EU Data Act Compliance Pack

EU Data Act Compliance — IoT Data Sharing and Cloud Switching Obligations

The Data Act creates unprecedented data access and portability rights. If your product generates data (IoT sensors, connected vehicles, smart appliances, industrial machinery) or you provide cloud services to EU customers, you have new obligations. This pack covers them all.

• Scope Assessment: Does the Data Act apply to your products or services? IoT devices, cloud services, and data processing services in scope
• User Data Access Rights: What data must be made accessible to users and third parties — and in what format (Chapter II)
• Data Sharing Agreements: Templates for B2B data sharing under the Data Act — fair, reasonable, and non-discriminatory terms
• Trade Secret Protection: How to share data while protecting confidential business information and trade secrets
• Cloud Switching Compliance: 30-day switching requirement, data portability, and interoperability obligations (Chapter VI)
• B2G Data Sharing: When public authorities can request your data in emergencies — process and safeguards
• Contract Review: Existing contracts that may conflict with Data Act obligations — amendment guidance
• Technical Implementation: API design, data format standards, and authentication for mandatory data access endpoints

NIS2 Annex I Overlap with EU Data Act

EU Data Act overlaps with NIS2 Directive 2022/2555 in several areas — particularly where data sharing contracts, cloud switching, and IoT data access intersect with cybersecurity risk management. This pack covers the overlap zones explicitly:

• (a) Risk analysis + information system security policy — Data Act risk register template covering data sharing arrangements, third-party access, and contractual liability
• (b) Incident handling — Joint incident protocol covering both NIS2 cyber incidents and Data Act data-sharing breaches (overlapping notification windows)
• (c) Business continuity + crisis management — Cloud-switching continuity plan (Data Act Article 25), data portability runbook
• (d) Supply chain security — Data Act-aligned supplier contract clauses for ICT supply chain (Article 21(d) cross-mapping)
• (e) Network + information system security — Secure data sharing architecture patterns, API security baseline
• (g) Cyber hygiene + training — Staff training module on Data Act + NIS2 dual obligations
• (h) Cryptography + encryption — Encryption-in-transit and at-rest baselines for shared data flows (TLS 1.3, AES-256)
• (i) Access control — Role-based data access policy template, data subject access request (DSAR) workflow
• (j) Multi-factor authentication — MFA enforcement requirements for data sharing platform access

Article 21 governance: Management body accountability matrix mapping Data Act compliance ownership to NIS2 board liability requirements (director personal liability under both regimes).

Article 23 reporting: 24-hour early warning template + 72-hour formal notification template covering cyber incidents that involve data sharing arrangements (dual-regime notification to national CSIRT and data protection authority).