Data Act in practice: Model Contractual Terms and Standard Contractual Clauses

Control of data is ever-more important – and that definitely includes data in the cloud. At Beltug’s 2025 VIP Evening, Claude joined Ioana Mazilescu, the EC’s Deputy Head of Unit for digital transition and judicial training. They discussed the Data Act, its impact on cloud contracts, some practical examples of opportunities, and the work of B2B Data Sharing and Cloud Computing expert group. Below is the text of Claude’s speech.

“Here are four key things that will change when the Data Act becomes a reality on 12 September 2025:

1. The ease of switching cloud service providers

Today, fewer than 5% of cloud service contracts have a good switching and exit clause. Most companies move to the cloud without any clear idea of how to get their data back, how long it might take, or how much it might cost. So they are effectively locked in.

The Data Act aims to address these issues. Article 23 says that providers of data processing services shall not impose and shall remove pre-commercial, commercial, technical, contractual and organisational obstacles to effective switching.

This means that even if your contract doesn’t specifically include a good switching and exit clause, as of 12 September 2025, the Data Act applies, and the providers have the following obligations:

• They must allow the customer to switch within a transitional period of maximum 30 days or if technically not feasible, maximum 7 months
• They must provide reasonable assistance with switching at a cost that cannot exceed the real cost
• After 12 January 2027, they must do this with no cost at all

What does this mean in practice?

Generally, companies won’t be directly impacted because they are satisfied with their existing provider, and also know how difficult, risky and time-consuming switching can be. So there are incentives to remain with your existing provider.

But if you are really unhappy with your existing provider, you have a way out: you send a notice to your provider requiring that it apply the Data Act. Switching will still be difficult, risky and time-consuming, but from 12 September 2025, you will have a well-regulated way out – which is not the case today!

2. Data sharing in the Business-to-Consumer market

This is a market in the making, a new market, and the Data Act wants to give it a boost.

Let us take a practical example:

1. You buy a car.
2. The car is an object that produces data and sends it to the manufacturer.
3. This includes data about the car itself and data about your driving.
4. Of course you are a good driver and you want your insurance company to know this.

How can you do this today? Are you the owner of the data generated by your driving? Is the manufacturer the owner of the data generated by the car?

The Data Act is not interested in who is the owner. It looks at:

• Who is the ‘user’ of the product: you
• Who is the ‘data holder’: the manufacturer

And it creates new rights for the user (you) and new obligations for the data holder (the manufacturer).

The data holder must make the data available to the user as quickly and as easily as possible. The user can also ask the data holder to transmit data to a third party (the ‘data recipient’).

So, in our example, the car manufacturer must enable you to have them transmit certain data to your insurance company.

3. Data sharing in the Business-to-Business market

Let us have a look at another example: equipment for material handling in warehouses. So forklifts, etc. Let’s say there is a Belgian company that is specialised worldwide in the management of this kind of ‘offroad industrial fleets’, and it manages more than 100,000 machines in 60 countries.

It operates in a heterogeneous market:

• Different manufacturers
• Different engines (diesel, gasoline, electrical)
• Different systems (mechanical, hydraulic, electrical)

How does data sharing work today?

The manufacturer installs a gateway and a SIM card on the machine, and asks for a maintenance contract with the user

The producer of the engine (usually) installs another gateway with another SIM card and asks for another maintenance contract with the user

A telematics company comes along wanting to provide additional services:

• GPS location for track and trace
• Access control
• Usage reports
• Collision reports
• Preventive maintenance
• …

To do this, the telematics company has to install a third gateway with a third SIM card on the machine.

Clearly, today, there is very little data sharing. But the Data Act intends to change this, with Article 5: Right of the user to share data with third parties.

In our example, the user can ask the manufacturer to send the necessary data to the telematics company, eliminating the need for the third gateway and SIM card.

But what about the meaning of the data? The Data Act takes it further and says that the data holder must also share the relevant metadata needed to interpret the data.

However, while the principles are now there, the question remains of how fast and to what extent they will be implemented.

4. Negotiating cloud contracts

Here we have yet another totally different topic, for which the Data Act’s Article 13 covers unfair contractual terms.

We’ll use another simple example.

In most cloud provider contracts, the customer may not breach the confidentiality of the contract, for example the conditions or pricing. The provider must not breach the confidentiality of the customer’s data. There is a sort of balance.

But the liability in case of breach is totally different:

• If the customer breaches the confidentiality of the contract, the liability is unlimited.
• If the provider breaches the confidentiality of the customer data, the liability is limited to one year’s fee.

Why is this the case? The providers claim that nobody can provide 100% security. Despite all security measures, hacking of confidential data is possible and they don’t want unlimited liability in these cases.

While this may be correct, there is another situation in which the providers should bear unlimited liability: the intentional use of confidential customer data by the provider, for example to feed its AI systems.

This might become critically important in a world where the success of companies depends on the development of Artificial Intelligence (AI) and customer data might be a ‘goldmine’.

This is no problem if the customer agrees to this. But intentional unauthorised use of confidential customer data must result in unlimited liability.

This is one of the Standard Contractual Clauses developed by the EC’s B2B Data Sharing and Cloud Computing Expert Group. When negotiating cloud service contracts, we encourage you to ask to include this clause. If the provider refuses, keep track of your request and the provider’s response. This way you can prove that the liability clause was unilaterally imposed by the provider.

Under Article 13 of the Data Act, a contractual term concerning access to and the use of data or concerning liability that has been unilaterally imposed by an enterprise on another enterprise, shall not be binding on the latter enterprise if it is unfair.”