The EU Data Act has implications for vendors of SaaS (Software as a Service), PaaS (Platform as a Service), and IaaS (Infrastructure as a Service) solutions to customers in the European Union. This article focuses on the Act's provisions - applicable from 12 September 2025 - regarding customers wishing to switch to an alternative cloud provider midway through a subscription and terminate their contracts early.
What's changing: the essentials
- New right to switch mid-term: EU-based customers of in-scope 'data processing services', which include various off-the-shelf solutions, can initiate a switch to another provider or to on-premises infrastructure on giving two months' notice or less, effectively terminating the relevant contract early.
- Supporting switching and relevant charges: affected cloud service vendors must support switching within a 30-day transition period (extendable, if technically unfeasible, to up to seven months), and customers can port certain data and digital assets they have the right to use. From 12 January 2027, no charges can be levied for implementing this (and, in the interim, any such charges may not exceed the actual costs incurred by such vendors). Proportionate early termination fees remain lawful where this results in a customer exiting the relevant contract prematurely.
- New contractual and notification requirements: in-scope contracts must include a suite of new provisions relating to the switching mechanics and relevant fees, and certain information must be provided upfront before the relevant contract is signed.
What is the EU Data Act?
The Act grants new rights to business and consumer customers regarding how their readily available, raw, and pre-processed data (including non-personal data) is shared, accessed, and used. Much of the Act concerns the Internet of Things (IoT): businesses supplying IoT-enabled products or related services (from industrial equipment to smart home appliances) or handling IoT-generated data (such as usage data) must make this data available on request, either to the user or, subject to certain restrictions, to a third party of the user's choice. The Act additionally disapplies certain unfair terms in business-to-business contracts.
Beyond the above (which is outside this article's scope), Chapter VI of the Act introduces a new regime applying to 'data processing services' (DPSs). These include SaaS, PaaS, and IaaS offerings entailing 'on-demand network access' to a shared 'configurable, scalable and elastic' pool of computing resources that can be 'rapidly provisioned and released with minimal management effort or service provider interaction'.
In-scope DPSs must allow customers to initiate switching with no more than two months' notice, with termination taking effect once the switching process is completed (or, as further detailed below, upon the deletion of customers' exportable data where they do not wish to switch). This means customers of in-scope DPSs have a new, unilateral right to terminate midway through the relevant contract term.
Is your business in scope?
The obligations regarding switching only apply to contracts with EU-based customers. If you are a cloud service vendor outside the EU (for example, in the UK), you may still be subject to the Act: what matters is where the customer is located, not the vendor. UK and US businesses, therefore, need not comply with the switching regime to the extent all their customers are outside the EU, although non-EU customers in the European Economic Area (EEA), such as Norway, may yet benefit from their rights under the Act if it is incorporated into the EEA Agreement.
If your business is a cloud vendor whose services cannot be set up by customers themselves without significant interaction or assistance or that lacks the ability to allocate resources flexibly to allow customers to scale up or down rapidly, it may not meet the above-described definition of a DPS and would not be in scope.
Chapter VI of the Act does not apply to cloud services provided for testing or evaluation purposes or in a non-production environment. Cloud services that are custom-built for a particular customer's needs (and are not offered at a broad commercial scale through your business's catalogue) are exempt from certain Chapter VI obligations, including the prohibition on switching fees and certain functional equivalence requirements, though other switching obligations (including allowing for early termination and ensuring that data is exported in a structured, commonly used, and machine-readable format) remain applicable. If you rely on these exemptions, you must inform the relevant customer of the obligations that won't apply.
What do in-scope cloud providers have to do?
If your business does provide in-scope DPSs, then you must allow both business and consumer customers to switch providers (or to switch to on-premises provision) and port over or delete relevant 'exportable data' (input and output data, including generated metadata) and 'digital assets' (applications and certain metadata, such as security settings, that customers can use independently) to an alternative provider at any point during their subscription. Customers (including those on free tiers) can trigger this process by giving up to two months' notice. A transition period of up to 30 days - extendable to up to seven months if this is technically unfeasible, provided justification is given within 14 working days of the switching request - begins after this notice period ends. Termination occurs once the switching process is successfully completed (or, where the relevant customer wants its data erased, once that data is deleted).
During the notice and transition periods, the relevant contract remains effective for business continuity purposes. In-scope DPS vendors must provide information about known risks to service continuity and continue to protect the customer's data.
From 12 January 2027, in-scope DPS vendors will be prohibited from imposing any 'switching charges' whatsoever to compensate them for effecting a switch to a different provider or to on-premises infrastructure. Until then, switching charges (including data egress charges) are only permitted if they do not exceed the costs directly linked to the transition.
Does this prohibition on switching charges mean termination fees can't be charged to customers who end their cloud subscription early?
No - switching fees cover the costs of facilitating the switch or data deletion but are distinct from standard service fees for providing the relevant DPS (which can still be charged) and from 'early termination penalties'. The Act's recitals clarify that parties may still agree to fixed-duration contracts with such early termination penalties to cover early contract termination enforced by the customer, provided these are legally 'proportionate'.
What additional terms must relevant cloud service contracts contain?
To address the above, in-scope contracts concluded with EU-based customers for any cloud service constituting a DPS must include a suite of additional terms stipulated in Article 25 of the Act, including:
- full details of the switching process, including clarification that switching will take effect without undue delay once the right is exercised (including a one-time right for the customer to extend the transitional period to what it may consider more appropriate);
- an explanation of the reasonable assistance the cloud service vendor will provide to the customer and third parties;
- an obligation to maintain continuity of services during the switch, with clear information regarding risks to service continuity;
- a statement as to when, as a result, the relevant contract terminates (i.e. after the switch or the erasure of the exportable data or digital assets);
- authorisation for customers to retrieve their data within a period of at least 30 days following the switch, after which the exportable data will be deleted;
- clarification as to what switching charges and early termination penalties apply if a customer exercises its switching rights; and
- an exhaustive list of exportable data and digital assets that may be transferred, as well as details of data that won't be (for example, trade secrets of the original source provider).
The Act also requires transparent and upfront information at pre-contract stages (including on vendors' websites) regarding the switching process and associated fees and charges.
What should in-scope cloud service vendors do now?
- Determine whether your business is subject to Chapter VI of the Act: Assess whether your cloud offerings meet the DPS definition (on-demand access to a shared, configurable, scalable, and elastic resource pool with minimal provider interaction) and whether you have EU-based customers.
- Run a compliance gap and risk assessment:
- Map exemptions: Identify any offerings that are custom-built and not offered at broad commercial scale or provided solely for testing or in a non-production environment, and document and disclose to relevant customers which Chapter VI obligations do not apply.
- Identify in-scope contracts and consider compliance risks: note that Article 50 of the Act does not explicitly stipulate any retrospective effect of Chapter VI's provisions to contracts concluded before 12 September 2025.
- Consider how your business's operations align with the switching process requirements, particularly as regards notice handling, transition planning, preparing machine-readable exportable data and digital assets, and service continuity.
- Consider your business's position on switching charges and early termination fees and to what extent you wish to charge these and in what circumstances, taking into account the upcoming prohibition on switching charges.
- Seek legal advice on how best to incorporate the relevant provisions into your contracts: The Act does not specify a particular format or wording, so there is scope to refine and adapt these in a way that best suits your business.
- Prepare internal and external documentation: In addition to contractual amendments, your business, if it is subject to the requirements discussed in this article, will need to ensure its legal, sales, engineering, and support staff are aligned on how the switching process operates (a playbook might be a valuable resource), while external-facing materials (such as on your website) will be needed to comply with the Act's transparency and information requirements.