---
title: "Data Act recitals 1 to 119"
canonical: "https://dposchool.com/data-act/recitals"
source: "http://publications.europa.eu/resource/celex/32023R2854"
source_note: "Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-30"
language: "en"
publisher: "DPO School"
---

# Data Act recitals

The recitals of Regulation (EU) 2023/2854 set out the reasons for its articles. Official Journal text of 22 December 2023. Retrieved 30 October 2026.

- [Recital 1](https://dposchool.com/data-act/recital/1): In recent years, data-driven technologies have had transformative effects on all sectors of the economy.
- [Recital 2](https://dposchool.com/data-act/recital/2): Barriers to data sharing prevent an optimal allocation of data for the benefit of society.
- [Recital 3](https://dposchool.com/data-act/recital/3): In sectors characterised by the presence of microenterprises, small enterprises and medium-sized enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC (5) (SMEs)…
- [Recital 4](https://dposchool.com/data-act/recital/4): In order to respond to the needs of the digital economy and to remove barriers to a well-functioning internal market for data, it is necessary to lay down a harmonised framework specifying who is…
- [Recital 5](https://dposchool.com/data-act/recital/5): This Regulation ensures that users of a connected product or related service in the Union can access, in a timely manner, the data generated by the use of that connected product or related service…
- [Recital 6](https://dposchool.com/data-act/recital/6): Data generation is the result of the actions of at least two actors, in particular the designer or manufacturer of a connected product, who may in many cases also be a provider of related services…
- [Recital 7](https://dposchool.com/data-act/recital/7): The fundamental right to the protection of personal data is safeguarded, in particular, by Regulations (EU) 2016/679 (6) and (EU) 2018/1725 (7) of the European Parliament and of the Council.
- [Recital 8](https://dposchool.com/data-act/recital/8): The principles of data minimisation and data protection by design and by default are essential when processing involves significant risks to the fundamental rights of individuals.
- [Recital 9](https://dposchool.com/data-act/recital/9): Unless otherwise provided for in this Regulation, it does not affect national contract law, including rules on the formation, validity or effect of contracts, or the consequences of the termination…
- [Recital 10](https://dposchool.com/data-act/recital/10): This Regulation is without prejudice to Union and national legal acts providing for the sharing of, access to and the use of data for the purpose of the prevention, investigation, detection or…
- [Recital 11](https://dposchool.com/data-act/recital/11): Union law establishing physical design and data requirements for products to be placed on the Union market should not be affected unless specifically provided for by this Regulation.
- [Recital 12](https://dposchool.com/data-act/recital/12): This Regulation complements and is without prejudice to Union law aiming to establish accessibility requirements on certain products and services, in particular Directive (EU) 2019/882 of the…
- [Recital 13](https://dposchool.com/data-act/recital/13): This Regulation is without prejudice to Union and national legal acts providing for the protection of intellectual property rights, including Directives 2001/29/EC (19), 2004/48/EC (20) and (EU)…
- [Recital 14](https://dposchool.com/data-act/recital/14): Connected products that obtain, generate or collect, by means of their components or operating systems, data concerning their performance, use or environment and that are able to communicate those…
- [Recital 15](https://dposchool.com/data-act/recital/15): The data represent the digitisation of user actions and events and should accordingly be accessible to the user.
- [Recital 16](https://dposchool.com/data-act/recital/16): This Regulation enables users of connected products to benefit from aftermarket, ancillary and other services based on data collected by sensors embedded in such products, the collection of those…
- [Recital 17](https://dposchool.com/data-act/recital/17): It is necessary to lay down rules regarding products that are connected to a related service at the time of the purchase, rent or lease in such a way that its absence would prevent the connected…
- [Recital 18](https://dposchool.com/data-act/recital/18): The user of a connected product should be understood to be a natural or legal person, such as a business, a consumer or a public sector body, that owns a connected product, has received certain…
- [Recital 19](https://dposchool.com/data-act/recital/19): Data literacy refers to the skills, knowledge and understanding that allows users, consumers and businesses, in particular SMEs falling within the scope of this Regulation, to gain awareness of the…
- [Recital 20](https://dposchool.com/data-act/recital/20): In practice, not all data generated by connected products or related services are easily accessible to their users and there are often limited possibilities regarding the portability of data…
- [Recital 21](https://dposchool.com/data-act/recital/21): Where several persons or entities are considered to be users, for example in the case of co-ownership or where an owner, renter or lessee shares rights of data access or use, the design of the…
- [Recital 22](https://dposchool.com/data-act/recital/22): Connected products may be designed to make certain data directly accessible from on-device data storage or from a remote server to which the data are communicated.
- [Recital 23](https://dposchool.com/data-act/recital/23): Virtual assistants play an increasing role in digitising consumer and professional environments and serve as an easy-to-use interface to play content, obtain information, or activate products…
- [Recital 24](https://dposchool.com/data-act/recital/24): Before concluding a contract for the purchase, rent, or lease of a connected product, the seller, rentor or lessor, which may be the manufacturer, should provide to the user information regarding…
- [Recital 25](https://dposchool.com/data-act/recital/25): This Regulation should not be understood to confer any new right on data holders to use product data or related service data.
- [Recital 26](https://dposchool.com/data-act/recital/26): To foster the emergence of liquid, fair and efficient markets for non-personal data, users of connected products should be able to share data with others, including for commercial purposes, with…
- [Recital 27](https://dposchool.com/data-act/recital/27): In sectors characterised by the concentration of a small number of manufacturers supplying connected products to end users, there may only be limited options available to users for the access to and…
- [Recital 28](https://dposchool.com/data-act/recital/28): In contracts between a data holder and a consumer as user of a connected product or related service generating data, Union consumer law, in particular Directives 93/13/EEC and 2005/29/EC, applies to…
- [Recital 29](https://dposchool.com/data-act/recital/29): Data holders may require appropriate user identification to verify a user’s entitlement to access the data.
- [Recital 30](https://dposchool.com/data-act/recital/30): The user should be free to use the data for any lawful purpose.
- [Recital 31](https://dposchool.com/data-act/recital/31): Directive (EU) 2016/943 of the European Parliament and of the Council (23) provides that the acquisition, use or disclosure of a trade secret shall be considered to be lawful, inter alia, where such…
- [Recital 32](https://dposchool.com/data-act/recital/32): The aim of this Regulation is not only to foster the development of new, innovative connected products or related services, stimulate innovation on aftermarkets, but also to stimulate the…
- [Recital 33](https://dposchool.com/data-act/recital/33): A third party to whom data is made available may be a natural or legal person, such as a consumer, an enterprise, a research organisation, a not-for-profit organisation or an entity acting in a…
- [Recital 34](https://dposchool.com/data-act/recital/34): The use of a connected product or related service may, in particular when the user is a natural person, generate data that relates to the data subject.
- [Recital 35](https://dposchool.com/data-act/recital/35): Product data or related service data should only be made available to a third party at the request of the user.
- [Recital 36](https://dposchool.com/data-act/recital/36): Access to any data stored in and accessed from terminal equipment is subject to Directive 2002/58/EC and requires the consent of the subscriber or user within the meaning of that Directive unless it…
- [Recital 37](https://dposchool.com/data-act/recital/37): In order to prevent the exploitation of users, third parties to whom data has been made available at the request of the user should process those data only for the purposes agreed with the user and…
- [Recital 38](https://dposchool.com/data-act/recital/38): In line with the data minimisation principle, third parties should access only information that is necessary for the provision of the service requested by the user.
- [Recital 39](https://dposchool.com/data-act/recital/39): Third parties should also refrain from using data falling within the scope of this Regulation to profile individuals unless such processing activities are strictly necessary to provide the service…
- [Recital 40](https://dposchool.com/data-act/recital/40): Start-ups, small enterprises, enterprises that qualify as a medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC and enterprises from traditional sectors with…
- [Recital 41](https://dposchool.com/data-act/recital/41): Given the current state of technology, it would be overly burdensome on microenterprises and small enterprises to impose further design obligations in relation to connected products manufactured or…
- [Recital 42](https://dposchool.com/data-act/recital/42): Taking into account the variety of connected products producing data of different nature, volume and frequency, presenting different levels of data and cybersecurity risks and providing economic…
- [Recital 43](https://dposchool.com/data-act/recital/43): On the basis of the principle of contractual freedom, parties should remain free to negotiate the precise conditions for making data available in their contracts within the framework for the general…
- [Recital 44](https://dposchool.com/data-act/recital/44): In order to ensure that the conditions for mandatory data access are fair for both parties to a contract, the general rules on data access rights should refer to the rule on avoiding unfair…
- [Recital 45](https://dposchool.com/data-act/recital/45): Any agreement concluded in business-to-business relations for making data available should be non-discriminatory between comparable categories of data recipients, independently of whether the…
- [Recital 46](https://dposchool.com/data-act/recital/46): In order to promote continued investment in generating and making available valuable data, including investments in relevant technical tools, while at the same time avoiding excessive burdens on…
- [Recital 47](https://dposchool.com/data-act/recital/47): First, reasonable compensation for meeting the obligation pursuant to Union law or national legislation adopted in accordance with Union law to comply with a request to make data available may…
- [Recital 48](https://dposchool.com/data-act/recital/48): It is not necessary to intervene in the case of data sharing between large enterprises, or where the data holder is a small enterprise or a medium-sized enterprise and the data recipient is a large…
- [Recital 49](https://dposchool.com/data-act/recital/49): To protect SMEs from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models, the reasonable compensation for making data…
- [Recital 50](https://dposchool.com/data-act/recital/50): In duly justified cases, including where there is a need to safeguard consumer participation and competition or to promote innovation in certain markets, regulated compensation for making available…
- [Recital 51](https://dposchool.com/data-act/recital/51): Transparency is an important principle for ensuring that the compensation requested by a data holder is reasonable, or, if the data recipient is an SME or a not-for-profit research organisation…
- [Recital 52](https://dposchool.com/data-act/recital/52): Ensuring access to alternative ways of resolving domestic and cross-border disputes that arise in connection with making data available should benefit data holders and data recipients and therefore…
- [Recital 53](https://dposchool.com/data-act/recital/53): The dispute settlement procedure under this Regulation is a voluntary procedure that enables users, data holders and data recipients to agree to bring their disputes before dispute settlement bodies.
- [Recital 54](https://dposchool.com/data-act/recital/54): To avoid cases in which two or more dispute settlement bodies are seized for the same dispute, in particular in a cross-border situation, a dispute settlement body should be able to refuse to deal…
- [Recital 55](https://dposchool.com/data-act/recital/55): In order to ensure the uniform application of this Regulation, the dispute settlement bodies should take into account the non-binding model contractual terms to be developed and recommended by the…
- [Recital 56](https://dposchool.com/data-act/recital/56): Parties to dispute settlement proceedings should not be prevented from exercising their fundamental rights to an effective remedy and a fair trial.
- [Recital 57](https://dposchool.com/data-act/recital/57): Data holders may apply appropriate technical protection measures to prevent the unlawful disclosure of or access to data.
- [Recital 58](https://dposchool.com/data-act/recital/58): Where one party is in a stronger bargaining position, there is a risk that that party could leverage such a position to the detriment of the other contracting party when negotiating access to data…
- [Recital 59](https://dposchool.com/data-act/recital/59): Rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships.
- [Recital 60](https://dposchool.com/data-act/recital/60): Furthermore, the rules on unfair contractual terms should apply only to those elements of a contract that are related to making data available, that is contractual terms concerning access to and use…
- [Recital 61](https://dposchool.com/data-act/recital/61): Criteria for identifying unfair contractual terms should be applied only to excessive contractual terms where a stronger bargaining position has been abused.
- [Recital 62](https://dposchool.com/data-act/recital/62): In order to ensure legal certainty, this Regulation establishes a list of clauses that are always considered unfair and a list of clauses that are presumed to be unfair.
- [Recital 63](https://dposchool.com/data-act/recital/63): In situations of exceptional need, it may be necessary for public sector bodies, the Commission, the European Central Bank or Union bodies to use in the performance of their statutory duties in the…
- [Recital 64](https://dposchool.com/data-act/recital/64): In the case of public emergencies, such as public health emergencies, emergencies resulting from natural disasters including those aggravated by climate change and environmental degradation, as well…
- [Recital 65](https://dposchool.com/data-act/recital/65): An exceptional need may also arise from non-emergency situations.
- [Recital 66](https://dposchool.com/data-act/recital/66): This Regulation should not apply to, or pre-empt, voluntary arrangements for the exchange of data between private and public entities, including the provision of data by SMEs, and is without…
- [Recital 67](https://dposchool.com/data-act/recital/67): This Regulation complements and is without prejudice to the Union and national law providing for access to and the use of data for statistical purposes, in particular Regulation (EC) No 223/2009 of…
- [Recital 68](https://dposchool.com/data-act/recital/68): For the exercise of their tasks in the areas of prevention, investigation, detection or prosecution of criminal or administrative offences or the execution of criminal and administrative penalties…
- [Recital 69](https://dposchool.com/data-act/recital/69): In accordance with Article 6(1) and (3) of Regulation (EU) 2016/679, a proportionate, limited and predictable framework at Union level is necessary when providing for the legal basis for the making…
- [Recital 70](https://dposchool.com/data-act/recital/70): The objective of the obligation to provide the data is to ensure that public sector bodies, the Commission, the European Central Bank or Union bodies have the necessary knowledge to respond to…
- [Recital 71](https://dposchool.com/data-act/recital/71): Data holders should have the possibility to either decline a request made by a public sector body, the Commission, the European Central Bank or a Union body or seek its modification without undue…
- [Recital 72](https://dposchool.com/data-act/recital/72): In the case of an exceptional need related to a public emergency response, public sector bodies should use non-personal data wherever possible.
- [Recital 73](https://dposchool.com/data-act/recital/73): Data made available to public sector bodies, the Commission, the European Central Bank or Union bodies on the basis of an exceptional need should be used only for the purposes for which they were…
- [Recital 74](https://dposchool.com/data-act/recital/74): When reusing data provided by data holders, public sector bodies, the Commission, the European Central Bank or Union bodies should respect both existing applicable Union or national law and…
- [Recital 75](https://dposchool.com/data-act/recital/75): When the safeguarding of a significant public good is at stake, such as responding to public emergencies, the public sector body, the Commission, the European Central Bank or the Union body…
- [Recital 76](https://dposchool.com/data-act/recital/76): A public sector body, the Commission, the European Central Bank or a Union body should be entitled to share the data it has obtained pursuant to the request with other entities or persons when this…
- [Recital 77](https://dposchool.com/data-act/recital/77): In order to handle a cross-border public emergency or another exceptional need, data requests may be addressed to data holders in Member States other than that of the requesting public sector body.
- [Recital 78](https://dposchool.com/data-act/recital/78): The ability of customers of data processing services, including cloud and edge services, to switch from one data processing service to another while maintaining a minimum functionality of service…
- [Recital 79](https://dposchool.com/data-act/recital/79): Regulation (EU) 2018/1807 of the European Parliament and of the Council (30) encourages providers of data processing services to develop and effectively implement self-regulatory codes of conduct…
- [Recital 80](https://dposchool.com/data-act/recital/80): Data processing services should cover services that allow ubiquitous and on-demand network access to a configurable, scalable and elastic shared pool of distributed computing resources.
- [Recital 81](https://dposchool.com/data-act/recital/81): The generic concept ‘data processing services’ covers a substantial number of services with a very broad range of different purposes, functionalities and technical set-ups.
- [Recital 82](https://dposchool.com/data-act/recital/82): Undermining the extraction of the exportable data that belongs to the customer from the source provider of data processing services can impede the restoration of the service functionalities in the…
- [Recital 83](https://dposchool.com/data-act/recital/83): Digital assets refer to elements in digital form for which the customer has the right of use, including applications and metadata related to the configuration of settings, security, and access and…
- [Recital 84](https://dposchool.com/data-act/recital/84): This Regulation aims to facilitate switching between data processing services, which encompasses conditions and actions that are necessary for a customer to terminate a contract for a data…
- [Recital 85](https://dposchool.com/data-act/recital/85): Switching is a customer-driven operation consisting of several steps, including data extraction, which refers to the downloading of data from the ecosystem of the source provider of data processing…
- [Recital 86](https://dposchool.com/data-act/recital/86): Functional equivalence means re-establishing, on the basis of the customer’s exportable data and digital assets, a minimum level of functionality in the environment of a new data processing service…
- [Recital 87](https://dposchool.com/data-act/recital/87): Data processing services are used across sectors and vary in complexity and service type.
- [Recital 88](https://dposchool.com/data-act/recital/88): Switching charges are charges imposed by providers of data processing services on the customers for the switching process.
- [Recital 89](https://dposchool.com/data-act/recital/89): A source provider of data processing services should be able to outsource certain tasks and compensate third-party entities in order to comply with the obligations provided for in this Regulation.
- [Recital 90](https://dposchool.com/data-act/recital/90): An ambitious and innovation-inspiring regulatory approach to interoperability is needed to overcome vendor lock-in, which undermines competition and the development of new services.
- [Recital 91](https://dposchool.com/data-act/recital/91): Where providers of data processing services are in turn customers of data processing services provided by a third-party provider, they will benefit from more effective switching themselves while…
- [Recital 92](https://dposchool.com/data-act/recital/92): Providers of data processing services should be required to offer all the assistance and support within their capacity, proportionate to their respective obligations, that is required to make the…
- [Recital 93](https://dposchool.com/data-act/recital/93): Providers of data processing services should also be required to remove existing obstacles and not impose new ones, including for customers wishing to switch to an on-premises ICT infrastructure.
- [Recital 94](https://dposchool.com/data-act/recital/94): Throughout the switching process, a high level of security should be maintained.
- [Recital 95](https://dposchool.com/data-act/recital/95): The information to be provided by providers of data processing services to the customer could support the customer’s exit strategy.
- [Recital 96](https://dposchool.com/data-act/recital/96): To facilitate interoperability and switching between data processing services, users and providers of data processing services should consider the use of implementation and compliance tools, in…
- [Recital 97](https://dposchool.com/data-act/recital/97): In order to facilitate switching between data processing services, all parties involved, including both source and destination providers of data processing services, should cooperate in good faith…
- [Recital 98](https://dposchool.com/data-act/recital/98): Data processing services which concern services of which the majority of main features has been custom-built to respond to the specific demands of an individual customer or where all components have…
- [Recital 99](https://dposchool.com/data-act/recital/99): In line with the minimum requirement allowing switching between providers of data processing services, this Regulation also aims to improve interoperability for in-parallel use of multiple data…
- [Recital 100](https://dposchool.com/data-act/recital/100): Open interoperability specifications and standards developed in accordance with Annex II to Regulation (EU) No 1025/2012 of the European Parliament and of the Council (33) in the field of…
- [Recital 101](https://dposchool.com/data-act/recital/101): Third countries may adopt laws, regulations and other legal acts that aim to directly transfer or provide governmental access to non-personal data located outside their borders, including in the…
- [Recital 102](https://dposchool.com/data-act/recital/102): To foster further trust in data, it is important that safeguards to ensure control of their data by Union citizens, the public sector bodies and businesses are implemented to the extent possible.
- [Recital 103](https://dposchool.com/data-act/recital/103): Standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability within and among common European data spaces which are purpose or…
- [Recital 104](https://dposchool.com/data-act/recital/104): To promote the interoperability of tools for the automated execution of data sharing agreements, it is necessary to lay down essential requirements for smart contracts which professionals create for…
- [Recital 105](https://dposchool.com/data-act/recital/105): To demonstrate fulfilment of the essential requirements of this Regulation, the vendor of a smart contract, or in the absence thereof, the person whose trade, business or profession involves the…
- [Recital 106](https://dposchool.com/data-act/recital/106): Besides the obligation on professional developers of smart contracts to comply with essential requirements, it is also important to encourage those participants within data spaces that offer data or…
- [Recital 107](https://dposchool.com/data-act/recital/107): In order to ensure the application and enforcement of this Regulation, Member States should designate one or more competent authorities.
- [Recital 108](https://dposchool.com/data-act/recital/108): In order to enforce their rights under this Regulation, natural and legal persons should be entitled to seek redress for infringements of their rights under this Regulation by lodging complaints.
- [Recital 109](https://dposchool.com/data-act/recital/109): Competent authorities should ensure that infringements of the obligations laid down in this Regulation are subject to penalties.
- [Recital 110](https://dposchool.com/data-act/recital/110): The EDIB should advise and assist the Commission in coordinating national practices and policies on the topics covered by this Regulation as well as in delivering on its objectives in relation to…
- [Recital 111](https://dposchool.com/data-act/recital/111): In order to help enterprises to draft and negotiate contracts, the Commission should develop and recommend non-binding model contractual terms for business-to-business data sharing contracts, where…
- [Recital 112](https://dposchool.com/data-act/recital/112): In order to eliminate the risk that holders of data in databases obtained or generated by means of physical components, such as sensors, of a connected product and a related service or other…
- [Recital 113](https://dposchool.com/data-act/recital/113): In order to take account of technical aspects of data processing services, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in respect of…
- [Recital 114](https://dposchool.com/data-act/recital/114): In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission in respect of the adoption of common specifications to…
- [Recital 115](https://dposchool.com/data-act/recital/115): This Regulation should be without prejudice to rules addressing needs specific to individual sectors or areas of public interest.
- [Recital 116](https://dposchool.com/data-act/recital/116): This Regulation should not affect the application of the rules of competition, in particular Articles 101 and 102 TFEU.
- [Recital 117](https://dposchool.com/data-act/recital/117): In order to allow actors within the scope of this Regulation to adapt to the new rules provided for herein, and to make the necessary technical arrangements, those rules should apply from 12…
- [Recital 118](https://dposchool.com/data-act/recital/118): The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(1) and (2) of Regulation (EU) 2018/1725 and delivered their opinion on 4…
- [Recital 119](https://dposchool.com/data-act/recital/119): Since the objectives of this Regulation, namely ensuring fairness in the allocation of value from data among actors in the data economy and fostering fair access to and use of data in order to…

This is reference material, not legal advice.

## Navigation

[Data Act Navigator](https://dposchool.com/data-act) / Recitals

## For AI agents

- Machine-readable index: https://dposchool.com/data-act/llms.txt
- JSON API: https://dposchool.com/data-act/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents