Compliance Briefing — January 11, 2024

Executive briefing: On January 11, 2024, Regulation (EU) 2023/2854 — the Data Act — became effective. The law ensures users can access and share data generated by connected products, establishes contractual fairness rules, mandates interoperability for cloud services, and adds guardrails for third-country access to non-personal data.

Immediate compliance priorities

Product data mapping. Inventory IoT products and related services to identify who can request access to data and how it should be provided.
Contract remediation. Update B2B data sharing agreements to align with unfair contract term prohibitions and mandated clauses.
Cloud strategy. Plan for switching obligations, including notice periods, technical portability, and gradual phase-out of exit fees.

Control alignment

Security and confidentiality. Establish safeguards for sharing data while protecting trade secrets, including secure environments and NDAs.
Access governance. Build processes to authenticate user and third-party access requests and deliver machine-readable outputs within statutory timelines.
International transfer review. Evaluate risks of third-country access to non-personal data and implement protective measures or challenge unlawful foreign access demands.

Enablement moves

Monitor upcoming implementing acts and harmonized standards that clarify interoperability requirements.
Coordinate with product, legal, and engineering teams to redesign user interfaces supporting data access rights.
Engage with industry consortia on best practices for secure data sharing and portability.

Sources

Zeph Tech equips industrial and cloud providers to meet Data Act obligations on user access, interoperability, and cross-border safeguards.