REP27 · Data Act · Representative
Regulation (EU) 2023/2854 · applicable since 12 September 2025
The Data Act has been applicable since 12 September 2025 and most companies outside the Union that sell connected products have never heard of the representative it requires. The obligation is close in shape to Article 27 of the GDPR and entirely separate in substance: it covers data generated by the use of a product, personal and non-personal alike, and it exists so that a user in the Union has someone to address when the manufacturer is on another continent. This page sets out who needs the mandate, what it covers and what it does not.
Connected productsRelated servicesData holderUser rightsCloud switching
Two questions decide it, in this order. Does your product generate data through use, or does your service relate to such a product? And is any legal entity of yours established in the Union? A yes to the first and a no to the second puts you inside the obligation, whatever your size and wherever your servers sit.
Manufacturer of a connected product, provider of a related service, or data holder receiving the data generated by use. One company is often two of the three at once, and the duties attached differ.
Establishment means a legal entity of yours carrying out real activity in the Union, not a server region and not a distributor.
One where the products are placed on the market or the related services are offered. Aligning it with your other mandates keeps audits short.
A written designation with an entity established there, accepting to be addressed by users and competent authorities on matters under the regulation.
The representative's details belong with the pre-contractual information you already have to give under Article 3.
Requests and correspondence from users and from the competent authorities designated by each Member State under the regulation.
What you provide is kept available, so a request does not depend on time zones or on finding the right team.
Answers procedural questions within deadlines, in the language the request arrived in.
Everything reaches you the same working day. The substantive answer, including whether data is provided and on what terms, stays with you.
Designing the product so data is accessible, and running the interface that delivers it, is engineering work inside your company.
Terms with data recipients, compensation, trade secret safeguards: yours to decide, ours to receive correspondence about.
Companies that sell connected hardware into the Union usually end up holding several designations at once. Seeing them together is the fastest way to work out what is missing, and to avoid paying twice for the same thing.
| Regulation | What it protects | Representative required? | Where it appears |
|---|---|---|---|
| Data Act 2023/2854 | Data generated by product use, personal and not | Yes, if not established in the Union | Pre-contractual information |
| GDPR 2016/679 | Personal data of people in the Union | Yes, under Article 27 | Privacy notice |
| GPSR 2023/988 | Safety of the physical product | Yes, Article 16 responsible person | The label |
| Cyber Resilience Act 2024/2847 | Security of products with digital elements | Optional under Article 18 | Technical documentation |
| NIS2 2022/2555 | Network and information systems | Yes, for listed service providers | Entity registration |
Not everyone is caught, and we would rather say so before you buy. Three exclusions matter in practice.
The data sharing obligations largely do not apply to enterprises below the small threshold, and to medium-sized ones for the first year after they cease to be small. The carve-out is real, but it is narrower than people hope: it does not cover every duty and it does not last.
If nothing you make reaches the Union, and no related service is offered there, the regulation does not reach you.
Data from products still in testing, not yet placed on the market, is outside.
Being a business seller rather than a consumer one, hosting data outside Europe, or having a distributor in the Union. None of those removes the obligation.
| We do | You do |
|---|---|
| Sign the mandate within 24 hours of the intake call | Decide your role: manufacturer, service provider, data holder |
| Appear as your representative, with a verifiable certificate | Design the product so data is accessible under Article 3 |
| Receive requests from users and authorities | Answer them on the substance, within the regulation's terms |
| Hold the documentation you give us | Draft the pre-contractual information and keep it accurate |
| Forward everything the same working day, in eight languages | Set the terms with data recipients, including compensation |
| Keep one renewal date with your other mandates | Handle trade secret safeguards and any dispute that follows |
What nobody does for you: making the data actually available. The Data Act is a design obligation before it is a paperwork one, and no representative changes that.
Nobody wakes up and reads Regulation 2023/2854. In practice the Data Act arrives through one of four doors, and knowing which one you are standing in tells you how fast to move.
| How it arrives | What is being asked | How urgent |
|---|---|---|
| A customer requests their machine data | Access under Articles 4 or 5, often to give it to a service partner | Immediate: a refusal starts a complaint |
| A procurement questionnaire | How your product satisfies the access duty, and who your representative is | Within the sales cycle, so weeks |
| A repairer or analytics provider | Transmission to a third party the user has named | Immediate, and commercially sensitive |
| A competent authority | Usually following a complaint about a refusal | Deadlines apply, and silence is the worst answer |
The third row is where the friction lives, because it is the one that touches aftermarket revenue. The regulation was written with exactly that in mind: opening repair, maintenance and analytics markets around connected devices is not a side effect, it is the stated purpose. Manufacturers who plan for it keep the relationship with the customer; manufacturers who resist it tend to lose both the argument and the account.
Whether it obtains, generates or collects data about its use or environment and can communicate it. That definition decides whether it is a connected product at all.
If a European entity of yours places the product on the market, the representative duty falls away for that entity.
An app, a portal, a subscription without which the product loses functions. It carries its own duties.
The micro and small enterprise carve-out is real, and we would rather establish it before invoicing than after.
Article 27, GPSR, NIS2. Aligning the renewal dates now saves an administrative mess in twelve months.
If your company is not established in the Union and you place connected products on the Union market or offer related services there, the Data Act requires a representative established in a Member State, and the mandate is signed in writing exactly as under Article 27 of the GDPR. The representative receives requests from users and authorities, holds the documentation you provide and forwards everything to you the same working day. What it cannot do is design your product, build the export route or negotiate terms with data recipients, because those are engineering and commercial decisions that belong inside your company.
The obligation has applied since 12 September 2025. Micro and small enterprises are largely carved out of the sharing duties, and we would rather establish that on the intake call than sell you a mandate you do not need.
We do not sign a Data Act mandate from a form alone, because the role question decides which duties attach and it is answered by looking at the product rather than at the company description.
| Question | Why it matters | What it changes |
|---|---|---|
| Does the product generate data through use? | That is what makes it a connected product | Whether Chapters II and III apply at all |
| Do you also provide a related service? | Apps and cloud backends usually are one | Adds related service data to the scope |
| Who holds the data? | The data holder carries the sharing duties | Whether the duties are yours or a partner's |
| Is any entity of yours established in the Union? | Establishment removes the representative duty | Whether you need this service |
| Where are the products placed on the market? | Constrains the choice of Member State | Which authority will address you |
| Are you a micro or small enterprise? | The carve-out is real but partial | Which sharing duties apply |
Half an hour on these six questions saves a wrong purchase, and we would rather tell you that the regulation does not reach you than sell a designation you will cancel in a year. The most common outcome is the opposite of what companies expect: they arrive thinking only the app is covered, and discover the industrial readings are the larger part of the obligation.
If your product generates data through use, if you place it on the Union market or offer a related service there, and if no entity of yours is established in the Union, you need a written mandate naming a representative in a Member State where you sell. It is a separate designation from Article 27 GDPR, it belongs with your pre-contractual information rather than in your privacy notice, and it exists so a user in the Union has somebody to write to. Everything the regulation actually asks you to build — access by design, the disclosure, the sharing route — stays with your own teams.
For manufacturers of connected products and providers of related services that are not established in the Union and place products or offer services there, yes. It is not optional.
The regulation entered into force in January 2024 and has been applicable since 12 September 2025, with some provisions phased in through 2026 and 2027.
No. Different regulation, different scope. The Data Act covers data generated by product use, personal and non-personal; Article 27 covers personal data only.
Yes, with two separate written designations, two certificates and one renewal date.
An item that obtains, generates or collects data about its use or environment and can communicate that data, whether over a network or directly.
A digital service, other than an electronic communications service, connected with the product at the time of purchase or later, without which the product could not perform some of its functions.
Micro and small enterprises are largely carved out of the data sharing duties, and medium-sized ones for a period after growing. The carve-out does not cover every obligation.
No. What matters is whether the product is placed on the Union market or the service offered there, not where the servers are.
One where your products are placed on the market or your services offered. Keeping it consistent with your other mandates simplifies audits.
With the pre-contractual information required by Article 3, and wherever you already identify yourself to users.
It receives and forwards them. Deciding what is provided, in what format and on what terms is yours, because only you know the product.
Yes, but not as a blanket refusal. The regulation expects safeguards to be agreed, and refusal is possible only in defined circumstances.
Chapter VI applies to providers of data processing services and is separate from the representative duty, though a non-EU provider can be caught by both.
Set by Member States, which must make them effective, proportionate and dissuasive. Where personal data is involved, GDPR penalties apply in parallel.
Yes. The Data Act covers business users as well as consumers; that distinction changes the terms, not the obligation.
The mandate is signed within 24 hours of a short intake call to confirm your role and the Member State.
€490 a year for the Data Act designation, with a lower price when combined with the other mandates you hold with us.
Product design, building the access interface, negotiating with data recipients, and legal advice on national implementing rules.
Related: what data users can obtain · how it differs from the GDPR
Europe Services, SE in Prague, signed within 24 hours, with a verifiable certificate and a desk that answers users and authorities in eight languages.
Request this service