Connected products and related services under the Data Act

• Regulation (EU) 2023/2854 — Data Act, Art. 37

Who has to appoint one

Manufacturers of connected products and providers of related services placed on the EU market, and data processing service providers, that have no establishment in the Union.

Thresholds and exemptions

Microenterprises are exempt from several obligations, but the representative requirement follows the product being placed on the EU market.

What must appear on the label

Pre-contractual information to the user about what data the product generates, how it is accessed and who the representative is.

Marketplace fields

Not a marketplace field, but the pre-contractual information must be given before the user is bound.

Documentation you must hold

Records of data access requests, the pre-contractual information, contractual terms with data recipients, and for cloud providers the switching documentation.

Standards and testing

Not applicable.

Language requirements

Pre-contractual information in the language of the user.

When it applies

Applicable from 12 September 2025. Design obligations for products placed on the market from 12 September 2026.

How long records are kept

For the life of the product and the related service.

What happens if you do not comply

Fines set by each member state, with the GDPR ceilings applying where personal data is involved.

Who enforces it

National competent authorities designated for the Data Act.

Where the boundary lies

This is a different appointment from the GDPR Article 27 representative, even though both may be held by the same company. The Data Act covers data generated by use of a product, personal and non-personal alike.

Questions we are asked

Does this apply to a simple smart plug?

If it is a connected product placed on the EU market, yes. The user has a right to the data it generates.