The Data Act and SaaS Contracts: A Practical Guide for Providers in 2026

Read FAQs

1. What the Data Act is and why it affects SaaS

Regulation (EU) 2023/2854 took effect on 12 September 2025. The main goal: to limit vendor lock-in (the customer’s dependence on a single supplier) and to make data accessible within the EU. It responds to the practice in which SaaS terms of business practically made switching to the competition impossible.

The Data Act brings you, as a SaaS provider, four major changes:

• A two-month notice period even for fixed-term contracts
• A mandatory free export of data in a structured format
• From 12 January 2027 you may charge nothing for switching (until then only direct costs)
• New information obligations on your website

The Data Act applies to everyone who serves customers in the EU, including American or Asian SaaS companies.

The Data Act refers to cloud services with the term “data processing service” (Article 2(8)). The definition covers IaaS (Infrastructure as a Service), PaaS (Platform as a Service) and, under certain conditions, also SaaS (Software as a Service).

2. Does your SaaS fall under the Data Act?

Not every SaaS falls under the definition of a data processing service.

The definitional test: four features of a data processing service (Article 2(8) of the Data Act)

• Access to computing resources - networks, servers, storage, applications (the essence of as-a-service)
• On-demand network access - the customer provides the resources to itself via standard devices (mobile phone, laptop, workstation)
• Rapid provisioning - the service is deployed without significant intervention by the provider, usable almost immediately
• Elasticity and scaling - capacity increases and decreases according to need

Key: the customer’s intent The European Commission clarified that what matters is what the customer actually uses. If they conclude the contract in order to store and process their own data, the service falls under the Data Act. If data processing is a side effect of the main functionality (music streaming, e-learning), the service does not fall under the Data Act.

In practice: most B2B SaaS - CRM, project tools, HR platforms, fintech - falls under the Data Act.

What falls under and what does not fall under the Data Act - examples

If you are not sure, a legal assessment is carried out at the level of the specific service (service-by-service assessment). That is where we start with clients.

3. Customers’ switching rights

Article 25 of the Data Act introduces the customer’s right to switch to another provider:

Switching is not termination without giving a reason

Article 25 establishes a right to switch, not a general right to terminate without giving a reason (termination for convenience). This difference is often overlooked. A customer cannot terminate the contract with a 2-month notice period just like that - they can use this notice only in order to initiate the process of changing provider.

4. What to change in your terms of business and contracts

The Data Act expressly states what conditions must be in contracts - this concerns both terms of business and application terms. If you do not address it, you are breaching the rules.

Mandatory contractual clauses

How the big players handle it

• Asana - a Data Act Addendum (asana.com/terms/eu-data-act-addendum), an export form, documentation in JSON
• Pipedrive - an addendum (pipedrive.com/en/legal/eu-data-act) with export in XLSX and a guide with screenshots
• One - a page (talon.one/legal/eu-data-act) with documentation of sessions, profiles, loyalty data in CSV/JSON

Common pattern: All three companies chose the form of a separate Data Act addendum to their existing terms of business or application terms - not a rewrite of the entire contract. To it they added online documentation describing the data structures, export formats and migration process.

Do you need a Data Act addendum for your terms of business? We will prepare tailored contractual documentation for you - a Data Act addendum, a description of the export and a web page on data portability.

Arrange a free consultation

5. Fees and penalties - what you can charge

Switching fees work in two phases:

• Until 12 January 2027: reduced fees corresponding to direct costs
• From 12 January 2027: no switching fees

Switching fees are not the same as paid subscription. A customer can leave earlier, but for the unused period you can demand reasonable compensation. Recital 89 confirms this: “nothing prevents the conclusion of fixed-term contracts, including reasonable penalties for early termination”.

What you can and cannot charge

Reasonableness of penalties - two interpretations

• Conservative: The penalty covers the actual harm after deducting saved costs. If a customer paid a year in advance and leaves after 6 months, you deduct the saved variable costs.
• Liberal: A penalty up to the amount of the remaining value of the contract. Arguments: implementation costs are fixed, the annual price is discounted compared to the monthly one, the sanction in the Czech Republic also includes a penalty.

Our recommendation: describe the penalty transparently in the contract and back it with figures. With annual subscriptions you have room for a higher penalty, but expect greater resistance from customers.

A disputed question: ongoing data export

If a customer, during the contract (without termination), requests an export to their own storage - is it free? The definition of “data transfer fees” in the Data Act does not distinguish whether the export is due to termination of the contract or not. We recommend regulating this expressly in the contract.

6. Data export - what the Data Act requires

The data must be in a “structured, commonly used and machine-readable format”. Until harmonized standards exist, you choose the format yourselves.

Overview of export formats in practice

Important: If your format does not suit a customer and they want a different one, you can refuse - provided your format meets the statutory requirements. The Data Act does not require you to develop conversion tools tailored to individual customers. You can charge for a premium customization as an additional service.

What you must publish on your website

• A description of the switching process - procedures, methods, formats, technical limitations
• Online export documentation - data structures, formats, standards for interoperability
• The jurisdiction of the ICT infrastructure - where you have the customer’s data stored
• Security measures - against access by foreign state authorities in breach of EU/Czech law

Links in contracts. In practice we create a new “Data Act” section alongside GDPR and link to it from the terms of business, application terms and individual contracts.

7. How we handle it in practice

At SEDLAKOVA LEGAL we have implemented the Data Act for dozens of SaaS clients in project and data management, IoT, fintech and HR tech. A typical procedure:

Step 1: Legal assessment of scope

We verify whether your service falls under the definition. The output is a legal opinion with an unambiguous conclusion.

Step 2: Amendment of contractual documentation

Changes to the terms of business, application terms or MSA (Master Service Agreement - a framework agreement on the provision of services) - a new article on the customer’s rights, a description of switching, provisions on notice and penalties. We also reflect the changes into existing contracts and evaluate risky clients.

Step 3: Web documentation

Materials for a new section on the website - portability, jurisdiction, security.

Step 4: Technical consultation

We advise the technical team on what the law actually requires. The goal is export only where it is necessary - you save developer time.

What clients deal with most often: “How do we set penalties so that we do not lose customers but are in compliance with the Data Act?” The answer depends on the business model and requires individual analysis.

Do you want a turnkey Data Act implementation? We have implemented Data Act compliance for dozens of SaaS clients. We will help you too.

Find out more about Data Act Shield

8. Timeline

Without contractual regulation you are moving blindly. A customer can exercise their rights at any time - write that they are terminating with a 2-month notice or requesting a free export. Without contractual provision you will not invoice them compensation for early termination.