Regulation (EU) 2023/2854
The EU Data Act on connected products: who gets the data
Updated
The Data Act decides who may use the readings a connected product makes. For a business that owns or leases machines, it is the strongest claim to that data it has ever had.
Ask about my sensor data 6 of the 11 IoT platforms we read say the readings belong to the business. Tell us what your devices log and where it is stored, and we will reply by email.
Who counts as the user
The Commission explains that the Act gives users of connected products, businesses or individuals that own, lease or rent the product, greater control over the data they generate, naming connected cars, medical and fitness devices and industrial or agricultural machinery.
Source: Sensor data rights law
What the manufacturer may not do
A data holder may use readily available non-personal data only on the basis of a contract with the user, and may not use it to derive insights about the user's economic situation, assets or production methods that could undermine the user's position.
No database right in device data
Article 43 says the database right of Directive 96/9/EC shall not apply when data is obtained from or generated by a connected product or related service in scope. Elsewhere that right runs fifteen years.
Source: Sensor data rights law
The dates
The Act applies from 12 September 2025. The duty to design products so their data is accessible applies to connected products placed on the market after 12 September 2026. Confidential trade secrets stay protected, but the holder has to identify them first.