The EU Data Act applies from 12 September 2025. For most pure SaaS companies — software delivered over the internet with no connected physical product — the Data Act creates limited direct obligations. But the picture changes significantly if your SaaS connects to or processes data from IoT devices, or if you operate a cloud service with significant data holdings.
When the Data Act Applies to a SaaS Company
Scenario 1: Your SaaS is a "Related Service" to a Connected Product
If your SaaS is the app or cloud backend for a connected physical product — a device management dashboard, an analytics service for industrial sensors, a mobile app that reads data from a smart device — you are likely a provider of a related service under the Data Act.
Related services are defined as digital services other than electronic communications services, including software, that are connected with the product in such a way that their absence would prevent the product from performing one or more of its functions.
If that describes your product:
- You have obligations to make data accessible to users on request
- You must enable users to share their data with third parties they designate
- Data access must be by default, not requiring a special request each time
Scenario 2: Your SaaS is a Cloud Service Provider
If you provide IaaS, PaaS, or SaaS and hold substantial customer data:
- Cloud switching obligations apply (see separate article on cloud switching)
- Customers must be able to export their data in a portable format
- Egress fees for switching must be eliminated by September 2027
- Contractual terms preventing switching are void
Scenario 3: Your SaaS Has No Physical Product Tie
If you are a pure SaaS company with no IoT component and no significant data-holding cloud infrastructure relevant to the Data Act's cloud provisions:
- The Data Act's IoT data access and B2B sharing obligations do not directly apply
- Cloud switching rules apply only if you meet the definition of a "cloud service provider" under the Act
The "Related Service" Test: Four Questions
To determine if your SaaS qualifies as a related service:
-
Is there a connected physical product? Your service must be connected to a product that collects data about its use or environment.
-
Is your service necessary for the product's function? Not every app connected to a device is a "related service." The connection must be structural — the product would not work, or would lose core functionality, without your service.
-
Does your service process data generated by the product's use? The Data Act focuses on data generated through the product's operation — usage data, performance data, environmental sensor data, not data the user independently creates and uploads.
-
Are users B2C or B2B? Data Act user rights apply to both. Business users have rights to access and share data from products they use in commercial contexts. Consumer users have the same rights.
SaaS + IoT: Practical Obligations
If your SaaS is a related service:
Data access interface: Users must be able to access their data easily — through the app interface or a dedicated API endpoint. You cannot require users to contact support to retrieve their own usage data.
Third-party sharing: If a user requests you to share their data with a named third party (a competing service, an analytics tool, a consultancy), you must do so. The third party is bound by purpose limitations — they can only use the data for the agreed purpose.
Data format: Data must be provided in a commonly used, machine-readable format. JSON, CSV, or industry-standard formats qualify. Proprietary formats that are difficult for third parties to consume do not.
No discrimination: If a user exercises their right to share data with a competitor, you cannot penalise them — by restricting service access, degrading performance, or applying discriminatory pricing.
What the Data Act Does Not Require from SaaS
It does not require you to give competitors access to your proprietary data. The rights belong to users — to their usage data generated by their own activity. Your business analytics, aggregated insights, and proprietary algorithms are not in scope.
It does not override trade secret protections. Data holders are explicitly allowed to protect trade secrets. If providing access would disclose a trade secret, you can invoke trade secret protection — but you must demonstrate the claim is genuine.
It does not apply to personal data created independently by users. If a user uploads files, enters text, or creates content in your SaaS, that is not "data generated by the product's use" — it is user-created content, governed by GDPR and your service terms.
Checklist for SaaS Companies
- Map all physical product connections — do any customers use your SaaS as the backend for a connected device?
- If yes, identify what data is generated by product use vs. user-created content
- Build or confirm a data access endpoint for users to retrieve their usage data
- Implement a third-party data sharing mechanism (API or structured export)
- Review service terms — remove any clause that prevents users from accessing or sharing their data
- Confirm data export format is machine-readable and non-proprietary
- Update privacy notice and product documentation