#2 Decoding the Data Act

Welcome to the second article in the Decoding the Data Act series.

If you are a data holder (reminder: who is a data holder), it is time to find out what additional obligations you have towards users of connected products or related services, apart from sharing data with them.

We will discuss the issue of data sharing in more detail in one of our next posts.

Do I have additional information obligations towards users?

Additional information obligations rest with the seller, lessor, leasing company or provider of a related service, who may (but need not be) the data holder. They must inform the user, among other things, about the type of data generated, the place and time of storage, and the means of access to such data, before the contract is concluded. The information obligations also apply in B2B relationships. In the event of an update or modification of a product or service resulting in additional data becoming available or restrictions being imposed on data, an additional notification must be sent.

If the data also includes trade secrets of the data holder that they wish to protect, they should also indicate this to the data recipient.

What are the obligations of the data holder in relation to the protection of personal data when making data available from a connected product/related service ("Data") pursuant to Articles 4 and 5 of the Act?

Data generated by connected products or related services may include both personal and non-personal data. The Data Act does not constitute a separate legal basis for the processing of personal data.

The legal basis for the processing of such personal data should be the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (“GDPR”).

Important!

The data holder may act as a controller (when it has the right to use personal data for specific purposes without the user's instructions, e.g. when the user has given its consent in a contract with the data holder) or a joint controller. Processors are not considered controllers.

Can the data holder use data generated by the device/service without restrictions?

No. From 12 September 2025, in order to legally use non-personal data from a product or related service, the data holder will have to enter into a contract with the user that allows this. However, it is not possible to use the data to obtain information about the economic situation, assets and production methods of the user or the user's use that could weaken the user's commercial position in the markets in which they operate.

Such an agreement must specify the ways in which the data holder may use non-personal data. This specification may be general or specific. Examples of ways in which data may be used include the following:

• performance of agreements with users or activities related to such agreements (e.g. issuing invoices, generating and providing reports or analyses, financial forecasts, impact assessments impact assessments, calculating employee benefits);
• providing support, warranty, guarantee or similar services or assessing claims by the user, data holder or third parties (e.g. regarding the malfunction of a connected product) in connection with a connected product or related service;
• monitoring and maintaining the function, safety and security of the connected product or related service and ensuring quality control;
• improving the function of all connected products or related services offered by the data holder;
• the development of new products or services, including artificial intelligence (AI) solutions, by the data holder, by third parties acting on behalf of the data holder (i.e. where the data holder decides which tasks are to be entrusted to such persons and what benefits arise from this), in cooperation with other parties or through special purpose entities (such as joint ventures);
• aggregating such Data with other data or creating derivative data in any manner consistent with lawful purpose, including for the purpose of selling or making such aggregated or derivative data available to third parties, provided that such data does not allow the identification of specific data provided to the data holder from the connected product or allow a third party to obtain such data from the data set.

Until now, I have shared Data with other third parties on terms that I have determined. Can I continue to do so?

You may share non-personal Data with third parties without the user's consent only for purposes related to the performance of the contract with the user (e.g., when using a cloud service provider that stores Data or makes the application available as part of a related service).

In other cases, the disclosure of Data by the holder to third parties requires the user's consent. The consent may be general or specify particular entities. It should indicate the permissible purposes that the person or third parties may pursue in connection with the disclosure of the Data to them, independently of the holder. Importantly, such user consent should also specify whether further disclosure of the Data is permitted. Such further consent may also be the general or specific consent of the user, and it is also permissible to specify the rules for further disclosure of the Data in the user's agreement with the data holder. In such a case, it is advisable to specify in the agreement: the entities to whom the Data may be further disclosed, any restrictions on the use of the Data, and the conditions and safeguards to be ensured by the entity to whom the Data may be further disclosed.

Important!

It is not permissible to disclose data to gatekeepers referred to in Article 3 of the Digital Markets Act, including through other entities.

Do I have new responsibilities regarding the transparency of digital applications, user interfaces or selection forms?

Yes, data holders should design user interfaces and selection forms in a way that does not hinder the exercise of rights under the Data Act.

You already know that you are a data holder and what your responsibilities are. In the next post in our Decoding the Data Act series, you will learn how to share data with other entities.