The Data Act, an EU regulation that will introduce groundbreaking rules on data access, sharing and transfer, is set to come into force on 12 September 2025. This is one of the most significant regulatory changes in recent years, and its effects will be felt by almost all industries.
Data – both personal and non-personal – has never before been such a valuable resource. It is generated by IoT devices, mobile applications, ERP and CRM systems, e-commerce platforms, and cloud solutions. Until now, companies have had relatively free rein in how they manage it. The Data Act changes this by introducing a legal framework that aims to protect users and open up the data market to innovation.
Michał Billewicz – Compliance Officer at Britenet
So, what is the Data Act, and why is it causing such a stir?
The Data Act (Regulation (EU) 2023/2854 of the European Parliament and of the Council) applies to any business entity in the EU that processes data, whether personal or non-personal. From 12 September 2025, companies will have to implement the regulations, and failure to comply may result in heavy fines.
The Data Act changes the way we think about data. It is no longer just a resource that can be collected and used at will. Instead, it is becoming a legally regulated commodity, access to which must be transparent and fair.
The new regulations include the following:
- the obligation to make data available to users and third parties designated by them;
- interoperability and the ability to transfer data between cloud services.
- a prohibition of unfair terms in B2B contracts;
- the obligation to make data available to public authorities in crisis situations;
- transparent communication about what data is collected and in what form.
The industries most affected by the changes
The list of sectors that will have to adapt to the new regulations is long. This applies in particular to:
- Technology and cloud: SaaS/PaaS providers, public and hybrid cloud operators.
- Industry and manufacturing: IoT device manufacturers, automated plants and process monitoring companies.
- Transport and logistics: fleet operators and companies using tracking systems.
- Energy and infrastructure: energy suppliers and smart grid operators.
- In finance and insurance: institutions processing transactional and analytical data.
- Retail and e-commerce: platforms that collect data on customer behaviour.
- Healthcare: manufacturers of online medical devices and telemedicine service providers.
In practice, the Data Act applies to any company that generates data, whether from devices, applications or business processes. There are no exceptions to this rule.
Key challenges for companies
The new regulations mean that many processes will need to be redesigned. The biggest challenges that experts predict for businesses are as follows:
- Data organisation: companies must know exactly what data they have, where it is stored, and what its quality is.
- Changes to IT infrastructure: ensuring interoperability and facilitating data transfer.
- New contracts and regulations: they must be transparent and comply with the requirements of the Data Act.
- A new organisational culture: employees must understand that data is a legally regulated element, not just a technical resource.
The biggest threat is not the regulation itself, but a lack of preparation. Companies that disregard the Data Act will face financial penalties and a loss of trust from customers and partners.
Where should you start preparing? Expert advice
Michał Billewicz, Compliance Officer at Britenet, recommends a four-step action plan:
- Assess the potential of data and systems – identify what data is collected and who has access to it.
- Adapt IT infrastructure to ensure interoperability and readiness for data migration.
- Update contracts and internal policies, eliminating any clauses that conflict with the Data Act.
- Training and communication – educate employees and prepare clear information for customers.
A year of preparation will lead to decades of benefits
According to the Data Act, most of the provisions will apply from 12 September 2025. However, we are less than a year away from the provisions on the obligation to design and manufacture connected products so that data is accessible by default coming into force. While this may seem like a long time, preparing an organisation — from IT infrastructure and processes to training — is a complex project that requires months of work.
Companies that start acting now will have an advantage: not only will they gain legal compliance, they will also streamline their processes. This is an opportunity to improve service quality and gain a competitive edge.
The Data Act is not just another regulation from Brussels. It is a strategic turning point in data management that will transform how companies use data. Those who treat it as an opportunity rather than an unpleasant obligation can gain a real advantage in the market. Those who disregard the new regulations risk heavy fines and a loss of customer trust.
