EU Data Act Pages on Changzhou Manufacturer Websites: How Should They Be Accepted?

Direct answer: The EU Data Act (Regulation (EU) 2023/2854) is not covered by "cloud contract terms" or a "privacy policy". It entered into force on 11 January 2024 and has applied since 12 September 2025, giving users (businesses or individuals) of connected products/related services the right to access, use and share the data they co-generate, and regulating data holders, third-party sharing, trade secrets, mandatory B2B sharing, unfair contract terms, cloud/edge switching, B2G access, international government access and interoperability. Key dates: from 12 September 2026, "data access by design" applies to connected products placed on the market after that date; from 12 January 2027, cloud switching charges are fully banned; from 12 September 2027, the unfair-terms rules extend to certain legacy contracts. A manufacturer's Data Act page should state which products/services/data are in scope, how users get data, how third parties share it, how trade secrets are protected, how cloud contracts switch, and what customer data is provided—not just "we value data security".

This guide is for equipment, robotics, industrial machinery, appliances, smart hardware, sensors, automotive parts, medical devices, energy equipment and software/cloud service companies in Changzhou and nearby areas. It explains how to write and accept an EU Data Act page. Information is current to 2026-11-05. It is a review of public rules and project practice, not EU legal, data-protection, contract or compliance advice; the specific scope, data categories, contracts, trade secrets, penalties and Member State enforcement depend on the regulation, Commission guidance, national law and the contract.

How does the Data Act page relate to GDPR, AI Act, CRA, ESPR/DPP and NIS2 pages?

The EU AI Act page answers AI-system risk/duties; the CRA page answers product cybersecurity; the information-security/data-exchange page answers NDAs/access control; the customer portal/EDI page answers orders/interfaces; the ESPR/DPP page answers product-passport data. The Data Act page answers "who may use data generated by a connected product, how users get it, how third parties share it, how cloud switching works, how public bodies access it". It does not change the GDPR: personal data still needs a legal basis; it does not change IP/trade secrets either—it sets conditions for access and use.

Common breakpoints: treating the Data Act as the GDPR; treating "data security" as "data access"; treating a cloud contract as everything; saying "API open" without permissions/fees/format; promising derived data/algorithms; ignoring trade-secret/security exceptions; assuming every third party (including non-EU) must receive data; misreading the SME exemption. A page that states products, data, roles, access, sharing, contracts and cloud gives R&D, IT, legal and sales one playbook.

This page map is editorial; Data Act duties follow Regulation (EU) 2023/2854 and the European Commission Data Act page.

Which products, services and data are in scope?

The scope covers connected products (an item that obtains, generates or collects data concerning its use or environment, can communicate product data via an electronic communications service, physical connection or on-device access, and whose primary function is not storing/processing/transmitting data on behalf of anyone other than the user) and related services (a digital service connected with the product at the time of purchase/rental/lease whose absence would prevent the product from performing one of its functions, or which is subsequently connected to add functions). The data is raw/pre-processed data generated by the user's use of the product/service that is readily available to the data holder (including metadata), e.g. temperature, pressure, flow, audio, pH, level, position, acceleration, speed; both personal and non-personal data may be involved; inferred/derived data, content and highly enriched data are out of scope. The data holder is typically the manufacturer or related-service provider.

Acceptance checks: whether the product is connected/generates data; related services; data types (raw/pre-processed/derived); whether "readily available"; personal/non-personal mix; user/data-holder/third-party roles; whether the contract defines data rights. Common gaps: calling all IoT data "shareable"; treating algorithms/models/reports as raw data; ignoring related services; hardware only, no app/cloud; unclear user role; no data clauses.

Scope/data types follow Data Act Articles 2–5 and the Commission Data Act explained page; confirm specific products with legal/data teams.

Timeline: what is due in 2025, 2026 and 2027?

The Data Act was adopted on 13 December 2023, published on 22 December 2023, entered into force on 11 January 2024 and has applied since 12 September 2025 (user access/third-party sharing, cloud switching, B2B fair terms, etc.); from 12 September 2026, Article 3(1) "data access by design" applies to connected products/related services placed on the market after that date; from 12 January 2027, cloud switching charges are fully banned; from 12 September 2027, the unfair-terms rules extend to certain legacy contracts (indefinite or expiring at least 10 years after 11 January 2024); the Commission will evaluate by 12 September 2028. The Digital Omnibus may propose further amendments; keep tracking.

Do not present "12 September 2025" as "all duties completed", nor "12 September 2026" as "something for the future": new-product design must handle by-design now. State "application/design/cloud charges/legacy contracts/evaluation", subject to the OJ/Commission updates.

Timeline follows Data Act Article 50, the Commission Data Act page and the OJ text; the Digital Omnibus may bring amendments.

How should user access and data-holder duties be accepted?

Users (businesses or individuals that own, rent or lease a connected product) have the right to access the data they co-generate through the product/service and may ask the data holder to share it with a third party. The data holder must: define data access/use/sharing rights in the contract; inform the user in advance about data types, volume, frequency and access; provide simple, secure, free access; provide data in a structured, commonly used, machine-readable format; not use non-personal data without the user's agreement; not use the data to develop a competing connected product (competition in aftermarket/related services is not prohibited); micro and small companies as manufacturers/providers have partial exemptions.

Acceptance checks: user identity/permissions; data catalogue; access/API/export; format/frequency/latency; fees (free to the user); contract terms; consent for non-personal data use; competing-use restriction; SME exemption. Common gaps: charging/queuing for access; PDF/report only; unclear data catalogue; API without permissions/audit; no contract clause; using data for training/improvement by default; expanding the exemption to all duties.

User access/data-holder duties follow Data Act Articles 3–6 and Commission interpretation; confirm contracts with legal.

How should third-party sharing, trade secrets and security exceptions be accepted?

A user may ask the data holder to share data with a third party of their choice (excluding gatekeepers under the DMA); the third party may use it only for the authorised purpose and may not use it to develop a competing connected product; the Data Act does not require sharing with third parties based outside the EU. Trade secrets: the data holder and user/third party may agree confidentiality measures; if they are not respected, the data holder may withhold/suspend; it may refuse only where it can demonstrate a high likelihood of serious economic damage, and must notify the competent authority. Security exception: sharing may be limited where it would undermine product security and cause serious adverse effects on health/safety, under EU/national law. Users may challenge decisions before a court/authority/dispute body.

Acceptance checks: third-party list/authorisation; purpose limitation; DMA gatekeeper exclusion; cross-border third parties; NDA/measures; refusal reasons/evidence; authority notification; security-exception basis; complaint channel. Common gaps: giving data to any third party; no purpose limitation; treating trade secrets as a universal refusal; refusing without notification; no legal basis for the security exception; over-promising to non-EU third parties.

Third-party/trade-secret/security exceptions follow Data Act Articles 4–6 and 8–9 and Commission interpretation.

How should mandatory B2B sharing and compensation be described?

Where a data holder is obliged by EU/national law (including the Data Act) to share data with another business, the terms must be fair, reasonable and non-discriminatory (FRAND); the data holder may request "reasonable compensation", but micro/small enterprises and non-profit research organisations may not be charged more than the costs incurred. Compensation may cover technical/dissemination/storage costs; it cannot be used to obstruct sharing. Existing sectoral data-sharing obligations remain unaffected; future sectoral legislation should align with the Data Act.

Acceptance checks: source of the sharing obligation; FRAND terms; compensation calculation/costs; micro/SME/research cap; non-discrimination; technical protection measures; dispute resolution. Common gaps: compensation without a cost basis; different prices for similar customers; treating the Data Act as the only source; ignoring sector rules; locking data with technical measures; no dispute/mediation mechanism.

B2B sharing/compensation follows Data Act Articles 8–9 and Commission interpretation; confirm prices/contracts with legal/finance.

How should unfair contract terms be accepted?

The Data Act protects businesses (especially SMEs) from unilaterally imposed data terms: some terms are "always unfair" (e.g. excluding liability for intentional acts/gross negligence), others are "presumed unfair" (e.g. improperly limiting remedies/liability); an unfair term is not binding and may be severed. The rules apply to new contracts concluded after 12 September 2025; for contracts concluded on or before that date that are of indefinite duration or expire at least 10 years after 11 January 2024, they apply from 12 September 2027. Member States may have additional rules.

Acceptance checks: contract type/signing date; unilateral/negotiable; black/grey lists; liability/remedies/termination/data use; legacy scope; severability; negotiation records. Common gaps: one-size template; unfair terms hidden in annexes; legacy contracts not reviewed; no negotiation record; SME customers afraid to negotiate; unclear governing law in cross-border contracts.

Unfair terms follow Data Act Article 13 and national law; this is not contract advice.

How should cloud/edge switching be accepted?

Providers of data-processing services (cloud/edge, etc.) must meet minimum requirements on contract transparency, open interfaces, data export (commonly used/machine-readable), IaaS functional equivalence and removal of switching obstacles; customers can switch after the transition. Switching/data-egress charges may cover costs during the transition (until 12 January 2027), then are fully banned. Contracts should state the switching procedure, transition period, exportable data categories, assistance and termination/data deletion. The EU is also developing interoperability standards/common specifications.

Acceptance checks: service type (IaaS/PaaS/SaaS); contract clauses; switching procedure/timing; export format/interfaces; functional equivalence; fees (zero after 2027); data deletion/retention; assistance; sub-processors; security. Common gaps: no switching clause; export only as backup; proprietary interfaces; no functional equivalence; charges after 2027; data not deleted; sub-processors obstruct.

Cloud switching follows Data Act Articles 23–31 and Commission interpretation; confirm contracts with legal/IT.

What else matters for B2G, international access and interoperability?

B2G: public sector bodies may request data in an "exceptional need" (public emergency/non-emergency); requests must be specific, transparent, proportionate, protect trade secrets and delete data when no longer needed; compensation differs by emergency/non-emergency and company size; the same data should not be requested more than once ("once-only"). International: where non-personal data is stored/processed in the EU, third-country government access requests must meet Data Act safeguards; providers must take reasonable measures (encryption/audits/certification) and publish them, and where possible inform customers first. Interoperability: data-space participants, smart-contract vendors and data-processing providers must meet essential requirements; the Commission develops standards/common specifications.

Acceptance checks: B2G request process/legal; compensation; deletion; once-only; third-country request assessment/notification; encryption/audit/publication; data-space/smart-contract compliance; standards tracking. Common gaps: no B2G response process; complying directly with third-country requests; security measures not published; smart contracts without termination/access control; standards not tracked.

B2G/international/interoperability follow Data Act Articles 14–22 and 32–40 and Commission guidance; confirm with legal/IT.

Preparation checklist for Chinese exporters

Prepare in seven blocks: product—data—roles—access—sharing—contracts—cloud. Connected product/related-service list; data catalogue (raw/pre-processed/derived, personal/non-personal); user/data-holder/third-party/cloud roles; access portal/API/export/permissions/audit; third-party sharing/trade secrets/security exceptions; contracts (data clauses, FRAND/compensation, unfair terms); cloud switching/exit; B2G/international access. New products placed after 12 September 2026 must build "data access by design" into the architecture, not bolt it on after launch.

The most commonly missed items are "data catalogue" and "roles": many companies know they have an app/cloud but have not classified data, access permissions, third-party sharing and trade secrets; they do cybersecurity but not data access; they use old contract templates; cloud contracts lack switching/exit. Appoint a Data Act owner, maintain a data map and review quarterly.

This checklist is editorial; specific duties follow the Data Act, Commission guidance, national law and the contract.

How should the website Data Act page be written?

A public page should include: products/related services covered, data categories/scope, user access (portal/API/format/frequency/fees), third-party sharing and purpose limitation, trade secrets/security exceptions, B2B sharing/compensation, fair contract terms, cloud switching/exit, B2G/international access, contact/version. Write verifiably: state "we have a data catalogue/access process/contract terms", not "all data is open/completely free/any third party can get it".

Separate "public information" from "customer/contract documents": data dictionaries, API docs, security measures, DPIAs and contract terms are provided per permission/contract; the public page gives scope, process and contacts, and does not publish customer data/keys/vulnerability details. If supplying components or carrying out contract manufacturing, state that the company supports the machine builder/brand owner with data-access capability and does not declare the whole product compliant. Multilingual pages should match sales countries.

This page structure is editorial; external claims must be truthful and verifiable, per the regulation, guidance, national law and contract.

What must not be written?

High-risk claims: "all IoT data is open" (scope is raw/pre-processed and readily available); "data is always free" (user access is free, but mandatory B2B sharing may allow reasonable compensation); "any third party can get it" (user choice, purpose limitation, gatekeeper exclusion, no obligation for non-EU third parties); "trade secrets can never be refused" (conditional suspension/refusal with notification); "cloud is always free" (cost-based charges allowed during the transition until 12 January 2027); "all SMEs are exempt" (limited exemptions); "the Data Act replaces the GDPR" (parallel); "an API means compliant" (contracts/permissions/format/sharing/cloud also matter). These are inaccurate or misstate responsibility.

Safer wording: "product/service/data scope, access process, third-party/trade secrets, B2B/contracts, cloud switching, B2G/international and evidence, subject to the Data Act/guidance/national law". External promotion must also comply with advertising/fair-competition law; customer/personal data needs authorisation/redaction.

These red lines are editorial; whether a claim is false advertising/non-compliant is determined by regulators and the contract, and this is not legal advice.

Go-live acceptance checklist

Ten checks: product/service scope, data catalogue, user access, third-party/trade secrets, B2B/compensation, contract fairness, cloud switching, B2G/international, security/permissions, page wording/version. Each needs an owner, evidence and review date. The pass condition is not "the page says API", but that a user/customer/regulator can see which data is available, how to get it, who may use it, what is prohibited and how cloud exit works.

Before go-live, run one real product/service through: scope → data → access → sharing → contracts → cloud → B2G → security → page wording. Any step that fails is a gap in the page or the process.

This checklist is editorial; specific compliance requirements follow the Data Act, Commission guidance, national law and the contract.

Who should read this, who should not, and what decisions does it support?

It suits manufacturers in Changzhou and nearby areas that export connected equipment, robotics, industrial machinery, appliances, smart hardware, sensors, automotive parts, medical devices or energy equipment to the EU, or provide related software/cloud services, digital after-sales or predictive maintenance. It also suits R&D, IT, legal, after-sales, sales and website teams assessing a Data Act page. It does not suit businesses that do not sell to the EU, whose products are not connected/do not generate usage data, or want one page to replace legal/data-protection/contract advice.

Read it if your product has an app/cloud/remote service; an EU customer asks about data access/sharing/switching; you place new products after 12 September 2026; you are building or revising a Data Act page; or you need to separate Data Act, GDPR, AI Act, CRA, NIS2 and DPP. Skip it if you treat data security as data access, an API as everything, or the exemption as broad. It supports self-review of scope, data, access, sharing, contracts, cloud, B2G, international and page wording.

FAQ

Does the Data Act apply now?

It entered into force on 11 January 2024 and has applied since 12 September 2025; from 12 September 2026, "data access by design" applies to connected products/related services placed on the market after that date; from 12 January 2027 cloud switching charges are banned; from 12 September 2027 certain legacy contracts are subject to the unfair-terms rules.

Which data is in scope?

Raw/pre-processed data generated by the user's use of a connected product/related service that is readily available to the data holder (including metadata), personal or non-personal; inferred/derived data, content and highly enriched data are out of scope. Personal data also follows the GDPR.

Is user access free?

User access should be free, simple, secure and provided in a structured, commonly used, machine-readable format; a data holder cannot use non-personal data without the user's agreement. Mandatory B2B sharing may allow reasonable compensation, but micro/small enterprises and non-profit research organisations may not be charged more than costs.

How do third-party sharing and trade secrets work?

A user may ask for sharing with a third party of their choice (excluding DMA gatekeepers); the third party may use it only for the authorised purpose and not to develop a competing connected product; there is no obligation to share with non-EU third parties. Trade secrets may be protected by agreed measures; non-compliance allows suspension/refusal, but refusal requires a high likelihood of serious economic damage and notification to the authority.

What are the cloud switching requirements?

Cloud/edge providers must offer contractual transparency, open interfaces, exportability, IaaS functional equivalence and removal of obstacles; switching/egress charges may cover costs until 12 January 2027, then are fully banned. Contracts should state the procedure, transition period, data categories, assistance and deletion.

How should the website/customer statement be written?

State the product/service/data scope, access portal/API/format/fees, third-party/purpose limitation, trade secrets/security exceptions, B2B/compensation, contract fairness, cloud switching/exit, B2G/international and contact/version; do not write "all data is open/any third party can get it/always free". Customer/contract documents are provided on a need-to-know basis.

One-sentence takeaway

A Changzhou manufacturer's Data Act page is not about the words "data security". It should turn the connected-product/related-service scope, data catalogue, user access (portal/API/format/free), third-party sharing/trade secrets, B2B/compensation, contract fairness, cloud switching/exit, B2G/international access and evidence into a verifiable checklist—so a user/customer/regulator can see which data is available, how to get it, who may use it and what is prohibited.

Method and limitations

This is a review of public rules and project practice, not an audit or legal opinion on any company's products, data, contracts, cloud services or compliance. No undisclosed customer data, contracts or system logs were used. Scope, data, access, sharing, contracts, cloud and acceptance items are editorial suggestions, not legal/data-protection/contract conclusions. Specific scope, data categories, contracts, trade secrets, penalties and Member State enforcement depend on the regulation, Commission guidance, national law and the contract.

Sources and scope

Information is current to 2026-11-05. The following are EU official/legal pages; their articles, guidance and national law control.

1. Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act), adopted 13 December 2023, OJ L 2023/2854, published 22 December 2023: EUR-Lex. Scope, data access/sharing, contracts, cloud switching, B2G, international access, interoperability and application dates.
2. European Commission, Data Act: European Commission. Objectives, measures, implementation support, FAQs/helpdesk and the Digital Omnibus.
3. European Commission, Data Act explained: European Commission. Data scope, users/holders/third parties, trade secrets, B2B/compensation, cloud switching, B2G and interoperability.
4. European Commission, Data Act enters into force (11 January 2024): European Commission. Entry into force/application background.
5. European Commission, EU Data Act gives users control over data from connected devices: European Commission. Application from 12 September 2025 and user rights.