The EU Data Act gives EU customers extensive rights to port and switch their data between cloud services or from a cloud service to their own on-premises infrastructure, while imposing significant obligations on cloud service providers to facilitate this data mobility. The policy objective is to tackle technology provider lock-in by making it easier for users to change cloud provider.
Market awareness is limited, with the Data Act generally being crowded out by AI governance and other regulatory concerns and the cloud-switching elements sometimes being forgotten as much of the Data Act relates only to IoT. Only eight of the 50 Articles relate to cloud-switching.
Cloud services are so prevalent and varied that it is impossible to generalise what the practical effect of cloud-switching will be. Certainly, some cloud services are effectively 'plug and play' and may be relatively easily switched out for alternatives and customers may appreciate and use that flexibility. Others take significant internal team time and resource to select, test and implement and/or are often part of a complex supply chain of cloud providers. In either case, we query the extent of user appetite to switch outside of the committed contract duration. Customers need to look carefully at the financial implications of switching given the Act allows proportionate early termination fees, raising the risk of early discounts being repayable and/or some payment for the remaining term of the contract.
Key issues for providers and customers
Does your cloud contract address the Data Act?
The cloud-switching provisions have been in force since 12 September 2025 with no grace period for cloud contracts in place before that date, and many large cloud providers have already published their template Data Act addenda. With patchy customer awareness and no immediate sign of national regulators issuing guidance or preparing to enforce, providers have had to make a call on whether to proactively push their addendum or simply have it available where needed.
Which customers get the right to switch?
Providers of data processing services to customers in the Union (meaning the EU) are caught. Customers are defined as any organisation or individual (B2C services are also covered) who has a contract with a provider of a data processing service.
The legislative intent is to protect EU customers, but providers may argue that their EU users are not always party to a contract with them: eg multinational deals where a non-EU company is party and EU group companies have rights of use (which may not always be directly enforceable against the provider). Also, if those EU affiliates do benefit from the cloud-switching rights, what is the effect on a global pricing deal if their use can be switched but not that of their non-EU affiliates? We have no guidance on the point, and may need to wait for national regulators or the European Data Innovation Board (which has a general co-ordination role) to issue guidance (although we currently have no indication of whether or when that will happen).
For now, providers may want to argue that these global deals are outside the scope and customers that they are in-scope and look to draft in rights accordingly.
Are all cloud-based services in scope?
The cloud-switching provisions apply to "a digital service that is provided to a customer and that enables ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature that can be rapidly provisioned and released with minimal management effort or service provider interaction" and the recitals make it clear that SaaS, PaaS, IaaS and DaaS are in scope. This is a very similar definition to NIS2 – so a fairly standard EU legislative definition of a cloud service.
The 'word on the street' is that all cloud-provided services are covered, but a note of caution: providers and customers should review how their services are implemented. For instance, where the provider's platform (or material functionality within it) is hosted on customer-managed cloud infrastructure and not on the provider-managed cloud infrastructure, we see arguments that the cloud switching provisions do not apply. This is because the provider is not delivering the digital service which is ubiquitous, on demand etc; rather the provider is allowing the customer to have its platform installed in a third party's service which has those qualities.
Be aware of the specificity of the requirements
The customer's right to terminate at any time for convenience on a maximum of two months' notice is rightly the headline, but businesses are sometimes surprised at how detailed and specific the cloud-switching requirements are. The voluntary standard contractual clauses for cloud-switching developed by an expert group for the EU Commission have a number of options, but addenda built using them are typically around 10–12 pages long, some longer, so significant detail. For many cloud services, we do not think that level of detail is needed (see here for more on the SCCs).
The specific requirements of the cloud-switching provisions of the Data Act include:
- Specifications of exportable data: the contract should include an exhaustive specification of all categories of data and digital assets (being essentially customer content/IP uploaded to the service) that can be ported during the switching process and of any exclusions from exportable data where the provider's trade secrets are involved.
- Three periods are mandated: a maximum notice period of two months, a transitional period (during which switching happens and set at a maximum of 30 days unless the customer or the supplier wants it to be longer) and a data retrieval period of a minimum of 30 days. Some addenda simplify this, as the current exit processes for many cloud services are more streamlined.
- Data erasure: after data has been exported it must be fully erased by the provider including all data generated by the customer's use of the services (whether personal or not), creating a challenge for ongoing use for analytics, product improvement and model training. Vendors needing to reserve these rights should check that their contracts permit that use, and be ready for customer objections.
Review customer exit processes
There is also a general positive obligation on providers to remove technical barriers to switching and an overriding obligation of good faith on both "source" and "destination" providers (the existing and replacement providers, respectively) to make the switching process effective and enable the secure and timely transfer of necessary data. For providers, this means a general review of the existing exit and data extraction process for terminating customers to assess whether they should make any changes or improvements. Other than for Infrastructure as a Service providers, the obligation on the source provider does not, in our view, mean they have to ensure that the exportable data or digital assets actually work on the new provider's or the customer's on-premises infrastructure.
Impact on fees
Payment structures for cloud services vary significantly, from up-front payments (sometimes for two or three-year fixed terms with a discount on fees in return for that longer commitment) to annual up-front payments, auto-renewing and purely consumption-based fees. The impact of the customer's right to switch needs to be assessed in the context of the payment structure in question. That is not straightforward as the Data Act does not have detailed provisions on this crucial question.
What is clear is that until January 2027, only the direct costs of the switching process can be charged by providers and after that time, no switching charges can be levied at all against EU customers. This has led some providers to drop exit fees well in advance of that date. Providers should review exit charges in the light of these changes.
The Data Act also states that nothing in it "prevents [ ] parties from agreeing on contracts for data processing services of a fixed duration, including proportionate early termination penalties to cover the early termination of such contracts". So it does not explicitly require refunds of any amounts paid pre-switching even if they relate to post-switching use.
Providers should remember that once the switching process is complete, the Act provides for the contract to terminate, so any future instalments would not be payable unless the contract specifies that they are early termination fees. As a result, for payment structures which involve instalments paid over a fixed term, it benefits providers to provide expressly for early termination fees.
We have no guidance on what a proportionate early termination fee would be, and we see some providers insisting that the full payments due for the remainder of the fixed term are the termination fee – they just get accelerated on switching. Customers may object that this is not "proportionate" – and that proportionality implies that some reduction in the remaining fees should be made to reflect costs the provider does not incur because it no longer has to deliver under the contract. That logic could also be applied to up-front payments where the customer has not had the benefit of a substantial period of the service it has pre-paid for.
There is no correct position on this as yet. There remains significant uncertainty about how courts will interpret these provisions. For now, it is a matter for negotiation with companies filling in the gaps left by the vague drafting of the legislation as best they can. Guidance from national regulators and case law is likely to emerge at some point.
Providers: watch revenue recognition and investor reporting
These issues impact different cloud providers in different ways, but a key concern for cloud providers is whether the switching right undermines their ability to recognise revenue. US GAAP is particularly sensitive to customer termination rights, so the Data Act risks undermining their ability to recognise revenue in the ways they are used to. Other providers (e.g. those who charge monthly based on actual consumption) may be less affected. Engagement with internal finance teams and possibly auditors is recommended.
Equally, companies which are used to reporting annually-recurring revenue to investors – a key metric for measuring performance – will need to address whether the approach needs adjusting for EU customer revenue given the risk of customers switching without needing to show a breach of contract by the provider.
What elements of data are "exportable data" to which a switching customer is entitled?
Under Article 2(38), "exportable data" includes all input and output data, including metadata, which is directly or indirectly generated by the customer's use of the data processing service.
This includes the primary data files uploaded by clients and as modified/generated by the core provision of the service but also configuration settings, logs, analytics, and any derived data created during the services. This is a broader category of data than is typically made available for download/export at the end of a cloud contract. It is not always obvious how customers make use of the metadata. Many customers may be happy with the current market practice of 'getting their data out' at the end of the contract, but providers and customers should be aware of the wider scope of exportable data.
The data must be provided in a structured, commonly used and machine-readable format so providers may need to alter or transform certain data elements to comply with this requirement. This broad scope means customers are entitled to a comprehensive data package that enables them to replicate their setup with a new provider.
An incomplete picture
The uncertainties around the Data Act's cloud-switching provisions are likely to remain while market practice develops. Further guidance from national regulators and the Data Innovation Board would be helpful, particularly in relation to what constitutes "proportionate" early termination fees, and on how to treat multi-national deals, but some issues may only be resolved by the courts. Perhaps one of the biggest questions is the extent to which these cloud-switching provisions will be used by customers and again, it will take some time for a full picture to emerge.
