Entered into force on January 11, 2024, the Data Act becomes applicable as of September 12, 2025.
While the General Data Protection Regulation (GDPR), in force since 2018, protects our personal data, the Data Act addresses a different but complementary dimension: the use, sharing, and governance of non-personal data — that is, data generated by connected devices, industrial machines, or digital services.
In a world where smart devices are becoming increasingly embedded in homes, businesses, and public infrastructure, the Data Act tackles key challenges:
-
preventing manufacturers or service providers from holding a monopoly over the data generated by their products;
-
ensuring that users — both individuals and companies — have fair and transparent access to that data;
-
facilitating the secure sharing of data when it serves the public interest or drives innovation.
Understanding the Difference: GDPR vs Data Act
The GDPR applies exclusively to personal data — information that can identify an individual (such as names, email addresses, health records, etc.).
-
Example: your email address or medical data are protected under the GDPR.
The Data Act, on the other hand, applies to non-personal data generated by connected devices and digital services — such as technical, usage, or performance data.
-
Examples:
-
mileage recorded by a connected car,
-
wash cycles from a smart washing machine,
-
consumption data from a smart electricity meter,
-
performance data from an industrial machine.
-
In short: the GDPR protects your personal information, while the Data Act governs all other data generated by your connected devices.
Who Is Affected?
The Data Act directly concerns:
-
Manufacturers of connected products: including carmakers, smart appliance producers, makers of industrial machinery, and connected medical device manufacturers;
-
Providers of associated services: such as predictive maintenance operators, tracking apps, and cloud services linked to device usage;
-
Users: both individual consumers (e.g. someone using a smartwatch) and businesses (e.g. a factory operating data-generating machinery).
Principles Aligned with the GDPR
The Data Act extends several well-established GDPR principles into the realm of non-personal data:
-
Data minimization;
-
User-controlled access;
-
Transparency in how data is collected and shared.
New Rights for Users
The regulation enhances user control over the data generated by their devices:
-
Expanded portability: users can transfer all data generated by a device to another service provider (e.g. exporting smartwatch data to use with a different app);
-
Direct access rights: users can view the data generated by a device without needing to go through the manufacturer;
-
Right to information: providers must clearly inform users about the product’s capabilities in terms of data generation, storage, and sharing (e.g. whether a connected car automatically shares data with the manufacturer or insurer).
When Data Sharing Becomes Mandatory
The Data Act also outlines scenarios in which data must be shared, for example:
-
when sector-specific legislation requires it (e.g. smart meter data shared with energy regulators);
-
to serve the public interest (e.g. sharing data from medical devices or environmental sensors in the event of a health or climate emergency);
-
upon request from a public authority with a clear legal basis.
These obligations aim to balance economic innovation with the common good, while avoiding situations where manufacturers hold exclusive control over "their" data.
Conclusion
The Data Act does not interfere with the GDPR — it complements it by organizing how non-personal data can be accessed and shared.
While it introduces new obligations for manufacturers and service providers, it also empowers users — both individuals and businesses — with greater control over the data they generate.
In a world increasingly reliant on connected technologies, the Data Act represents a major step toward building a trusted European data ecosystem, where data — personal or not — is better protected, better governed, and more fairly shared.
