Skip to content

The rules, in plain words

EU Data Act

Data Act · Regulation (EU) 2023/2854 · EU

Cloud customers get a legal right to switch provider, and the fees that made switching painful are being removed entirely.

Who it applies to. Providers of cloud and other data-processing services offered in the EU, and their customers. It also covers data generated by connected products, which is a separate strand from the cloud-switching rules.

In plain words

The cloud-switching part of the Data Act is a lock-in law. Regulators concluded that customers were technically and commercially trapped with their provider, and legislated a right to leave.

Providers have to help you switch rather than merely permit it: contractual terms that support exit, defined notice and transition periods, and cooperation in moving your data and applications out. And the switching charges that made leaving expensive are being phased out to zero.

For most organisations the practical significance is not that they intend to switch. It is that the regulation gives their DORA exit work a second legal basis, and it removes the standard excuse - that leaving is prohibitively expensive - from the conversation.

Timing

When it applies.

12 September 2025
The Data Act became applicable across the EU.
Until 12 January 2027
Switching charges are permitted but capped at the costs the provider actually incurs.
12 January 2027
Switching charges are prohibited entirely.

What it means for your architecture

The part that is decided at design time.

  • A legal right to switch is worth little if the architecture cannot exercise it - the constraint moves from commercial to technical.
  • Proprietary managed services and data gravity are where the real lock-in lives, and neither is fixed by a contract clause.
  • Egress volume and elapsed transfer time are frequently the binding constraint on any realistic exit timeline.
  • Portability is cheapest when designed in. Open table formats and standard interfaces at the data layer cost little up front and a great deal to retrofit.
EU Cloud Resilience and Exit Strategy

Read the real thing

This is an engineering explainer, not legal advice. How the rules apply to your organisation is a question for your counsel and your compliance function. What your architecture can evidence against them is the question Northkeep answers.

Also worth knowing

The other rules in play.

Book a readiness assessment All the rules