 2(8), 2(13)

What best describes your company's primary role?

Select the closest match — you can qualify further in the next steps.

🔧 We manufacture connected / IoT productsHardware + software, sold to users or businesses ☁️ We provide digital / cloud servicesSaaS, PaaS, IaaS, data processing 🗄️ We hold data generated by others' use of products/servicesData holder but not the original manufacturer 📥 We request or receive data from other companiesAggregator, analytics provider, data broker

Company profile · Art. 7 — SME exemptions

How large is your company?

SMEs (under 250 employees and under €50M turnover) have lighter obligations under Art. 7.

Number of employees

Annual turnover (€)

Module A · Art. 3(1) — access by design

Can users access the data your product generates, in real time?

Art. 3 requires products to be designed so users can access data directly and easily — this is a design obligation, not just a privacy one.

✓ Yes — via dashboard, app or API ~ Partially — some data is accessible but not all ✗ No — users cannot access the data we collect

Module A · Art. 4(1) — data portability

Can users export their data in a machine-readable format?

Art. 4 requires data to be portable — downloadable in a common structured format (e.g. JSON, CSV, XML) so users can take it elsewhere.

✓ Yes — structured export is available ✗ No — no export feature exists

Module A · Art. 4(1)

Do you have a timeline to implement data portability?

Export capability is mandatory under Art. 4 for connected products sold in the EU from September 2025.

📅 Yes — planned within 12 months ✗ No — not currently planned

Module B · Art. 5 — third-party sharing

Do you have a formal process for users to request data sharing with a third party?

e.g. a repair company, insurer, analytics platform — any party the user nominates to receive their data.

✓ Yes — formal mechanism exists ~ We handle requests informally, no formal process ✗ No mechanism exists

Module B · Art. 6 — B2B data sharing contracts

Do you have contractual templates for B2B data sharing?

Art. 6 requires that when data is shared with third parties there must be fair, documented contractual terms.

✓ Yes — standard data sharing agreements are in place ✗ No — we share data informally or under general T&Cs

Module B · Art. 9 — compensation

Do you charge for providing data to third parties?

Art. 9 permits charges but limits them to reasonable, cost-reflective, non-discriminatory amounts.

✓ No — data is provided free of charge 💰 Yes — we charge a fee 💭 Not yet — we're considering monetisation

Module B · Art. 6(2)(e) — purpose limitation

Do you use data received from other companies only for the agreed purpose?

Art. 6(2)(e) prohibits using received data for purposes beyond what was agreed — including training competing AI models.

✓ Yes — strictly limited to the agreed purpose ~ We use it more broadly in some cases ❓ Not applicable — we don't receive data from others

Module C · Art. 13 — contract fairness

Have your B2B data sharing contracts been reviewed against the Art. 13 blacklisted terms?

Art. 13 blacklists certain clauses that are automatically void — e.g. unilateral modification rights, data exclusivity clauses, excessive liability limits.

✓ Yes — legal review completed ~ Partially — some older contracts haven't been reviewed ✗ No — this review hasn't been done

Module C · Art. 13(2)(a–d)

Do your contracts contain any of these clause types?

Unilateral right to change terms · Limit liability for inaccurate data · Exclusive rights over data · Prevent use of competing services

✓ None of the above ✗ One or more may apply ❓ Unsure — contracts need review

Module D · Art. 23 — scope

Do you provide cloud or data processing services to customers?

Includes SaaS, PaaS, IaaS, managed databases, analytics platforms — any service where customers store or process data with you.

✓ Yes — customers store or process data with us ✗ No — we don't provide data processing services

Module D · Art. 25 — switching assistance

Do customers have a documented right and process to switch to a competing provider?

Art. 25 requires you to actively facilitate switching — not just permit it. This includes technical assistance, data export and transition support.

✓ Yes — documented switching process exists ~ We allow switching but have no formal process ✗ No — switching is difficult or penalised

Module D · Art. 29 — egress fees

Do you charge customers egress or data export fees?

Art. 29 phases out egress fees. From September 2027 you cannot charge for data export when a customer is switching provider.

✓ No egress fees charged ⚠️ Yes — we charge for data export ❓ Fees are bundled — hard to separate

Module E · Art. 15–22

Have you received — or do you expect — data requests from a government or public body?

Under Art. 15–22, public sector bodies can request non-personal data in exceptional circumstances such as public emergencies.

🏛️ Yes — we have received government data requests ❓ Not yet, but it's plausible in our sector ✗ Very unlikely given our data type

Module E · Art. 17–19 — validation & safeguards

Do you have a documented process to validate and respond to public sector requests?

Includes: verifying the legal basis, assessing proportionality, protecting trade secrets, logging the disclosure.

✓ Yes — formal procedure exists ✗ No — we would handle it ad hoc

Module F · GDPR interface · Art. 1(4)

Does any data your product or service generates include personal data?

Personal data = any information relating to an identified or identifiable person. Names, IPs, device IDs, location and behavioural data can all qualify.

✓ Yes — some or all data is personal data ~ Mixed — some personal, some non-personal ✗ No — purely machine-generated non-personal data

Module F · GDPR Art. 6 — lawful basis

Do you have a documented GDPR lawful basis for each Data Act sharing activity?

Each time you share personal data — even when mandated by the Data Act — you still need a GDPR lawful basis. The Data Act does not override GDPR.

✓ Yes — documented for all sharing activities ~ Partially — some activities aren't mapped yet ✗ No — GDPR mapping not done for Data Act obligations

Module F · GDPR Art. 35 — DPIA

Have you completed a DPIA for high-risk data sharing activities?

Where Data Act-mandated sharing involves large-scale, sensitive or novel processing of personal data, a DPIA is required under GDPR Art. 35.

✓ Yes — DPIAs completed where required ❓ Not sure if our activities trigger a DPIA ✗ No DPIAs completed

Almost done

Get your free report

Free during beta — your personalised PDF report will be ready to download instantly. We don't share your details with third parties.

Company name

Your email address

Free during beta · No payment needed · Download instantly