Expert Group on B2B Data Sharing and Cloud Computing Contracts under the Data Act (EU Regulation 2023/2854) publishes final report

Introduction on 2 April 2025, the European Commission's Expert Group on B2B Data Sharing and Cloud Computing Contracts (the "Expert Group") has released its final report. It provides (i) guidelines and model contractual terms (MCTs) for data sharing and (ii)standard contractual clauses ("SCCs") for cloud computing contracts.

This report comes after a consultation of the Expert Group (17 members, including lawyers, practitioners, and academics) and a more extensive consultation (notably public webinars attended by 200-300 participants each). The report will form the basis for the incoming Commission Recommendation.

Key Highlights

1. Nature and use of clauses: The MCTs and SCCs are:

• non-binding, voluntary, and adaptable to specific contractual needs; and
• accompanied by explanations and examples to facilitate the understanding of the clauses and reflect the most common business situations.

2. Model Contractual Terms for data sharing: for contracts between data holders and users, users and data recipients, data holders and data recipients, and voluntary data sharing between data sharers and data recipients. The MCTs:

• are designed to align with the Data Act’s objectives of facilitating the availability of data, while maintaining protection measures, including details on compensation for data use and sharing, as well as remedies for the parties;
• will take into account other applicable laws, including Data Governance Act, Trade Secret Directive;
• apply in both B2B and B2C relations, but additional provisions may be needed for consumer protection in B2C scenarios; and
• are without prejudice to parties’ rights and obligations under EU and national law, notably the Data Act and the GDPR. A competent court or tribunal or competent administrative authority may set aside the contract or particular terms for non-compliance with EU or member state law.

3. Standard Contractual Clauses for cloud computing contracts: for service agreements (eg cloud contracts) between a provider and its customers in the EU. The SCCs:

• cover the main contractual issues: Switching and Exit, Termination, Security and Business Continuity, Non-dispersion, Liability, Non-Amendment; and
• aren't separate contracts (unlike MCTs), but standard clauses to be inserted into the broader service agreements.

Organisations whose products and/or services are covered by the Data Act need to start preparing for its (demanding) requirements. This includes reviewing relevant contracts and related documentation and determine what clauses are best protective of their interest. Compliance needs to be ensured by 12 September 2025.

For more information or help implementing these clauses, please contact our team at DLA Piper.