Sharing data without friction

Every day, we use all kinds of digital applications, such as smart thermostats, health apps and navigation systems. In using these applications, we almost continuously feed their suppliers with data. For the user, this often feels like progress: apps and devices are becoming smarter and making our daily lives run more smoothly. But behind that user-friendliness lies a growing dependence on a few major players.

This comes with drawbacks, such as a growing reliance on a few dominant players who control our data and make it difficult to switch to competitors. The European Union ("EU") foresaw this problem and offers the Data Act as a solution. This regulation became applicable on 12 September 2025. Since then, parties have been required to adapt their contracts to the new obligations. This article examines the role of model contractual clauses, which play an important part in regulating data sharing between businesses and users in a fair and transparent manner.

What is the Data Act?

The Data Act aims to promote access to and use of data within the EU. The Data Act provides clear rules on who may use data and under what conditions. It does so, for example, by prohibiting certain clauses qualified as 'unfair' and by requiring an exit arrangement.

Who does the Data Act apply to?

The scope of the Data Act is broad and applies, among others, to:

• manufacturers and suppliers of Internet of Things devices (such as smart meters);
• providers of related services (such as an app that corresponds with the smart meter); and
• providers of data processing services (such as cloud providers, SaaS services and data analytics platforms).

Data processing service providers must furthermore include a free-of-charge exit arrangement in their contracts and general terms and conditions as of 12 January 2027, and must extensively inform users of their rights.

What are the consequences of the Data Act?

The Data Act has necessitated far-reaching changes. The Data Act is now directly applicable, yet many businesses have still not sufficiently adapted their contracts to the new framework. Contracts therefore still need to be revised to comply with the new rules on data sharing and exit arrangements. To help businesses with this, the European Commission has developed model contractual clauses based on four scenarios.

Model contractual clauses

The European Commission's model contractual clauses are applicable in business-to-business situations involving data sharing or cloud computing contracts. Data sharing may involve, for example, a manufacturer sharing data with the user of a smart device, while cloud computing contracts cover arrangements between businesses and their cloud service provider regarding the storage and processing of data. The model contractual clauses are a practical tool for drafting balanced contracts. The Data Act clauses are explicitly non-binding. It is therefore not mandatory to adopt the model contractual clauses in full. Each organisation can tailor the model contractual clauses to its own needs, provided that the obligations under the Data Act are respected. Those who deviate too far risk having their arrangements classified as 'unfair' or 'imbalanced', and a court may void the relevant conditions.

Four scenarios

Model contractual clauses exist for four situations:

1. The data holder shares data with a user. Consider a car manufacturer making driving data from a smart car available to the owner of that car for maintenance or analysis purposes.
2. The user shares data with a third-party recipient. For example, the owner of that car requests that the data be shared with a company that analyses travel movements.
3. The data holder shares data with a third-party recipient. This may arise where a car manufacturer shares data with an analytics company at the request of the car's owner.
4. Voluntary data sharing by the data holder. An example of this is a car manufacturer sharing anonymised data on its own initiative with a research institution.

Content of the model contractual clauses

The model contractual clauses translate the obligations of the Data Act into concrete provisions. These include, among others, the following obligations:

• Access to and use of data (Article 4 of the Data Act).
• Fair compensation for transfer (Article 9 of the Data Act).
• Use solely for the agreed purpose and protection of trade secrets (Article 19).
• The GDPR continues to apply: a valid legal basis is therefore required (Article 1(5) and Article 5 of the Data Act). In practice, this will generally involve legitimate interest as the legal basis.

By incorporating the model contractual clauses into their terms and conditions, parties will know how to share, protect and use data within the framework of the Data Act.

Conclusion

The Data Act marks an important turning point in European data strategy. Where data was long primarily in the hands of a few major players, the law now establishes clear rights and obligations for everyone who generates, uses or processes data. This affects a wide range of parties: from manufacturers of smart devices to cloud service providers and the businesses that depend on them.

The model contractual clauses provide a useful framework in this regard, not mandatory, but certainly instructive. The Data Act is now in force, yet in practice many businesses have not yet fully brought their contracts into compliance. Whether it concerns revising existing contracts, drafting new data sharing arrangements or implementing an exit arrangement: we are happy to assist. Please contact us to discuss the possibilities.