A cloud contract renews automatically. Data export has never been tested. And only the provider likely knows what information can actually be retrieved after termination. For many companies, this isn’t an exceptional situation, but rather a well-established practice.
The Data Act changes the legal framework governing such dependencies. The European Data Regulation has generally been in effect since September 12, 2025. Further important steps will follow in 2027: Certain switching fees will be eliminated, and oversight of abusive data contract clauses will be extended to certain existing contracts.
Now is therefore a good time for management, IT, purchasing, and the legal department to jointly review contracts and technical exit options.
Effective Date: October 6, 2026.
The Data Act doesn’t take effect until 2027. Many requirements regarding data access and cloud migration are already in effect. If you’d like to start by reviewing the basics, you can find them in our article on the EU Data Act: An Overview of Data Access and Obligations.
Effective September 2026, an additional design requirement will also apply: For covered connected products and associated services placed on the market after September 12, 2026, access to product and service data must be enabled from the design stage. Direct access is required to the extent that it is relevant and technically feasible.
Two dates in particular are important for further planning:
These deadlines relate to different requirements. They should therefore not be treated as a single “Data Act deadline.” The basis for this is, in particular, Article 29 and the transitional provisions in Article 50 of Regulation (EU) 2023/2854.
Effective January 12, 2027, providers may generally no longer charge switching fees for actions required by the Data Act when a user switches providers. This also includes the corresponding data extraction fees, often referred to as “egress fees.”
Until then, reduced switching fees may not exceed the costs directly incurred by the provider as a result of the switch in question.
However, that does not mean that a complete migration project will be free of charge. The regulation explicitly distinguishes switching fees from normal service fees and penalties for early termination. Nor do the project’s own costs or services provided by a separately contracted IT service provider disappear.
A typical example: A medium-sized company wants to switch its cloud infrastructure. Data transfer by the previous provider is subject to legal requirements for switching providers. However, adapting the company’s own applications, setting up the new environment, and training employees still require significant effort.
There are also legal exceptions for certain custom-developed data processing services that are not offered on a large commercial scale. Companies should therefore first determine which rules apply to the specific service. The decisive factor is the actual characteristics of the service, not merely its product name. The definitions are set forth in Article 2, paragraph 36, as well as Articles 29 and 31 of the Data Act.
Eliminating certain fees does not solve every technical problem. Data may be exportable, yet still prove difficult to work with in the target system. Different formats, missing metadata, or proprietary features remain practical challenges.
The Data Act therefore already requires contractual provisions governing the transition. These include, among other things, transferable data and digital assets, support during the transition, the continuation of business operations, and data retrieval and deletion.
For the actual migration, a transition period of no more than 30 calendar days following the expiration of the notice period is generally provided for. This period may not exceed two months for initiating the migration. In cases where migration is technically unfeasible, the regulation provides for justified extensions. “Every cloud migration must be completed within 30 days” would therefore be too sweeping a statement. Article 25 of the Data Act is the relevant provision.
In practice, a company should be able to answer four questions:
A limited test export is often more revealing than a general assurance that a switch is “of course possible.” The only thing that’s “of course” at first is that this sentence is quick to write.
The Data Act protects companies from certain unfair contract terms that are unilaterally imposed on them by another company. This applies to provisions regarding data access and data use, as well as liability and remedies related to data-related obligations.
In this context, “imposed unilaterally” does not simply mean that one party provided the draft contract. The key point is that the other party was unable to influence the content despite attempting to negotiate.
For example, clauses that grant one party the exclusive right to determine whether the data provided complies with the contract can be problematic. Preventing the reasonable use of one’s own data—whether provided or generated—may also fall under the abuse control provisions.
These rules already apply to contracts entered into after September 12, 2025. Beginning September 12, 2027, the rules will also apply to contracts entered into on or before September 12, 2025, provided that they are either open-ended or their term ends no earlier than January 11, 2034.
Not every existing contract or every onerous clause is automatically rendered invalid as a result. The requirements must be examined on a case-by-case basis. Furthermore, the review under Article 13 does not concern either the determination of the main subject matter or the reasonableness of the price for the data provided in exchange. The details are set forth in Articles 13 and 50 of the Regulation.
As implementation proceeds, discussions are underway regarding changes to European digital law. The Digital Omnibus also includes proposals related to the Data Act.
However, as of the date of this article, the relevant procedure is still pending in the legislative process. The European Parliament’s procedural register indicates that a committee decision is still pending.
Companies should monitor this development but should not base their implementation on potential future concessions. A proposal does not alter existing contracts or obligations that are already in effect.
The best way to get started is to conduct a prioritized assessment. Which cloud services are business-critical? Which data agreements are long-term? Where are there technical or contractual dependencies?
This should be followed by a joint review by the IT, purchasing, and legal departments. The contract outlines the termination options; a technical test will determine whether they work in practice. These two results go hand in hand.
As a guide, the European Commission provides non-binding model contracts for data use and cloud computing in a draft recommendation. These can assist in the review process but do not replace the need to tailor the terms to the specific service and business model.
Data protection and information security remain integral parts of this work. An export must not result in the uncontrolled dissemination of personal data, access information, or confidential business documents. The Data Act does not grant blanket authorization for any data transfer.
In Germany, the Federal Network Agency has been the central point of contact for the Data Act since May 30, 2026, and oversees its implementation.
K11 Consulting helps companies integrate data protection, information security, and organizational implementation. For legal contract reviews, this work can be coordinated with K11 Law Firm.
The Data Act strengthens companies’ ability to use data and reduce their dependence on providers. However, it is not enough for a right to simply be included in a contract; it must also be feasible to exercise that right from both a technical and organizational standpoint.
Those who review their cloud contracts, data agreements, and exit processes now can specifically account for the changes coming in 2027. Good preparation, therefore, does not begin with termination, but with the question of what will actually work afterward.