The Data Act is in force – what now and how to proceed?

The Commission has recognised that there are ambiguities and uncertainties in the application of the Act. To clarify the situation, the Commission maintains a written FAQ document, which contains various clarifying statements on how the Data Act should be interpreted. The Commission has updated the FAQ document infrequently and is likely to continue updating it in the future. For example, on 12 September 2025, the date on which the main parts of the Act came into force, a dozen questions and answers were added to the document concerning, among other things, edge computing services, data format, quality and collection frequency, the use of the GDPR legal basis and the categorisation of SaaS services as data processing services. However, there is no information on the future update schedule for the document or the content of new updates. 

In addition to the update to the FAQ document mentioned above, sector-specific guidance on vehicle data was published on 12 September 2025. The purpose of this guidance is to clarify the application of the Data Act in the automotive industry. According to the guidance, its guidelines are not directly applicable to other industries, but as there is little other interpretative material available at present, it may in fact be a very useful source of information for any entity offering connected devices and related services. 

The Data Act requires the conclusion of several new agreements between different stakeholders. A group of experts appointed by the Commission has presented guidelines and templates for the content of these agreements in its final report published on 2 April 2025 (Final Report of the Expert Group on B2B data sharing and cloud computing contracts). The Commission was supposed to issue its final recommendations on model contract terms based on this final report at the same time as the obligations came into force, i.e. on 12 September 2025. However, these final recommendations have not yet been published. 

In Finland no one is currently monitoring compliance with the Data Act. National legislation establishing national authority jurisdiction over the Act is not expected to come into force until early 2026. It is practically certain that Traficom will have primary responsibility for enforcement. The Finnish Competition and Consumer Authority is responsible for monitoring consumer rights, and the Office of the Data Protection Ombudsman is responsible for monitoring tasks related to personal data.

Even before its official powers are confirmed, Traficom already provides extensive guidance and advisory services on issues related to the Data Act. The agency's approach is a refreshing exception to the often somewhat rigid and mainly ex post supervision (i.e. fining) based guidance that we are used to in Finland. However, it should be remembered that in matters of broader interpretation, Traficom will have to align its own guidance with that of its international counterpart agencies, which will inevitably delay the formation of binding interpretation guidelines. In order to formulate these consistent guidelines, a group has been set up under the European Data Innovation Board to deal with issues relating to the interpretation of the Data Act in order to maintain consistency in the interpretation of the Act between Member States.

The Commission is also setting up a Data Act Legal Helpdesk to provide direct advice on issues related to the Data Act. Its purpose is to clarify, for example, practices and mechanisms related to the protection of trade secrets contained in product and related service data to be transferred. The Helpdesk's agenda also includes the formulation of recommendations on model terms and standard clauses for cloud agreements relating to data sharing. At this stage, there is no precise information on when the helpdesk will be established or its specific mandate.

One of the objectives of the Data Act is to stimulate the data economy and accelerate innovation. There has been discussion in the market as to whether these objectives are being pursued at the expense of manufacturers and providers of products and services falling within the scope of the Data Act, whether the costs are being allocated correctly and, on the other hand, whether the Act will ultimately achieve these objectives at all. However, this debate is more political than legal in nature and, in that sense, fruitless, as the Act will come into force in any case. Nor are there any direct indications that its applicability is being narrowed, postponed or revoked, as has been done, for example, with several pieces of legislation related to sustainability (omnibus packages). The Digital Omnibus package, published by the Commission in September 2025, does not seem to focus on the Data Act, but rather other regulation dealing with data, cybersecurity and AI.

The Act does, however, include an obligation for the Commission to assess its impact by 12 September 2028 and the possibility of proposing amendments to it on the basis of that assessment. For the time being, however, it is clear that strict compliance with the Act will sometimes require significant measures from operators within its scope, without any immediate benefits for the operators themselves.

The new business opportunities opened up by the Data Act would seem to be concentrated mainly among those who use data from connected devices and related services to produce new, competing and complementary services. For example, the dismantling of the data monopoly of device manufacturers will facilitate the activities of competing maintenance and repair service providers. With regard to other value-added services, the market is likely to develop new service offerings in the future, although the extent of this remains to be seen. It is difficult to see any immediate significant positive economic effects driven by wider access to data. This change will take time. Facilitating the switching of data processing services may, of course, help new service providers enter the market, which, at least in theory, will reduce the overall costs of data storage and processing as competition increases.

Numerous ambiguities and delays in the implementing guidelines and model clauses have led some companies affected by the Data Act to postpone their efforts to comply with their obligations. The situation is undeniably unusual. The Data Act is directly applicable law in the Member States and will therefore mainly oblige operators from 12 September 2025 onwards, even though no one yet knows in detail how the obligations should be fulfilled. Nor is there yet an authority from which binding interpretation guidelines could be sought. In practice, administrative consequences for non-compliance with the Act are not yet possible, as there are no national supervisory authorities responsible for sanctioning non-compliance. At the same time, the parties on the other side of the obligations, i.e. those who gain rights as a result of them – such as users of equipment and ancillary services and customers of data processing services – can nevertheless assert their rights under the Act in the general courts, where individual judges will have to rule on disputes.

Waiting for market practices – the first data notices related to products and related services are already on the market. Agreements between data holders and users are also being concluded at an accelerating pace, and data processing services are already underway. However, it is realistic to recognise that the full implementation of the Data Act across the entire market will take years.

Our team of data economy  experts is ready to help you with all your Data Act needs, including applicability assessments and contract drafting.

This article is part of a series of articles focusing on the Data Act, which delves into individual issues  of the Act from different perspectives and in as practical a manner as possible. Previous parts of the series: