The European Union’s approach to business data is changing.
The EU Data Act has applied since 12 September 2025, creating a common framework around access to and use of data generated by connected products and related services, business-to-business data sharing, unfair contractual terms, cloud switching and interoperability.
For businesses operating in Europe, the important question is no longer simply where information is stored.
It is increasingly about who can access it, who can use it, how it can be shared, how easily it can move between systems and what happens when a business wants to change technology providers.
That changes the role of data inside an organisation. Data can no longer be treated purely as something a business collects and controls internally. In certain situations covered by the Regulation, customers and business users gain clearer rights around data generated through their use of connected products and related services, while customers of data-processing services gain stronger protections around switching and interoperability.
For organisations, this makes data management an operational issue as much as a technology issue.
One of the most significant parts of the Data Act concerns data generated through connected products and related services.
The Regulation gives users of connected products — including businesses and individuals that own, lease or rent them — greater control over data generated through their use of those products. The framework covers connected products ranging from smartphones and smart household appliances to intelligent industrial machines and other connected equipment, as well as certain related digital services.
The important distinction is that the Data Act is not simply about giving businesses access to databases.
For covered data, the framework can require data holders to make relevant readily available data accessible to users, including associated metadata, where the information falls within the scope of the Regulation. Users can also request that such data be made available to a third party of their choice, subject to the Regulation’s conditions and safeguards.
That creates a different expectation around information access.
A business using connected industrial equipment, for example, may increasingly expect access to operational data generated through that equipment rather than relying entirely on the manufacturer or technology provider to interpret and control the information.
The question becomes less “Where does the data sit?” and more “Can the organisation actually access and use the data it is entitled to?”
That is a significant change in how businesses need to think about information infrastructure.
The idea of data portability is not new.
What is changing is the extent to which European regulation is pushing businesses towards a more structured and usable data environment.
Under the Data Act, users of connected products can access data generated through their use and, where permitted, share that information with third parties. The Regulation is designed to facilitate the transfer of valuable data while protecting confidentiality, intellectual property and trade secrets.
For organisations, that means simply having data available somewhere is no longer enough.
Information needs to be identifiable, retrievable and usable.
Consider a business that operates connected machinery across several locations. The data generated by that equipment may have value beyond the original manufacturer relationship — for maintenance, performance analysis, insurance, aftermarket services or operational optimisation.
If that information is difficult to retrieve, stored in inconsistent formats or buried across multiple environments, the organisation may technically possess access rights while still struggling to extract business value from the information.
That is where data management becomes important.
The ability to locate information quickly, understand what it represents, control who can access it and move it into another business process becomes part of the organisation’s operational resilience.
The Data Act also changes expectations around cloud and other data-processing services.
Chapter VI establishes requirements intended to make it easier for customers to switch between providers or use multiple data-processing services in parallel. Providers of data-processing services must meet requirements around interoperability and switching, including making information available about switching procedures, data structures, formats and relevant interoperability specifications.
This is important for businesses that have built critical operations around SaaS platforms.
Historically, changing a major software provider could become a major internal project. Data migration, application dependencies, export restrictions, contractual terms and technical incompatibilities could all make switching difficult.
The Data Act is designed to reduce some of those barriers.
The European Commission identifies facilitating switching between data-processing service providers as one of the Regulation’s core measures for creating a more competitive European cloud market.
There is also a specific timing point businesses should understand.
From 12 January 2027, providers of data-processing services will no longer be permitted to impose switching charges on customers. Until then, reduced switching charges may still apply during the transitional period, subject to the Regulation’s conditions.
That makes 2026 an important preparation period for organisations reviewing their technology dependencies.
The question is not simply whether a provider is good today.
It is whether the organisation can move its data and continue operating effectively if that relationship changes tomorrow.
Greater access to data does not automatically mean better data management.
In fact, it can create a new governance challenge.
As information becomes easier to access and share, businesses need to understand what information they hold, where it originated, who is permitted to access it, what can be shared and what restrictions apply.
The Data Act itself includes safeguards around personal data, intellectual property, trade secrets and security. Where requested data includes personal data, applicable data-protection requirements still need to be satisfied. Trade-secret protections can also apply in certain circumstances.
This means organisations cannot treat data portability as an unrestricted “export everything” exercise.
They need enough structure around their information to distinguish between different types of data and apply the appropriate controls.
That becomes particularly important when information moves between internal teams, external providers, customers, technology platforms and third parties.
The more portable data becomes, the more important it is to know exactly what is being moved, why it is being moved, and who should be able to use it.
The Data Act may give businesses greater rights and create stronger expectations around data access, but access alone does not solve the operational problem.
Once information enters the organisation, it still needs to be managed.
A company may receive data from a connected product, import information from a cloud platform, share records with an external service provider, and maintain supporting documentation internally. If those activities happen across disconnected systems, the organisation can quickly create another layer of complexity.
Teams may have access to the same underlying information but maintain different versions.
Important records can become difficult to locate.
Access permissions may not reflect current responsibilities.
Documents and supporting evidence can become separated from the business information they relate to.
And when information needs to be exported, shared, or reviewed, employees may still depend on manual processes to reconstruct the required record.
The result is a paradox: data becomes more portable externally while remaining difficult to manage internally.
That is where businesses need to rethink their information architecture.
This is where Moebius Document Management becomes relevant.
Moebius provides a central environment for organising, searching and retrieving documents, while supporting shared access, editing and workflows, automated filing, versioning, configurable access controls and audit trails. It also provides OCR-based search and document backup capabilities designed to make business information easier to find, manage and protect.
The relevance to the Data Act is not that document management alone makes an organisation “Data Act compliant”.
It does not.
The more useful connection is operational.
As businesses face greater expectations around data access, sharing and portability, they need reliable ways to identify, organise, control and retrieve the information that sits around their business processes.
A centralised information environment can make it easier for teams to understand which records exist, retrieve supporting information, apply access controls and maintain a reliable history of documents and changes.
That becomes particularly valuable when information moves between systems.
Moebius also provides an API architecture, allowing businesses to connect the platform with other tools and systems rather than treating information management as a completely isolated function.
For organisations dealing with increasing data movement across SaaS platforms, connected services and internal applications, that ability to connect information becomes commercially important.
The Data Act is ultimately part of a wider European shift towards making data more accessible and usable. That does not mean every business must suddenly open every database or abandon existing technology platforms.
It means organisations need to understand the data relationships that underpin their operations.
Where does critical data originate?
Which systems depend on it?
Who has the right to access it?
Can the information be retrieved without significant manual intervention?
Can it be shared when required?
Can the organisation move it if a technology provider changes?
And can the business demonstrate appropriate control over sensitive information while doing so?
These questions become particularly important for businesses operating across multiple SaaS platforms and connected services. A company may have excellent software in every department and still struggle to manage information across the boundaries between those systems.
The Data Act makes those boundaries more visible.
The Data Act is often discussed as a regulatory development around data access and sharing.
But its commercial significance is broader.
When data becomes easier to access and move, businesses have more opportunities to use it across products, services, partners and operational processes. The European Commission positions the Regulation as a way to increase data availability, support data-driven innovation and create a more competitive European data economy.
That creates an important distinction between having data and being able to use data effectively.
An organisation may hold years of operational information, customer records, documents and system-generated data. If employees cannot find the relevant information, if systems cannot exchange it efficiently or if moving it requires significant manual work, much of that data remains operationally trapped.
The businesses that adapt well to the Data Act will therefore not simply focus on regulatory interpretation.
They will look at how information moves through the organisation.
They will identify where data is created, where it is stored, how it is accessed, and what happens when it needs to leave one system and enter another.
They will also review their cloud and SaaS contracts, particularly where critical business information is tied to a specific provider.
The EU Data Act has moved from future regulation to an applicable European framework. It has applied since 12 September 2025, meaning businesses should now be assessing its relevance to their products, services, data relationships and technology arrangements.
For businesses, the next stage is practical.
The question is no longer whether data will become more portable and accessible. The question is whether internal systems, contracts and processes are ready for that reality.
Businesses should assess their critical data flows, understand their dependencies on connected products and SaaS providers, review how information is stored and shared, and identify where manual processes could prevent them from responding efficiently to data-access or portability requirements.
The organisations that benefit most will be those that treat data access as an operational capability rather than a legal checkbox.
Because once customers, partners and technology providers expect data to move more freely, the value of an organisation’s information will increasingly depend on how easily it can find it, control it, share it and use it.
That is the real shift behind the EU Data Act.
It is not simply changing who can access data.
It is changing what businesses should expect their data infrastructure to be capable of doing.
Provide us with a bit of information about your business needs and we will be in touch to arrange a no commitment demonstration.
"*" indicates required fields
