The European Union Data Act (Regulation EU 2023/2854) represents a landmark shift in data governance that became enforceable on September 12, 2025. This comprehensive legislation entered into force on January 11, 2024, with most provisions applying from September 12, 2025, fundamentally changing how organizations across all economic sectors handle data access, sharing, and portability. [1]
Core Requirements Under the EU Data Act
The Data Act establishes several key obligations that directly impact observability platforms and enterprise data management:
Connected Device Data Sharing
Users of IoT objects can access, use, and port data that they co-generate through their use of a connected product. This extends to industrial equipment, smart devices, and any products that collect operational data, which includes much of the infrastructure that generates observability telemetry.
Cloud Service Switching Rights
Providers of cloud and edge computing services must meet minimum requirements to facilitate interoperability and enable switching. The Act requires providers to remove all “pre-commercial, commercial, technical, contractual, and organisational” obstacles that make it difficult for customers to switch to or use another service of the same service type.
Data Export and Portability
Providers of Platform and Software as a Service must make open interfaces available and, at a minimum, export data in a commonly used and machine-readable format. Critically, during the first 3 years after the Data Act’s entry into force (from 11 January 2024 to 12 January 2027), providers may still charge their customers for the costs incurred in relation to switching and data egress, but these charges will be eliminated after January 12, 2027. [2][3]
Unfair Contract Terms Restrictions
Chapter IV provisions protect all businesses, in particular small and medium-sized enterprises (SMEs), against unfair contractual terms imposed on them. The Data Act introduces two categories of unfair terms:
(1) terms deemed unfair per se, which are automatically invalid; and
(2) presumptively unfair terms, which must be justified by the imposing party.
International Data Transfer Protections
Non-personal data stored in the EU is protected against unlawful foreign government access requests. Organizations must assess whether a foreign access request aligns with EU law and may need to challenge such requests if they are unlawful under the Data Act.
Implications for Observability Platforms
The observability sector faces unique compliance challenges given the nature of telemetry data and traditional SaaS architectures:
Technical Architecture Considerations
Traditional observability platforms that store customer data in proprietary formats or systems may struggle with the Act’s data portability requirements. Data processing vendors providing platform-based (“platform as a service” or “PaaS”) and software-based (“software as a service” or “SaaS”) must make open interfaces available to all their customers and relevant destination service providers free of charge to facilitate switching.
Pricing Model Impact
Many observability platforms charge for data extraction or impose high egress fees. However, charges are permitted for data egress conducted for the purpose of in-parallel use of services, but not for one-time switching operations after the transitional period ends. [2]
Scope and Application
The EU Data Act has an extraterritorial scope. It applies, regardless of the place of establishment, to a variety of entities, including providers of data processing services offering services to customers in the EU. This means global observability vendors must comply regardless of where they’re headquartered.
Strategic Compliance Approaches
Organizations should evaluate observability solutions based on their alignment with Data Act requirements:
Open Standards Implementation
Solutions built on established standards like OpenTelemetry, Prometheus metrics format, and common log formats naturally support the Act’s interoperability requirements. If a customer wishes to switch providers before the standards have been published, the cloud service provider must export all customer data in a structured, standardized format.
Transparent Data Access
Platforms should provide clear mechanisms for customers to access their complete data sets. Data holders must provide the user with information on the type of data that they will generate when using the connected product or related service (including the volume, collection frequency, etc.).
Multi-Cloud and Hybrid Capabilities
The EU takes a rigid approach in that even customers benefiting from free-tier offerings have switching and porting rights under the Data Act. Solutions that support deployment across multiple environments provide natural compliance advantages.
Customer-Controlled Data Storage
Architectures that allow customers to maintain control over their data storage locations help address both sovereignty and portability requirements simultaneously.
Implementation Timeline and Enforcement
The Data Act’s implementation follows a phased approach:
- September 12, 2025: Main provisions apply (including IoT data access, mandatory B2B sharing, B2G requests, switching obligations, and unfair terms for new contracts)
- September 12, 2026: “Data by design” obligations for connected products placed on the market after this date
- January 12, 2027: Complete ban on charges for switching between data processing services [2][3]
Member States shall lay down rules on penalties applicable to infringements of the Data Act. Fines shall be effective, proportionate, and dissuasive. For violations involving personal data, data protection authorities may impose fines within their scope of competence as provided for in the GDPR (up to EUR 20 million or 4% of the total worldwide turnover of an entity for the preceding financial year, whichever is higher).
Building Future-Ready Observability Strategies
The Data Act represents the beginning of a global trend toward stronger data governance requirements. Organizations should view compliance as an opportunity to build more resilient and flexible observability capabilities.
When evaluating observability platforms, consider these compliance-focused criteria:
Data Portability: Can you export all historical data in standard, machine-readable formats without prohibitive costs?
Interface Openness: Does the platform provide open APIs and support industry-standard protocols for data access?
Switching Support: How easily can you migrate to different solutions, and what transitional support is provided?
Geographic Controls: Can you specify data storage locations and processing jurisdictions?
Contract Terms: Are pricing models transparent, and do agreements avoid unfair terms that could violate the Act?
Standards Compliance: Does the platform embrace open standards rather than proprietary formats and protocols?
How Apica Addresses EU Data Act Compliance
Apica’s architecture directly addresses many of the EU Data Act’s core requirements through its innovative approach in the observability space. Apica’s Ascent products complete data ownership with open formats, preventing vendor lock-in, and 100% of data belongs to you, not Apica. This approach ensures organizations maintain full control over their telemetry pipeline.
Apica’s patented InstaStore™ technology seamlessly integrates with any object storage, allowing customers to store their observability data in their own infrastructure or preferred cloud storage, naturally satisfying data sovereignty requirements while providing infinite retention for complete observability history. [4]
Apica’s commitment to open standards and interoperability positions organizations well for Data Act compliance. Ascent’s telemetry pipeline seamlessly integrates with 100+ existing tools, including Splunk, Datadog, and Elastic, while flexible deployment options allow you to use Apica Lake, its optimized data lake, or route to your organization’s existing storage. This architecture eliminates the vendor lock-in scenarios that could violate the Act’s switching requirements, as any data in Lake can be instantly replayed to a target on demand, ensuring seamless data portability. With Apica’s approach of optimizing existing observability investments rather than demanding costly replacements, organizations can maintain compliance while reducing observability costs by up to 40% compared to traditional platforms.
The organizations that will succeed under the new regulatory framework are those that embrace data sovereignty as a competitive advantage, enabling greater operational flexibility while meeting evolving compliance requirements. By prioritizing solutions that align with the Data Act’s principles of openness, fairness, and customer control, enterprises can build intelligent observability capabilities that adapt to future regulatory changes while delivering superior operational insights.
This article provides general information about the EU Data Act and its potential implications for observability platforms. Organizations should consult with legal professionals for specific compliance guidance tailored to their circumstances and use cases.
References:
[1] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R2854
[2] https://www.berec.europa.eu/system/files/2023-05/EC_Data%20Act%20Cloud_presentation.pdf
[3] https://www.europarl.europa.eu/RegData/etudes/ATAG/2025/775915/EPRS_ATA%282025%29775915_EN.pdf
[4] https://www.apica.io/blog/instastore-data-storage-for-the-modern-enterprise/instastore-3/
