Wojciech Dybka for Rzeczpospolita: “You need an exit plan to change your cloud service provider.”
The EU Data Act is intended to make it easier for cloud service customers to change providers, transfer data, and use multiple clouds simultaneously. In practice, however, the real protection of users’ interests depends largely on contractual provisions and the effectiveness of negotiations with the provider. Associate Wojciech Dybka writes about the opportunities and risks associated with the Data Act in the daily newspaper Rzeczpospolita.
Scope of application of the Data Act and the right to change providers
The Data Act, which will apply from September 12, 2025, covers a wide range of data processing services, including classic cloud models such as SaaS, PaaS, and IaaS, as well as other and future cloud services. The rights provided for in the act apply to both consumers and businesses, regardless of the degree of individual customization of the service. The essence of the right to switch providers is the ability to transfer exportable data—personal and non-personal—along with the metadata necessary for its further use.
The importance of the contract in the light of general EU regulations
Although the Data Act imposes an obligation on cloud service providers to facilitate switching and prohibits barriers to this process, many key issues are left to be regulated in the contract between the parties. The provisions only set out the framework for the exit strategy and general technical requirements for data migration. Their vague nature means that the actual scope of the provider’s obligations and the real protection of the customer’s interests depend on the specific contractual provisions.
Data, metadata, and technical support as critical elements
One of the most important areas of contract negotiation is the precise definition of the categories of data and metadata covered by the supplier change process. Too narrow a scope may prevent a smooth transition to another provider and lead to significant disruptions in the customer’s business. It is equally important to regulate the scope of technical support, access to interfaces, and standards enabling efficient data migration, without which the exit strategy may remain only a formal provision.
Notice period and consequences of non-performance
The text also draws attention to problems related to the notice period, particularly in cases of immediate termination. The lack of clear regulations in the act on data causes uncertainty as to the obligations of the parties during the transition period. The author also points out that although the regulation provides for supervisory mechanisms and administrative sanctions against suppliers, it does not comprehensively regulate the civil law consequences of violations, which further reinforces the importance of appropriately constructed contractual provisions.
In practice, this means that a number of fundamental questions need to be answered:
how broad should the scope of data and metadata covered by migration be, what technical support can the customer realistically enforce from the provider, how should the contract termination period be structured, and what mechanisms will protect the interests of the cloud user in the event of non-performance by the provider.
Wojciech Dybka answers these and many other questions in his article, which appeared in the daily newspaper Rzeczpospolita.