Europe is taking the lead in this global challenge by developing a regulatory framework around fair access to and use of data. This Data Act is an opportunity to free up inter-company data sharing and is a complement to other existing or planned regulations, notably: the GDPR, the Digital Services Act (DSA), the Digital Markets Act (DMA) and the Artificial Intelligence Act.

GDPR was published in 2016 to protect the privacy of the (business) users and came into force in 2018. Under the GDPR, protection of personal data is guaranteed by all parties involved in the processing of these personal data. The vendor must fulfil its duties as processor and/or controller, adhere to contractually agreed location of data processing (including hosting or remote support), etc… Business users need to be able to trust their vendors and must be sure that the software used or the services offered by their cloud provider are GDPR compliant. In the same way as ISO 9000 is already for years a criterium for quality, GDPR compliance must guarantee privacy for (business) users. For this, all vendors must take their responsibilities. Vendors that work in a certain industry, geography or otherwise regulatory environment shall comply with applicable regulations. Vendors shall take responsibility for the data they manage on behalf of the customer in such a way that customers can comply with regulations they are subject to.

Today, the local Data Protection Authorities enforce the GDPR process and monitor the compliance. In many countries this caused already the first discussions and legal proceedings, but it is regrettable that in 2022 (4 years after the activation) some providers still do not respect the GDPR framework or – worse – continue to dispute it with all possible efforts. The larger and more dominant vendors are, the longer they protect their position and business model but the slower they apparently adhere to the regulatory framework of an open innovation system with respect for all stakeholders. Therefore the question remains; will they respect and apply the new EU regulations coming such as Digital Services Act (DSA), Digital Markets Act (DMA), the Artificial Intelligence Act to ensure that Europe can continue to innovate and stay competitive in this global market?

We summarise all these concerns with a first principle which is also the simplest since no one is above the law and the law is for everyone. Big or small, European or non-European, software company or cloud provider … if you want to do business in the European data economy you follow the EU rules; every vendor shall fulfill existing regulatory obligations. And should do it now. No excuse.