Data Act 2025 and businesses: what changes for data sharing

Data Act in brief: the framework that is in place in 2026

The Data Act is the European regulation on fair access to and use of data, designed to increase data availability in the EU, reduce vendor lock-in, and simplify data sharing among users, businesses, and PAs. It entered into force on Jan. 11, 2024, and is fully applicable as of Sept. 12, 2025, with a phased-in regime for some obligations extending to 2026 and 2027.

The essential points affecting businesses in 2026:

• Right of users (including companies) to access data generated from the use of related products and services, and to share them with third parties of their choosing, in a timely manner and in machine-readable format.
• Obligations for producers and data holders to provide for “by design” access, interoperability, and fair, reasonable, and nondiscriminatory conditions for sharing, including fair compensation when provided.
• Discipline of unfair terms in B2B contracts governing data access and use, especially protecting SMEs and those in weaker bargaining positions.
• Measures to facilitate portability and switching between data processing services (cloud, data centers, platforms), reducing technical and contractual barriers.

In 2026, businesses are no longer asking “whether” the Data Act applies, but “how” to revise contracts and IT infrastructure to comply with it and make better use of it, consistent with GDPR, NIS2 and other European regulations on data, security and artificial intelligence.

What “data” means for enterprises in 2026 (even if they don't develop software)

The Data Act is not a rule for a few cloud bigwigs: it affects all businesses that use connected products or digital services that generate data in the normal course of business. In 2026 that means, concretely, most companies in manufacturing, services, logistics, energy, and many other sectors.

Typical examples of “data sources” involved:

• Industrial machinery, enterprise vehicles, IoT devices, manufacturing plants and sensors that collect data on operation, maintenance, energy consumption, downtime, and alarms.
• Management ERP (SAP Business One, Microsoft ERP, vertical solutions), CRM, HR management software, attendance software and ticketing systems that generate logs, KPIs, process tracking and usage data.
• Services cloud and data processing platforms: data warehouse, BI tools such as Power BI, cloud/VOIP switchboards, remote monitoring platforms, and predictive maintenance solutions.

Many companies, until 2025, considered this data “in the belly of the suppliers,” accessible only through proprietary portals or through ad hoc exports, often for a fee. With the Data Act, the user of the product or service now has a structural right to access and share with third parties, which changes the way IT processes and infrastructure are designed.

For Lanpartners, in 2026, the first step is often to help companies recognize where the data are (ERP, machinery, cloud switchboard , managed IT services), what rights they can exercise, and how to link these rights to network architectures, cloud migration projects, and advanced business continuity solutions.

Business-to-business data sharing: rights, obligations and limits after 2025

As of Sept. 12, 2025, the discipline of data sharing between holders and recipients is fully operational, and in 2026 the question becomes how to incorporate it into contracts and daily practices.

For enterprises using connected products and digital services:

• The data generated must be made available promptly. and, in machine-readable format, with quality and granularity comparable to those held by the manufacturer or supplier.
• At the request of the user, the holder must transmit the data directly to a third party (e.g., another maintenance provider, an IT partner, a new cloud provider), without undue delays or artificial obstacles.
• The economic conditions for making data available must be fair ; the regulations provide criteria for determining fees and for the protection of know-how and trade secrets.

For data holders (manufacturers, platform providers, cloud providers):

• They must adapt, between 2025 and 2026, contracts, systems and interfaces To allow access and sharing in compliance with the Data Act.
• They must implement technical and organizational measures to protect trade secrets, the security of systems and the rights of third parties, even when data is shared with new actors.

This directly affects relationships with software houses, ERP and CRM vendors, IoT equipment manufacturers, companies that provide IT services for enterprises, and cloud service providers, with whom Lanpartners is already in dialogue for IT management, networking, and security, as part of projects of Corporate information security and identity theft prevention .

Portability, interoperability and vendor lock-in in 2026

One of the most concrete promises of the Data Act is the reduction of vendor lock-in , especially in the cloud world and in data processing services. From 2025, providers must facilitate switching between services, and in 2026 many enterprises begin planning migrations that previously seemed impossible or too risky.

For data processing service providers (clouds, data centers, platforms):

• It is required to ensure portability of data, applications, and, to some extent, configurations , according to common technical standards and without unjustified contractual obstacles.
• Certain provisions on the design of related products and related services, which simplify access to the data generated, take effect for products placed on the market after September 12, 2026.

For user enterprises:

• It becomes more realistic to negotiate exit clauses (exit) from cloud, data center and managed services contracts, defining migration timing, formats and responsibilities.
• You can build data lake, business intelligence and predictive maintenance projects based on data from multiple sources, without remaining tied to a single proprietary ecosystem.

Not only policy but also technical choices become central on this front: Lanpartners works on technologies of backup & business continuity and on hybrid architectures that allow enterprises to move loads, data, and applications between different environments without losing control or security.

Unfair terms and B2B contracts: what to review in 2026

The Data Act contains specific discipline on unfair contractual terms related to data access and use in business-to-business relationships, with a focus on the protection of SMEs . The relevant provisions have a gradual logic, but in 2026 it is already clear that unbalanced clauses are under observation and may be declared void.

Examples of critical clauses:

• Total and unjustified exclusion of data access generated by the user's use of the related product or digital service.
• Manifestly disproportionate costs For making data available or switching to other providers.
• Unilateral changes in data conditions (access, format, frequency, sharing rights) without notice and without the possibility for the user to withdraw.

In 2026, many enterprises are:

• Initiating systematic audits of contracts with IT vendors, software houses, cloud providers, and related equipment maintainers to identify clauses inconsistent with the Data Act;
• Defining standard templates for “Data Act compliant” clauses.” to be used in new contracts or renewals, in line with future model clauses being prepared by the EU Commission.

Here the experience gained on the issues of artificial intelligence and law and AI Act: Lanpartners is accustomed to having the legal department, internal IT, and external vendors talk to each other, relating contract terms and the technical realities of the infrastructure (logs, APIs, data exports, replication, service levels).

Data Act, GDPR, NIS2 and enterprise cybersecurity in 2026

In 2026, businesses can no longer afford to treat Data Act, GDPR, NIS2, AI Act and other digital regulations as separate “silos”: data shared, moved, exported and aggregated are often the same, and obligations overlap.

Three perspectives to be integrated:

• Data protection (GDPR): any data sharing that includes personal information must comply with the principles of lawfulness, minimization and purpose limitation, as well as appropriate technical and organizational measures for security and privacy by design.
• Cybersecurity and continuity (NIS2): many enterprises fall within the NIS2 perimeter and must ensure a minimum level of network and system security; openings of data flows to third parties, new integrations, and increased portability must be designed with appropriate firewalls, network segmentation, backup systems, and incident response plans.
• Access and Sharing (Data Act): the increased circulation of data should not turn into a larger attack surface; we need access controls, logging, strong authentication, audits of partners and technical ways of transferring data.

In this light, the issues discussed in the article on the cybersecurity for law firms in 2026 and on digital identity theft incidents-the same logic of prevention, continuous monitoring, and coordinated response applies to the Data Act scenario. Lanpartners can propose integrated paths that start with a snapshot of the existing (management, cloud, networking, PEC, data center) and arrive at a governance model in which Data Act, GDPR, NIS2 and AI Act are translated into IT rules, contracts and training.

How to prepare (or catch up) in 2026: operational plan for businesses

For companies that started working on the Data Act in 2025, 2026 is the year of consolidation; for those who have fallen behind, it is the time to catch up with a pragmatic plan.

1. Update the mapping of systems and data.

• Don't limit yourself to a static list: in 2026, many companies introduced new cloud services, ERP modules, sensors or analytics tools; it's time to update the map of connected products, digital services and data flows.
• Link each system to its contracts: understand where access rights already exist, where clauses are silent or potentially abusive, where renegotiation is needed.

2. Define a prioritization strategy.

• Start with “core” systems: critical production machinery, ERP, CRM, cloud platforms with strategic or sensitive data.
• Focus on contracts that expire or renew between 2026 and 2027 to include clauses in line with the Data Act, GDPR and NIS2 from now on.

3. Review contracts and governance of supplier relationships.

• Prepare a Data Act checklist for IT contracts: data access, formats, timelines, costs, third-party sharing rights, security measures, switching and exit rules.
• Introduce, when possible, technical annexes (e.g., tabs on APIs, logs, export modes) that reflect the reality of infrastructure and IT environments managed by external partners, as described in the page on the customized IT services

4. Adapt IT infrastructure to portability and security

• Verify that the infrastructure (enterprise routers, firewalls, networking, replication and storage systems) allows for secure and traceable receipt, consolidation and sharing of data.
• Integrate the Data Act theme into business continuity strategies, referring to the best practices outlined in the guide on disaster recovery and business continuity

5. Formalizing internal policies and training paths

• Define who in the company can request data from suppliers, who can share it with third parties, with what legal and technical reviews, and how to document these decisions.
• Training management and operations staff on the new rights and obligations: what Data Act means for those working with ERP, CRM, connected machinery, cloud services, and VOIP switchboards, linking it to the paths already started on AI Act, artificial intelligence in studies, and the AI models in legal tech .

Lanpartners can support the enterprise in each of these steps, complementing work on the Data Act with projects already underway on the AI Act 2026, cybersecurity, process digitization, and managed IT services.

Lanpartners' role in 2026: data, law, infrastructure

In 2026 Lanpartners continues to position itself as the “technology concierge” for businesses and firms that want to govern their data, not just protect it. Experience in IT infrastructure, cloud services, enterprise networking, backup and continuity solutions is complemented by expertise in regulations such as AI Act 2026, NIS2 and the Data Act, creating a practical bridge between law and technology.

In concrete terms, Lanpartners can:

• Helping businesses build a reasoned map of connected devices, management, cloud services and data flows, identifying where the Data Act opens up new opportunities for access and sharing.
• Support the review of IT contracts and agreements with software houses, cloud providers, and enterprise IT service providers, including clauses that reflect both regulatory requirements and the actual technical characteristics of the systems.
• Design and implement networking, security, backup, data center, and virtual desktop solutions that make portability, interoperability and switching feasible, without compromising digital security and business continuity.
• Structuring paths of training and coaching for entrepreneurs, top management and operations staff , so that Data Act, GDPR, NIS2, and AI Act do not remain “convention matters,” but are translated into consistent day-to-day decisions.

Contact us For any further information.

Frequently asked questions

Is the Data Act already fully applicable to Italian companies in 2026?

Yes, EU Regulation 2023/2854 is fully applicable from September 12, 2025, following its entry into force on January 11, 2024. However, some obligations have gradual deadlines between 2026 and 2027, particularly those regarding the design of connected products, which concern products placed on the market after September 12, 2026, and those regarding unfair contract terms.

What rights does a company have over data generated by machinery, management software, and cloud services it uses?

The user company has the right to access data generated by the use of connected products and related services in a timely manner and in a machine-readable format. It may also ask the holder to transmit them directly to a third party, such as a new maintenance provider, an IT partner, or a cloud provider, without artificial obstacles.

Does the Data Act also concern companies that do not develop software?

Yes, the Data Act does not only concern large cloud providers but all companies that use connected products or digital services that generate data. This includes industrial machinery, company vehicles, IoT devices, ERPs like SAP Business One, CRMs, VOIP switchboards, and business intelligence tools like Power BI.

Which clauses in B2B contracts with IT and cloud providers can be considered unfair under the Data Act?

Clauses that totally and unjustifiably exclude access to user-generated data, those that impose manifestly disproportionate costs for making data available or for switching, and unilateral changes to data conditions without notice or the right of withdrawal are critical. Such clauses may be declared void.

How do the Data Act, GDPR, and NIS2 coordinate in managing data sharing?

The three regulations overlap because the shared data is often the same. The GDPR requires lawfulness, minimization, and purpose limitation for personal data. The NIS2 mandates network and system security, with firewalls, segmentation, backups, and incident response. The Data Act requires access controls, logging, and strong authentication to avoid expanding the attack surface.

If a company has not yet done anything for the Data Act, where should it start to become compliant?

You must first update the mapping of connected products, digital services, and data flows, linking each system to its respective contract. Then, it is advisable to prioritize core systems (critical machinery, ERP, CRM, strategic cloud) and contracts expiring between 2026 and 2027, using a Data Act checklist regarding access, formats, costs, security, and exit.