Published on
The EU Data Act (Regulation (EU) 2023/2854) gives users of connected products the right to access the data those products generate and to have it shared. It applies to manufacturers wherever they are established and has applied since 12 September 2025. Selling into the Netherlands from outside the EU? Give your Dutch distributor the pre-sale data information now.
Part of our overview of EU product law for companies selling into the Netherlands.
Who does the EU Data Act apply to?
The EU Data Act applies to manufacturers of connected products placed on the market in the Union and to providers of related services, irrespective of their place of establishment (Article 1(3)(a) of Regulation (EU) 2023/2854).
A connected product obtains, generates or collects data about its use or environment and can communicate that data (Article 2(5)). A related service is a digital service, including software but not an electronic communications service, that is connected with the product at purchase so that the product cannot perform one or more of its functions without it, or that the manufacturer or a third party connects later to add to or adapt the product’s functions, for example with updates (Article 2(6)).
| Role | Core obligation | Article |
|---|---|---|
| Manufacturer; provider of a related service | data accessible to the user by default, for products and services placed on the market after 12 September 2026 | Art. 3(1), 50 |
| Seller, rentor or lessor, “which may be the manufacturer” | information to the user before the contract | Art. 3(2) |
| Data holder | makes data accessible to the user and, on request, to a third party | Art. 4(1), 5(1) |
| User, which can be a business | no competing connected product with the data | Art. 2(12), 4(10) |
| Third party, such as a maintenance company | agreed purpose only; no competing product | Art. 6 |
The Data Act is not a CE-marking regime. For cybersecurity rules, see the Cyber Resilience Act.
What changes for a manufacturer outside the EU?
A manufacturer outside the EU falls under the EU Data Act once its connected products are placed on the EU market. It must designate a legal representative, and its EU seller will need its data information (Articles 3(2), 37(11)).
Before the purchase, rent or lease, the seller, rentor or lessor gives the user at least (Article 3(2)):
- the type, format and estimated volume of product data;
- whether it generates data continuously and in real time;
- whether it stores data on the device or a remote server, and for how long;
- how the user can access, retrieve or, where relevant, erase the data.
If you provide a related service, such as an app, you give the user information before the contract yourself, including who the data holder is, whether you use the data yourself and the user’s right to complain to the competent authority (Article 3(3)).
Authorities can address that legal representative alongside or instead of you; it cooperates and, on request, shows what you have done to comply (Article 37(12)). It is not the authorised representative of product regulation.
A data holder may use readily available non-personal data only on the basis of a contract with the user, and may not pass non-personal product data to third parties except to fulfil that contract (Article 4(13) and (14)).
A business outside the EU often thinks the Data Act only applies to businesses with an establishment in Europe. That is not right: what counts is whether you place connected products on the European market. You must then also designate a legal representative in one of the Member States, whom the regulator can turn to. Your European seller or rentor must inform the customer about the data before the purchase, so it will ask you for that information.
Chapter II does not apply to data from products made or services provided by a micro or small enterprise, unless it has a larger partner or linked enterprise or works as a subcontractor for the design or manufacture of the product. The same applies to an enterprise that has been medium-sized for less than one year, and to products for one year after a medium-sized enterprise placed them on the market (Article 7(1)).
When does the EU Data Act apply?
The EU Data Act has applied since 12 September 2025, including the user’s access and sharing rights. The design obligation of Article 3(1) applies only to products and services placed on the market after 12 September 2026 (Article 50).
| Event | Date | Source |
|---|---|---|
| Adoption | 13 December 2023 | title |
| Publication | 22 December 2023 | OJ L, 2023/2854 |
| Entry into force | twentieth day after publication | Art. 50 |
| General application, including access and sharing rights | 12 September 2025 | Art. 50 |
| Design obligation | products placed on the market after 12 September 2026 | Art. 50 |
| Unfair terms (Chapter IV) | contracts concluded after 12 September 2025 | Art. 50 |
| Chapter IV for older contracts | from 12 September 2027, if of indefinite duration or expiring at least 10 years from 11 January 2024 | Art. 50 |
| Dutch implementing act in force | 21 November 2025 | Stb. 2025, 372 |
Products placed on the market before 12 September 2026 need not be redesigned, but Articles 4 and 5 apply to them. Connected products placed on the market after that date must make the data accessible by default: easily, securely, free of charge, in a structured, commonly used and machine-readable format (Article 3(1)).
The contracts come first. Users’ access rights have applied since September 2025, also for products already at your customers’ sites. On top of that, you may only use your customers’ data yourself if you have agreed that with them. Many manufacturers have used that data for years for service and product development without it being written down anywhere. One good data use agreement solves that. The design obligation for new products comes next, together with your development team.
How does the EU Data Act work in the Netherlands?
The Uitvoeringswet dataverordening (Dutch Data Act Implementation Act, Stb. 2025, 372), in force since 21 November 2025, makes the Authority for Consumers and Markets (ACM) the main regulator (Articles 3–5).
- The ACM is the competent authority for most of Chapter II and for Chapters III, IV and VI to VIII, and the data coordinator; the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) handles the personal data parts (Articles 3 and 4).
- The ACM can impose an administrative enforcement order (last onder bestuursdwang) or a fine of up to the amount of the sixth category of Article 23(4) of the Dutch Criminal Code or, if higher, 10% of the offender’s annual turnover in the European Union in the preceding financial year (Article 8(1)).
These powers concern entities that fall under Dutch competence, such as your Dutch distributor. If you designate your legal representative here, the ACM supervises that representative’s obligations (Articles 3(1) and 8(1)).
A Dutch customer that contests a decision to withhold, suspend or refuse data can complain to the competent authority or, if you both agree, refer the matter to a certified dispute settlement body; the courts remain open (Article 4(9) of the Data Act). The ACM’s guidance, the Leidraad Data Delen of 15 May 2026, is a provisional version that it will revise and make final.
Has your Dutch distributor or a Dutch customer asked for data? I can set out what you must supply and record the roles in your contracts: contact me as your product law partner in the Netherlands.
What do you do when a Dutch customer asks for all the data from your machine?
When a Dutch business customer asks for the data from your connected product, the data holder must make readily available data and its metadata accessible without undue delay and free of charge, on a simple request (Article 4(1)).
Do not say yes or no straight away; first find out what is being asked. I start with three questions:
- is the person asking really the user of this product;
- which data exactly are involved;
- do they contain trade secrets?
Data you can supply without effort, you supply quickly and free of charge; that is the rule. If trade secrets are involved, you record before delivery how the customer keeps them confidential. Refusing or suspending is possible only in the cases the regulation names, and then in writing and with reasons that the regulator also gets to see. Answering quickly and clearly prevents a complaint.
For trade secrets, the data holder identifies them and agrees confidentiality measures with the user; without agreement or after a breach, it may withhold or suspend sharing. It may refuse only in exceptional circumstances, case by case, if it holds the trade secret and can show on objective grounds that serious economic damage is highly likely despite the user’s measures. Decisions go to the user in writing with reasons and are notified to the competent authority (Article 4(6)–(8)).
If the customer wants the data sent to a maintenance company, the data holder makes it available to that third party, free of charge to the user (Article 5(1)). Terms must be fair, reasonable and non-discriminatory; compensation must be reasonable and, for an SME recipient, may not exceed the costs of making the data available (Articles 8(1), 9(1) and (4)).
Cooperate, and record it properly. The customer’s right to have data given to a third party is the heart of the regulation, and a maintenance company is exactly the kind of party it is meant for. What you may and should arrange: that the third party uses the data only for the agreed purpose, does not develop a competing product with it and protects trade secrets. In such a business relationship you may ask for a fee if it is reasonable; for a small recipient, no more than your costs.
What can you arrange yourself, and where do you need your engineers?
You can arrange a lot yourself: a data inventory per product (which data, format, storage), a technical access route for users, and the Article 3(2) information in the sales documentation for your EU distributor.
The design obligation for products placed on the market after 12 September 2026 is work for your engineers (Article 3(1)); see also information and communication technology law in the Netherlands.
When do you need a Dutch lawyer for the EU Data Act?
You need a Dutch lawyer when you designate a legal representative, agree with your Dutch distributor or customer who supplies which data on what terms, want to withhold or refuse data, or face ACM questions.
| Your situation | At stake | What MAAK Advocaten does |
|---|---|---|
| Your Dutch distributor asks for data information or access | Art. 3(2), 4(1) | record roles and response times in the distribution contract |
| A Dutch customer wants data with trade secrets, or sent to a third party | Art. 4(6)–(8), 5 | assess the request, agree confidentiality, draft written reasons |
| You have no EU establishment | Art. 37(11)–(12) | draft the mandate of your legal representative |
| You use customer data for service or development | Art. 4(13)–(14) | draft the data use agreement |
| Your contracts contain data clauses | Art. 7(2), 13 | review, redraft, negotiate |
| The ACM asks questions or announces a measure | Uitvoeringswet, Art. 8 | prepare a zienswijze (written view), objection and appeal |
Under Article 13, an unfair data clause that one business unilaterally imposed on another does not bind. A term is unilaterally imposed if one party supplied it and the other could not influence its content despite trying to negotiate; the supplying party must prove otherwise (Article 13(6)). Excluding or limiting the imposing party’s liability for intentional acts or gross negligence is always unfair (Article 13(4)); blocking the other party’s use of the data it provided or generated is presumed unfair (Article 13(5)). See also IT contracts under Dutch law.
Who handles users’ requests. Your distributor or dealer often gets the request for data first, but you have the data. So record who answers, within what time, who supplies the information before the sale, and how trade secrets are protected when data goes to a third party. Look at your own terms too: a term you imposed unilaterally that takes the other party’s data away or excludes your liability for gross negligence does not hold up under the Data Act.
Example: connected compressors sold through a Dutch distributor
Under the EU Data Act, a Dutch business customer has a right to the data of a connected product it bought, even one placed on the market before 12 September 2026, and may have it shared (Articles 4(1), 5(1), 50).
Suppose a Canadian manufacturer sells connected compressors through a distributor in Eindhoven and keeps the operating data on its servers. A Dutch food producer that bought three in 2025 wants the data sent to a maintenance company.
The design obligation does not apply to these compressors, but the manufacturer, as data holder, must make the data available to the maintenance company (Article 5(1)). If the distribution contract is silent on who answers, the request bounces between Eindhoven and Canada.
This is a hypothetical example for illustration, not a description of a MAAK Advocaten case.
How does MAAK Advocaten work on EU Data Act matters?
MAAK Advocaten N.V., a law firm in Amsterdam, acts for non-EU manufacturers and their Dutch distributors and customers, in negotiations, before the ACM and in court.
In the first days we map who is the data holder, which data are involved and when each product was placed on the market; then we review your contracts. In disputes we act at first instance and on appeal.
Calmly and completely. I first establish the deadline and read what exactly is being asked. Then we supply, in good order, what was requested, together with what you have already done: which data you supply, how, and why you refused in a particular case. If the ACM announces a measure, we submit a zienswijze. If it cannot be settled in discussion, bezwaar and beroep follow. A regulator mainly wants to see that you take the rules seriously; a good file does more than a sharp letter.
Frequently asked questions about the EU Data Act
Does the EU Data Act already apply to my connected products?
The EU Data Act has applied since 12 September 2025, including users’ access and sharing rights. The design obligation, data accessible by default, applies only to products placed on the market after 12 September 2026 (Article 50).
Does the EU Data Act apply to a manufacturer without an EU establishment?
The EU Data Act applies to manufacturers of connected products placed on the market in the Union, irrespective of where they are established (Article 1(3)(a)). Without an EU establishment, you must also designate a legal representative in one of the Member States (Article 37(11)).
Who enforces the EU Data Act in the Netherlands?
In the Netherlands, the Authority for Consumers and Markets (ACM) is the competent authority and data coordinator under the Uitvoeringswet dataverordening. The Dutch Data Protection Authority supervises the personal data parts. The ACM can impose an enforcement order or a fine on entities under Dutch competence.
When should a non-EU manufacturer call a Dutch lawyer about the Data Act?
A non-EU manufacturer should call a Dutch lawyer when it designates a legal representative, when its Dutch distributor asks for data information, when a Dutch customer wants data that includes trade secrets, or when the ACM asks questions.
Primary sources
- Regulation (EU) 2023/2854 of 13 December 2023 (Data Act), OJ L, 2023/2854, 22.12.2023; ELI: http://data.europa.eu/eli/reg/2023/2854/oj
- Uitvoeringswet dataverordening, Stb. 2025, 372, in force 21 November 2025 (Articles 3–5 and 8)
- Authority for Consumers and Markets: Leidraad Data Delen, provisional version of 15 May 2026
Last checked on 30 October 2026 · next relevant date: 12 September 2027 (Chapter IV applies to certain contracts concluded on or before 12 September 2025)
Does a Dutch distributor or customer want data from your connected products? Put your situation to me through my page as product law partner in the Netherlands. — Martin Krüger
