30 June 2025 • 5 minute read
The EU Data Act: A catalyst for innovation
The Data Act will create strategic opportunity for those who capitalise on it
The EU Data Act (Data Act), applicable from September 2025, is set to become a cornerstone of Europe's strategy for data. At first glance, the Data Act may be seen as another layer of compliance. But a purely compliance-driven approach risks missing its broader strategic value..
The Data Act’s preamble emphasises the intent to enable the use of data as a strategic asset for innovation and economic growth. It creates a significant commercial opportunity for organisations who understand how to use it well.
Understanding the legal perimeter well – rights, obligations, and conditionalities – can unlock new business models, partnerships, and revenue streams.
However, there are legal and technical requirements to be navigated
The Data Act introduces several legal and technical requirements aimed at enabling easy and secure access to user data. The provisions of interoperability and portability mean that the data must be shared in accordance with EU published standards/specifications. Where these have not been published, the data must be shared in a structured, commonly used, and machine-readable format, in compliance with GDPR and other related regulations.
The Data Act also introduces safeguards to protect commercial interests. One example is that data holders are entitled to protect information that qualifies as a trade secret. The threshold for qualifying information as a trade secret is notably high. Data holders are required to proactively identify such data and demonstrate that disclosure would cause serious economic damage. Similarly, data access can be withheld on security grounds, but such exceptions must be narrowly interpreted and clearly justified. Withholding data on either of these grounds is intended as a last resort and must be accompanied by notification to the relevant national authority.
The non-compete provision is another such safeguard. Third parties receiving shared data cannot use it to develop competing connected products.
A clear understanding of these carve-outs is essential to safeguard commercial interests and ensure that enabling innovation does not come at the expense of competitive position.
Where data holders share data with third parties at the users' request, they can request compensation provided such compensation is reasonable, fair, and non-discriminatory. This contrasts with sharing data with the user, which must remain free.
New access to user data could revolutionise data-based products and services
The Data Act gives users the right to access and share certain data produced through their utilisation of connected products or related services, while imposing an obligation on data holders to make this data available. This creates a new, regulated market for usage data. Users can share data with third parties, who can potentially use it to develop new data-based products and services. The European Commission estimates this will create EUR270 billion of additional GDP by 2028.1.
This opens the door to exciting real-world applications
Potential monetisation opportunities for third parties exist across sectors, such as through delivering more bespoke solutions for customers. For example, insurers could use driving data from connected vehicles or health metrics from wearable devices to assess risk more accurately and provide more personalised cover. Similarly, third parties could provide better energy tariffs in response to smart meter data, or tailor access to credit using financial services data. In doing so, third parties can refine their segmentation as well.
Some third parties are already doing this: as an example, health insurers have long offered tailored products linked to user data. The rights introduced by the Data Act are set to enable even more sophisticated offerings with potential for broader applicability.
Access to granular usage data could also create insights into unmet needs or usage patterns. This might prompt innovative third parties to develop entirely new products, services, or business models. For example, a third party could use industrial equipment data to offer predictive maintenance as a service.
Third parties stand to benefit along with users, provided their technical readiness is bolstered by a thorough understanding of legal and business implications.
A fast-approaching implementation deadline requires prompt, considered action
The scope and complexity of the Data Act demand immediate and thoughtful action from data holders. Building the right legal framework is key to ensure compliance within a complex legal and legislative environment with competing factors including the Data Act, GDPR, specific sector regulations (e.g. medical devices), and jurisdictional perimeters etc.
This legal framework could serve as the foundation for a strategic advantage. Innovative smaller players are already beginning to capitalise on monetisation opportunities resulting from the right to user-generated data. Larger firms are beginning to explore how they can integrate such data into their broader digital strategies.
Those who assess applicability and design a value proposition around this opportunity at the intersection of legal compliance and commercial strategy will be best positioned to lead in the emerging data economy.
Find out more
DLA Piper sits precisely at this intersection. Further to legal counsel, we provide clients with digitally fluent strategic advice delivered by our integrated team of lawyers and consultants. Our team marries the complex requirements of the Data Act with your business' ambition, resulting in practical and proportionate action to build compliant, future-ready strategies.
To find out more about the Data Act, read Data Act Frequently Asked Questions answered by the EU Commission.
For further information or if you have any questions, please contact any of the authors.