DEU Data Act Regulation & Exit - and Continuity Provisions in IT Contracts

Since 12 September 2025, Regulation (EU) 2023/2854 (“Data Act Regulation”) has been applicable throughout the EU. The aim of the Data Act Regulation is to create a single market for data within the European Union, amongst other things by removing barriers to data sharing.

The Data Act Regulation and related legislation and regulations do not affect legislation and regulations concerning the protection of personal data, privacy, the confidentiality of communications or the integrity of terminal equipment.

Applicability and scope of the Data Act

The new legal obligations regarding switching under the Data Act apply to IT suppliers who are providers of data processing services. Pursuant to Article 2(8) of the Data Act, the Data Act defines a ‘data processing service’ as:

“a digital service that is provided to a customer and that enables ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

Data processing service

Examples include cloud services in the following service delivery models:

• Infrastructure-as-a-Service (IaaS)
• IT infrastructure such as servers, storage and networking (e.g. AWS EC2, Microsoft Azure Virtual Machines)
• Platform-as-a-Service (PaaS)
• Development platforms where the provider manages the technical layer (e.g. Google App Engine, Heroku)
• Software-as-a-Service (SaaS)
• Ready-to-use software offered via the internet (e.g. Salesforce, Microsoft 365, Slack)
• Database-as-a-Service (DBaaS)
• Hosted database solutions (e.g. Amazon RDS, MongoDB Atlas)
• Storage-as-a-Service (STaaS)
• Cloud storage services (e.g. Dropbox Business, Google Drive for Business)

The defining feature of all these services is that they are delivered via a shared, scalable infrastructure where resources are available on demand.

What is likely to fall within the scope of the Data Act?

The Data Act primarily focuses on standard cloud services offered to multiple customers via a service catalogue. The service is delivered via a shared, scalable computing capacity where resources are available on demand.

Specific examples:

• CRM systems, such as Salesforce or HubSpot
• HR software, such as BambooHR or Workday
• Planning tools, such as Asana or Monday.com
• Accounting software, such as Exact Online or Yuki
• Communication platforms, such as Slack or Microsoft Teams

These are likely to fall under the Data Act because they:

1. Are provided via the internet (cloud-based)
2. Are multi-tenant (infrastructure shared with other customers)
3. Are scalable and elastic (computing capacity on demand)
4. Are available as standard from the catalogue (one-to-many model)

What is unlikely to fall within the scope of the Data Act?

The following IT services are likely to fall outside the scope of the Data Act:

1. On-premises software.
• Software that runs entirely on the customer’s own servers, without any cloud component. Examples include in-house applications on the customer’s own servers, commercial software installed on-premises (SAP, Oracle), or virtualisation on the customer’s own infrastructure.
2. Private cloud infrastructure.
• Cloud infrastructure exclusively reserved for a single customer, with no resource sharing with others. For example, dedicated AWS hosts, Azure private subscriptions or virtual data centres exclusively for a single customer.
3. Custom software
• Software of which the majority of the core functions have been developed specifically for a single customer and are not offered on a broad commercial scale via a service catalogue (Article 31 of the Data Act). Examples include fully custom-built ERP systems or bespoke workflow automation.
  
  Please note: Minor adjustments or custom fields (such as those in Salesforce) do not in themselves make a standard product into custom software.
4. Traditional IT outsourcing
• A one-to-one service in which an IT company manages infrastructure for a single client. For example, Managed Services Providers that manage servers, networks and databases 24/7.
5. IT services that are not data processing services Support services, such as systems integration, IT consultancy, IT support, network management, training or data centre management, are not data processing services within the meaning of the Data Act.

Vendor lock-in

In the Data Act, the European legislator has set itself, amongst other things, the objective of curbing ‘vendor lock-in’.

Vendor lock-in arises when companies or organisations are so heavily tied to a single IT supplier that switching is prohibitively expensive or technically impossible. This occurs due to intellectual property rights over software or a lack of interoperability with other systems. As a result, an organisation loses control: it is forced to accept updates and faces significant risks in the event of price increases, discontinued support or the supplier’s bankruptcy.

In practice, this problem is addressed through exit and/or continuity provisions in IT contracts. An exit and/or continuity provision includes agreements on the transfer of data, the performance of work and cooperation regarding the switch to a new location or supplier.

What does the EU Data Act Regulation mean for exit and continuity provisions in IT contracts? In this article, we explain the implications.

Phasing out of switching charges

From 12 September 2025, ‘Chapter VI (switching between data processing services)’ of the Data Act Regulation will apply to providers of data processing services.

The Data Act now requires data processing services to include provisions, clearly set out in a written contract, under which the customer may, upon request, switch to a data processing service offered by another provider, or under which the customer may transfer all ‘exportable data’ and ‘digital assets’ to an on-premises IT infrastructure. This must take place without delay and in no circumstances after a mandatory transition period of no more than 30 days, which commences after the maximum notice period of no more than two months for the client to initiate a switching process.

Through a gradual phase-out, the Data Act Regulation now prohibits the charging of switching fees:

• From 12 January 2027, data processing service providers will no longer charge switching fees for the switching process.
• From 11 January 2024 to 12 January 2027, data processing service providers may charge customers reduced switching fees.
• The reduced switching fees from 11 January 2024 to 12 January 2027 must not exceed the costs incurred by the data processing service provider that are directly related to the switching process in question.

All parties involved in the switching process are also subject to a ‘duty of good faith’, for example to provide information and offer the cooperation reasonably required to ensure an effective switch.

This does not mean that the IT supplier is necessarily obliged to carry out work free of charge, for example in respect of the time and manpower required for migration work. The contractor is entitled to a reasonable fee, and the client is obliged to reimburse the contractor for the expenses incurred in carrying out the contract, insofar as these are not included in the fee, pursuant to Article 7:405(2) and Article 7:406 of the Dutch Civil Code.

However, the costs that the IT supplier wishes to charge for migration work and other activities related to the switch must be carefully justified, for example by referring to a fixed service rate. In any event, imposing a separate ‘switch’ fee is no longer permitted.

Exit/continuity arrangements; right to data migration

What happens to data at the end of an IT contract, or, for example, in the event of a takeover or the insolvency of an IT supplier?

Personal data

Pursuant to Article 28(3)(g) of the GDPR, as well as in accordance with the data subject’s right under Article 20(1) in conjunction with Article 28(3)(e) of the GDPR, it is a legal requirement to enter into a data processing agreement when processing personal data, which must stipulate that personal data:

(“at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data”)

Data not classified as personal data

Until recently, there was no clear right to retrieve ‘own’ data in a specific format or to have it transferred to a new IT supplier in the case of data that could not be classified as personal data.

It is not necessarily a legal requirement to include an exit and/or continuity provision in an IT contract or in an IT supplier’s internal policy. Indeed, not every IT contract contains a clear agreement at all regarding what happens after the end of the contract.

Without the voluntary cooperation of the original IT supplier in migration work at reasonable costs, or a statutory provision for data migration, a client wishing to switch providers is dependent on the terms set out in the IT contract. In the absence of a clear agreement, a dispute may ultimately escalate into legal proceedings.

Recent court rulings

The relevance of this issue is demonstrated, amongst other things, by recent court rulings:

ECLI:NL:RBAMS:2024:8477

ECLI:NL:RBNHO:2025:13279

ECLI:NL:RBGEL:2025:7398

Legal proceedings are costly and time-consuming, even if the court ultimately orders the IT supplier to grant access to certain data or to cooperate with the migration under conditions imposed by the court. A clear exit/continuity clause or policy in an IT contract is clearly preferable.

Competent supervisory authority

In the Netherlands, the Authority for Consumers and Markets (ACM) has been authorised to supervise the Data Act since 21 November 2025.

The Netherlands Authority for Consumers and Markets (ACM) has the power to impose effective, proportionate and dissuasive sanctions.

Digital Omnibus Proposal

Please note! The above article is based on the current text of the law. A proposal has been put forward as part of the von der Leyen II Commission’s simplification agenda, following the Draghi report on European competitiveness. The proposal also includes proposed amendments to the Data Act Regulation and related legislation and regulations.

We previously wrote an article about the proposed amendments:

Proposal for the Digital Omnibus: Proposed Amendments to the GDPR

It is possible that, should the legislative amendments proposed in the Digital Omnibus be adopted, the timeline and rules regarding remuneration for the (re)use of data will become less stringent.

It has also been proposed to replace the implied obligation to amend existing and new IT contracts from 12 September 2025 and to change terms and conditions to bring them into line with Chapters III and IV of the Data Act with an alternative approach that is less drastically intrusive on the principles of freedom of contract, free pricing and competitiveness in the European market. However, it is not possible to predict in advance which proposed legislative amendments will actually be implemented and when the Data Act will be amended.

Any questions?

Do you have any questions about the Data Act? Would you like to include or update an exit/continuity clause in your IT contract? Please contact our IT lawyers; they will be happy to assist you.

Virtual Legal Department

Would you like to make use of our ready-to-hand expertise and speak to us on a regular basis? Take out a subscription to the Virtual Legal Department. Simply send us an email and we’ll send you the terms and conditions, with no obligation.