The Data Act brings new opportunities and models for business

10 September 2025 | Knowledge, News

Today, 12 September 2025, the Data Act comes into force. This regulation establishes uniform rules for access to data generated by connected products (IoT) and related services, including personal, technical, telemetric, and operational data.

The Data Act also regulates access to data by public authorities in emergency situations.

Why is it a landmark regulation?

Thanks to the Data Act, users of devices or related services now have the right to request access to any data generated when using a product.

This information must be provided in a structured, machine-readable format of the same quality as is available to the entity collecting it, free of charge and without undue delay.

Who is affected by the obligations under the Data Act?

The Data Act imposes obligations on data holders. Data holders are entities that have the right or obligation to use and make available data generated when using a product or service, and include, without limitation:

Manufacturers
Operators
Maintenance service providers
Digital service providers

Obligations of data holders

Data holders must make data available to users and third parties of their choice, on clear terms and in confidence.

In particular, this includes:

Providing the user with ‘readily available data’ – without undue delay, free of charge, with metadata, continuously and in real time, if possible
Making data available to a third party designated by the user
Protecting trade secrets through appropriate technical and organisational measures (the data holder may only refuse to disclose data if they can demonstrate a serious risk of damage)
Being prohibited from practices that hinder the exercise of the right of access (dark patterns)
Keeping records of disclosures and handling requests transparently

The obligation to make data available applies to raw and pre-processed data. However, information inferred or derived from such data remains outside the scope of the Regulation.

Data Act timeline

12 September 2025 – Data Act on user rights and access by public authorities
12 September 2026 – ‘access by design’ requirement for new products and services
12 January 2027 – prohibition on charging fees for changing data processing service providers (switching charges)
12 September 2027 – contracts concluded before the Regulation comes into force will also be covered if they are of indefinite duration or long-term

What to consider now

In order to meet the requirements and prepare for access requests, it is advisable to take the following steps as soon as possible:

Inventory your data-generating devices and services
Determine which data is ‘readily available’ and must be made available, and which is derived and need not be made available
Review and adjust B2B contracts, particularly with regard to prohibited clauses affecting SMEs
Develop procedures for making data available, prepare registers and anonymisation and pseudonymisation mechanisms
Plan the process of switching cloud providers and adapt systems to ensure they are interoperable
Integrate Data Act requirements with GDPR processes, including DPIA

The Data Act also brings new opportunities and models for business

The Data Act is not just about obligations.

It also creates new opportunities. Providing access to data for independent websites, integrators, and application providers enables the development of competitive services and new business models, boosting innovation.

Companies that prepare compliance procedures in good time can avoid regulatory risks and take advantage of the opening data market.

We can help you analyse specific cases, review contracts, and develop a plan for implementing the Data Act within your organisation.

If you are interested or have any queries, please contact us.

Latest Knowledge

Dual-use items: how broad will the CJEU’s definition be?

A training aircraft designed for civilian purposes can also qualify as a military item. That’s a conclusion emerging from the Advocate General’s Opinion in Case C-538/25 (Flugzeugherstellerin) before the Court of Justice of the European Union. What does this mean for companies exporting goods from the EU?

Banking sector overview | Banking today and tomorrow | October 2026

The National Working Group is developing recommendations on the transition to a new benchmark rate – POLSTR – in agreements with retail clients, announced Tadeusz Białek, President of the Polish Bank Association (Związek Banków Polskich).

Workplace harassment and discrimination: new regulations for employers

The Sejm has passed an amendment to the Labour Code concerning workplace harassment and discrimination. The changes introduce a broader definition of the concept itself, new forms of harassment, clearer definitions of what constitutes, for example, sexual harassment, and new rules governing the handling of such cases, including the reversal of the burden of proof, higher compensation awards, and the jurisdiction of district courts. The provisions will enter into force on 5 November 2026. We examine what will change and how much time remains to adapt company documents, policies, and the organisation as a whole.

ESG Roadmap. How to identify which regulations apply to your business and build a strategy

As we know, ESG in business is a roadmap made up of numerous obligations arising from different regulatory frameworks. That is why the right question is not “how do I meet all the requirements?” but rather “which of them apply to my business?”. This is a crucial distinction. We explain how to correctly diagnose your regulatory profile and build an effective ESG strategy – one that actually works and gives you a competitive edge.

Banking sector overview | Banking today and tomorrow | September 2026

In July, Poles held PLN 1,117.5 billion in current accounts and over PLN 406 billion in fixed-term deposits of up to two years. Household debt rose by PLN 7.6 billion to PLN 869.1 billion. Meanwhile, the value of cash in circulation is already approaching PLN 500 billion.

Announcement of Income Tax Reform

On 19 August, during a press conference, the Prime Minister announced a package of tax changes planned for next year. According to the announcement, the reform is intended, on the one hand, to ease the burden on the middle class and, on the other, to shift a greater fiscal burden onto the wealthiest individuals and the largest companies. We take a look at the proposals included in the announced package and explain what they might mean for taxpayers.

Family foundations and the tax authorities: what draft bill UD447 proposes and why this is not the end of the troubles

Family foundations were intended to provide entrepreneurs with a stable framework for intergenerational wealth management. Yet not even four years have passed since the first such foundations were established, and the rules governing their taxation are set to be changed once again. This is because the scale of interest and the practical problems uncovered have overwhelmed the drafters of the legislation, as best illustrated by the figures – 927 applications for individual tax rulings and 77 opinions issued from the Head of the National Revenue Administration. This does not, however, mean that family foundations are being used on a massive scale for aggressive tax optimisation. A significant proportion of the queries concerned simply how to correctly apply the complex regulations.

Banking today and tomorrow | Financial sector overview | August 2026

Poland’s banking sector has reacted with concern to recent remarks by Katarzyna Pełczyńska-Nałęcz, the Minister of Development Funds and Regional Policy, who announced plans to put forward a proposal for a further increase in CIT levied on banks. The Minister’s reasoning, however, rests on a flawed conflation of the sector’s liquidity with its profitability, revealing a fundamental misunderstanding of how the banking sector operates and how its financial health is assessed. What is more, it feeds into a worrying trend of replacing substantive debate with simplistic, populist messaging which may be politically appealing but is not underpinned by either facts or economic analysis.

NIS2 and the National Cybersecurity System Act in transport: what you need to do before October 2026

The amended Act on the National Cybersecurity System (UKSC) has been in force since 3 April 2026. For transport sector undertakings, this means a specific compliance timeline, including an obligation to register with the National Cybersecurity System (KSC) registry by 3 October 2026. Failure to do so may result in substantial financial penalties, coupled with the risk of personal liability for senior management. Not every undertaking, however, automatically falls within the scope of the new regime. Read on to find out whether your organisation is affected and what you need to do before the deadline for preparation.

Family foundations: the government has done the maths and presented the bill

Three years. That’s how long we’ve been waiting for what the Council of Ministers had seen in the data from the outset – and has now disclosed in its review of the Family Foundation Act. The document not only diagnoses the problems, but also previews substantial changes to rules that founders and their advisers treated as settled and stable. And therein lies a problem that goes far beyond tax matters. If the rules of the game are changed while the game is being played, there can be neither planning stability nor trust in the law. It is no coincidence that one of the greatest concerns among entrepreneurs considering setting up a foundation is not the level of taxation, but the stability of the legal framework – which today is once again being called into question.