Tool Documents

The EU Data Act

This is not legal advice. It is a summary of a published regulation, written for people choosing software.

Most guidance on avoiding vendor lock-in tells you to negotiate exit terms. In the EU that advice is now partly obsolete, and a lot of published comparison material has not noticed. For a separate operational reference from Monitask, see this resource.

Reviewed August 9, 2026. Verify the current position before relying on it.

What it is

Regulation (EU) 2023/2854, the Data Act, applicable from 12 September 2025.

For broader context, see ICO.

One of its stated purposes is limiting vendor lock-in in cloud and data processing services — making it possible to move from one provider to another.

It applies to providers operating in the EU, and it sits alongside GDPR rather than replacing any of it.

What it changes

A two-month notice period, including for fixed-term contracts. A customer can give notice and move.

A right to switch, under Article 25, to another provider or to on-premises infrastructure.

Free export of data. Charges for the export itself are the thing the regulation targets.

And a prohibition on obstacles — technical or contractual arrangements that make switching impractical. No export fees, no deliberately degraded export functionality, no artificial limits on bulk download.

What it does not change

Being precise, because overstating it is easy.

It is a right to move, not a right to walk away from obligations. Article 25 concerns switching providers; a fixed-term contract remains a contract, and fees already owed remain owed.

It does not make migration easy. Configuration, integrations and history are not solved by a data export, however free.

And it does not cover everything you might want. The categories of portable data are defined, and some of what you built is not data.

How it sits with GDPR

They stack.

Article 20 GDPR gives individuals a right to their personal data in a structured, commonly used, machine-readable format.

The Data Act gives the customer organisation a switching right over its service data.

In practice: if a vendor's standard export omits personal data fields, an Article 20 request is a separate route to them. Two instruments, two bases, and both worth knowing about before you need either.

What to ask a vendor now

Four questions, before signing.

"How do you meet the Data Act switching obligations?" A provider operating in the EU should have an answer, and many now publish a Data Act addendum alongside their terms.

"What is the notice period for switching, and does it apply to fixed-term contracts?"

"What exactly is exported, in what format, and at what cost?" The answer should be nothing, and getting that in writing costs one email.

And "what is not exported?" The more useful question, and the one the regulation does not fully answer for you.

If you are outside the EU

There is no equivalent federal right in the United States, and rights come from the contract.

Which makes the negotiation advice still current there — export format, timing and cost written into the agreement, because nothing supplies them otherwise.

And it makes an EU-facing vendor's Data Act terms worth reading anyway, because a provider that built free export for EU customers has the capability, and asking for the same treatment is a smaller request than asking them to build it.

The short version