EU Data Act and Data Clauses in IoT Supply Agreements
- 1. Impact of the Data Act on Supply Agreements
- 2. Allocation of Design Obligations and Information Duties
- 3. Application of the Unfair Contractual Terms Rules
- 4. Trade Secrets and Restrictions on Data Use
- 5. Ongoing Amendments and Contract Adjustments
- 6. Implications for Businesses
- Related Laws and References
Reviewing the data holder role, allocation of design costs, unfair contractual terms, and trade secret protection
The EU Data Act has applied since September 12, 2025. It grants users of connected products a right to access the data those products generate and regulates unfair contractual terms in data agreements between businesses. Korean manufacturers supplying devices to the EU market need to revisit how data-related roles and responsibilities are allocated in their supply and distribution agreements with EU partners.
Devices placed on the EU market after September 12, 2026 are subject to a design obligation premised on user data access, and the unfair terms rules may apply from September 12, 2027 to long-term agreements concluded before September 12, 2025. This article summarizes the key clauses to review in supply agreements.
1. Impact of the Data Act on Supply Agreements
The Data Act applies to connected products placed on the EU market and to related services. Even if the manufacturer is established outside the EU, it may fall within the Act's scope when its devices are sold in the EU.
Users may access the data generated by their devices and, if they wish, require that the data be made available to third parties such as repair service providers (Articles 4 and 5). The party that must respond to such requests is the data holder, meaning the party that actually controls the data.
A Korean manufacturer that operates its own cloud platform and app may be the data holder. Conversely, if an EU brand owner receives the data through its own platform, that company may be the data holder, so the supply agreement should first define each party's role.
2. Allocation of Design Obligations and Information Duties
Devices placed on the market after September 12, 2026 must be designed so that users can easily access their data (Articles 3(1) and 50). Because this entails firmware and app modification costs, the agreement should specify which party bears them.
Before concluding a contract, the seller must inform the user what data the product generates and how it can be accessed (Article 3(2)). Since a distributor needs the manufacturer's technical information to provide this notice, the supply agreement should include an obligation to provide that information and a warranty as to its accuracy.
The agreement should also set out how much the distributor may recover from the manufacturer if it faces regulatory sanctions or customer disputes due to non-compliance. Without a liability cap, the manufacturer may face damages claims that exceed the supply price.
3. Application of the Unfair Contractual Terms Rules
Article 13 of the Data Act provides that an unfair contractual term concerning data access and use that has been unilaterally imposed by one enterprise on another is not binding on the latter.
Terms that exclude liability for intentional acts or gross negligence, or that exclude the remedies available to the other party in case of non-performance, are always considered unfair. Terms that prevent a party from using data it has contributed, or that allow termination on unreasonably short notice, are presumed unfair.
These rules apply to contracts concluded after September 12, 2025, and from September 12, 2027 they also apply to earlier contracts that are of indefinite duration or due to expire on or after January 11, 2034 (Article 50). Companies should review data clauses when their agreements come up for renewal.
4. Trade Secrets and Restrictions on Data Use
Device data may include information that reveals the manufacturer's design know-how. The Data Act does not allow a data holder to refuse access merely because data contains trade secrets, but it allows the data holder to agree with the user on confidentiality measures (Article 4(6)).
If no agreement is reached or the other party fails to implement the measures, the data holder may withhold the data, and in exceptional cases where it is highly likely to suffer serious economic damage, it may refuse access. Because the grounds for refusal are interpreted strictly, it is safer to specify the scope of data provided and the confidentiality measures in the agreement in advance.
Companies should also consider clauses prohibiting the distributor from using the data to develop competing products, as well as criteria for calculating compensation for data use.
| Clause | Key Review Points |
|---|---|
| Scope | Whether devices are placed on the EU market, designation of the data holder |
| Design and information | Costs of the design obligation, provision of pre-sale information and accuracy warranty |
| Unfair terms | Liability exclusions, exclusion of remedies, short-notice termination |
| Trade secrets | Confidentiality measures, conditions for withholding or refusing data |
| Legislative changes | Renegotiation upon adoption of amendments, allocation of GDPR roles |
5. Ongoing Amendments and Contract Adjustments
The EU is discussing a proposal to simplify digital rules, including the Data Act (the Digital Omnibus). The Council of the EU agreed on its negotiating position in October 2026, but the European Parliament has not yet adopted its position, so the amendments are not yet law.
Companies may align current agreements with the rules now in force while including a clause to renegotiate once the amendments are finalized.
Because device data of individual users may include personal data, companies should also confirm the GDPR legal basis and the allocation of roles in the data-sharing process.
6. Implications for Businesses
The Data Act has turned device data from an incidental by-product into the subject of contractual rights and obligations. If the supply agreement does not define the data holder role, design costs, and information duties, the burden of non-compliance may fall disproportionately on one party regardless of the transaction structure.
The unfair terms rules already apply to new agreements and will be extended to long-term existing agreements. Companies should update liability caps, termination conditions, and trade secret protection measures at renewal and continue to monitor whether the proposed amendments are adopted.
Related Laws and References
EUR-Lex — Regulation (EU) 2023/2854 (Data Act), Articles 3, 4, 13 and 50
European Commission — Data Act
Council of the EU — Negotiating Position on Simplifying Digital Rules (October 21, 2026)
