Short answer
Under the EU Data Act, a user—a person or business that owns, rents or leases a connected product, or receives a related service—may access and use covered product and related-service data. If the user cannot obtain the data directly, the data holder must generally provide readily available data and the metadata needed to interpret it. The user may also direct the holder to provide those data to an eligible third party. A gatekeeper designated under the Digital Markets Act cannot be that third party.
Trade-secret or cybersecurity language is not a general escape clause. Trade secrets should normally be shared under proportionate confidentiality safeguards. Sharing may be withheld or suspended if safeguards cannot be agreed or are not followed; outright refusal is exceptional and requires objective, written proof that serious economic damage is highly likely despite the safeguards. Security concerns justify a contractual restriction only where access could undermine a security requirement laid down in EU or national law and cause a serious adverse effect on people's health, safety or security. Refusals trigger notification and challenge mechanisms.
What data and products are covered?
Regulation (EU) 2023/2854, the Data Act, applies here to data concerning the performance, use or environment of a connected product or related service. A connected product obtains, generates or collects such data, can communicate them, and is not principally a data-storage or communications service for someone other than the user.
The categories are narrower than “everything associated with the product”. Product data must have been designed to be retrievable. Related-service data record user actions or product-related events. Holder-mediated access concerns readily available data: data that the holder lawfully obtains, or can obtain without disproportionate effort beyond a simple operation. Relevant metadata are included. Content is outside Chapter II, and the Commission's non-binding explanation distinguishes covered raw and pre-processed data from inferred, derived or highly enriched material.
The Act applies to users in the EU and to products placed on the Union market. A manufacturer, related-service provider or data holder may be established elsewhere. The words “Text with EEA relevance” in the Regulation's title do not, by themselves, establish when or how the rules apply in the EEA.
Who may access or use the data?
The user
Where direct access is not available, Article 4 establishes the basic holder-mediated right:
“Where data cannot be directly accessed by the user from the connected product or related service, data holders shall make readily available data, as well as the relevant metadata necessary to interpret and use those data, accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time.” —
The holder should act on a simple electronic request where technically feasible. The user's status, not whether the user is a consumer or business, controls the right. The holder may request only information necessary to verify that status.
The user may analyse and share the data, including for an aftermarket service. The user may not use requested data to develop a competing connected product, share them with that intent, or derive prohibited insights about the manufacturer's or holder's economic situation, assets or production methods.
A third party chosen by the user
The user can ask the holder to send the data to a repairer, insurer, analytics provider or other eligible third party:
“Upon request by a user, or by a party acting on behalf of a user, the data holder shall make available readily available data, as well as the relevant metadata necessary to interpret and use those data, to a third party without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge to the user, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time.” —
A designated Digital Markets Act gatekeeper is expressly ineligible. The right also does not cover testing a new product, substance or process not yet placed on the market unless the contract permits that use.
The recipient may process the data only for the agreed purpose and conditions. It must normally erase them when no longer necessary, cannot send them to a gatekeeper or build a competing connected product, and cannot harm the security of the connected product or related service. Limited onward sharing requires a user contract and applicable confidentiality safeguards.
The data holder
The Act gives a holder no new free-standing entitlement to exploit co-generated data. It may use readily available non-personal data only under a user contract and must not derive insights that could undermine the user's commercial position. Nor may it disclose non-personal product data beyond performing that contract.
Personal data remain subject to the General Data Protection Regulation (GDPR) and ePrivacy rules. Where the user is not the data subject, the Data Act does not manufacture a missing GDPR legal basis. The same qualification applies when data are sent to the user's chosen third party. If data-protection law conflicts with the Data Act, the applicable data-protection or privacy rule prevails.
When can cybersecurity or safety justify restricting access?
Article 4(2) sets a confined test:
“Users and data holders may contractually restrict or prohibit accessing, using or further sharing data, if such processing could undermine security requirements of the connected product, as laid down by Union or national law, resulting in a serious adverse effect on the health, safety or security of natural persons.” —
Three elements matter. The restriction is contractual; a vague internal policy is not enough. The product-security requirement must be laid down in EU or national law. The predicted consequence must be serious and affect natural persons' health, safety or security. Ordinary inconvenience or an unparticularised claim that “cybersecurity is sensitive” does not meet that wording.
The restriction should match the risk: authentication, scoped interfaces or rate controls may address danger without blocking all data. A holder refusing to share on this ground must notify the national competent authority. The user may complain there, seek a court remedy or, by agreement, use a certified dispute-settlement body.
When do trade secrets permit withholding or refusal?
The Regulation uses a sequence, not an automatic veto.
First, the data holder or separate trade-secret holder must identify the protected data, including in metadata. Before disclosure, it and the recipient should agree proportionate measures, such as confidentiality agreements, strict access protocols or technical standards.
If necessary safeguards cannot be agreed, are not implemented or confidentiality is undermined, the holder may withhold or suspend the identified data. It must substantiate the decision promptly in writing and notify the competent authority, identifying the failed measure or compromised secret.
Outright refusal has a higher threshold:
“In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that it is highly likely to suffer serious economic damage from the disclosure of trade secrets, despite the technical and organisational measures taken by the user pursuant to paragraph 6 of this Article, that data holder may refuse on a case-by-case basis a request for access to the specific data in question.” —
The demonstration must be objective, written and specific. Relevant factors include enforceability of protection in third countries, the data's nature and confidentiality, and the product's uniqueness and novelty. The same structure applies to a chosen third party; there, disclosure must also be strictly necessary for the agreed purpose.
A user or third party can challenge withholding, suspension or refusal before a Member State court, through the competent authority, or by agreed dispute settlement. The holder's authority-notification duty makes an undocumented blanket refusal especially difficult to reconcile with the statutory process.
Timing and important exceptions
Most of the Data Act has applied since 12 September 2025. The Article 3(1) duty to design products and related services so data are directly accessible by default applies only to products and related services placed on the market after 12 September 2026. That later date does not postpone the Article 4 right to request readily available data from the holder.
Chapter II generally exempts products or related services of microenterprises and small enterprises, subject to linked-enterprise, partner-enterprise and subcontracting qualifications. Contract terms cannot weaken Chapter II rights to the user's detriment.
A practical assessment checklist
- Is the requester an owner, lessee, renter or recipient of the related service?
- Are the requested items covered data and metadata—not content or independently inferred material?
- Are holder-mediated data readily available without disproportionate effort?
- If personal data are involved, who is the data subject and what GDPR/ePrivacy basis applies?
- Is the third party eligible, purpose-bound and not a designated gatekeeper?
- Which specific data are claimed as trade secrets, and which proportionate safeguards were proposed?
- Does a security restriction identify a legal product-security requirement and a serious adverse effect on natural persons?
- Is the response proportionate, justified in writing, notified where required and open to challenge?
Conclusion
The Data Act puts the user at the centre of connected-product data access. The user may obtain covered, readily available data and direct them to an eligible third party; recipients must stay within the agreed purpose and statutory safeguards, while holders need a user contract to use non-personal data themselves. Trade secrets ordinarily call for proportionate confidentiality measures, not secrecy by assertion. Cybersecurity and safety can support a restriction only through the specific contractual, legal and serious-harm test in Article 4(2). Permanent refusal for trade secrets is reserved for exceptional, case-specific and objectively substantiated risks of serious economic damage, with notification and review built into the process.
Sources
- — no interpreting judgment identified by 29 July 2026.
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.