Purpose
The skill answers the threshold question of every Data Act mandate: is the company affected, in which role and from which date. It assigns products and services to the terms of the Regulation, examines the exemption for micro and small enterprises and translates the staggered start of application under Art. 50 to the specific facts. It also provides the position on jurisdiction and penalties under the German implementing act.
Inputs
- Product or service description: which data arise, where they are collected, where they are stored
- Role in the market: manufacturer, provider of a related service, dealer, renter, lessor, provider of a data processing service
- Enterprise size under Recommendation 2003/361/EC including partner and linked enterprises
- Time of placing the product on the market or of conclusion of the contract
- Existing contracts: term, open-ended or fixed-term, end date
- Whether personal data are affected and who is the controller within the meaning of Art. 4 No. 7 GDPR
- Whether trade secrets within the meaning of Section 2 No. 1 GeschGehG are contained in the data
Sub-agent architecture
A researcher consults the text of the Regulation, the DADG and – where available – guidelines of the Commission and the Bundesnetzagentur. A drafter assigns the facts to the legal definitions of Art. 2 and calculates the deadlines of Art. 50. A reviewer checks whether the role allocation has been maintained, whether the size exemption of Art. 7 (1) including the partner enterprise rule has been examined and whether every statement on the level of penalties is based on Section 15 DADG. No participant cites German case law on the Data Act without a reference.
Process
1. Clarify the material scope of application (Art. 1, Art. 2 Data Act)
Four terms are central:
| Term | Checkpoint |
|---|---|
| Connected product | An item that obtains, generates or collects data concerning its use or environment and that is able to communicate such data via an electronic communications service, a physical connection or on-device access, and whose main function is not the storage, processing or transmission of data on behalf of third parties |
| Related service | A digital service that is connected with the product at the time of purchase, rent or lease in such a way that the product could not perform one or more of its functions without it, or that is connected subsequently |
| Data holder | A person who, under the Regulation, applicable Union law or national law, is entitled or obliged to use and make available data |
| User | A natural or legal person that owns a connected product or to whom temporary rights to use it have been transferred by contract |
Covered are not only personal data. The Data Act is an access and contract regime for product data and related service data irrespective of personal data reference. Pure software products without sensors are generally not connected products; the distinction must be substantiated, not asserted.
2. Assign roles — and only one role per data stream
The regulation attaches per data stream . The same company can be a data holder vis-à-vis the customer and at the same time a data recipient vis-à-vis a supplier. The initial review names, for each data stream, the user, the data holder and — if applicable — third parties under Art. 5.
A gatekeeper designated under Art. 3 of Regulation (EU) 2022/1925 is not an authorized third party under Art. 5(3) of the Data Act; it may neither request users to pass on data nor receive data under Art. 4(1). This prohibition must be checked for every data transfer to large platform companies.
3. Check the exemption for micro and small enterprises (Art. 7(1))
The obligations of Chapter II do not apply to data from connected products manufactured or designed by a micro or small enterprise , or from related services of such an enterprise. Two exceptions to the exception that are almost always overlooked in practice:
- The enterprise has a partner enterprise or linked enterprise within the meaning of Art. 3 of the Annex to Recommendation 2003/361/EC that is not a micro or small enterprise. Group subsidiaries therefore regularly fall outside the exemption.
- The enterprise was as a subcontractor commissioned with the manufacture or design.
For an enterprise that has been regarded as a medium-sized enterprise for less than one year, and for connected products within one year after their placing on the market by a medium-sized enterprise, a one-year transitional period applies (Art. 7(1), second subparagraph).
Under Art. 7(2), contractual terms that exclude, derogate from or modify the user's rights under Chapter II are not binding on the user — a statutory invalidity order that applies alongside §§ 305 et seq. of the German Civil Code.
4. Calculate temporal applicability under Art. 50
| Regulation | Applies from / for |
|---|---|
| Regulation as a whole | 12.09.2025 |
| Design obligation Art. 3(1) | connected products and related services that were after 12.09.2026 placed on the market |
| Chapter III (obligations under other Union law) | only for provision obligations that after 12.09.2025 enter into force |
| Chapter IV (abuse control Art. 13) | Contracts that were after 12.09.2025 concluded |
| Chapter IV for existing contracts | from 12.09.2027, if the contract is of indefinite duration or its term ends no earlier than 10 years after 11.01.2024 |
| Elimination of switching fees Art. 29 (1) | 12.01.2027; until then only reduced, cost-covering fees (Art. 29 (2), (3)) |
Deterministic calculation see below.
5. Determine competence and sanctions under the DADG
Germany has implemented the Regulation with the Act on the Application and Enforcement of the Data Regulation (DADG) .
- Competent authority and data coordinator is, under Section 2 (1) DADG the Federal Network Agency. It is the central point of contact, handles complaints under Art. 38 Data Act, authorizes dispute settlement bodies under Art. 10 (5) and reviews data requests from federal public bodies.
- For fines for infringements relating to personal data, under Section 16 DADG in conjunction with Art. 40 (4) Data Act, the BfDI is competent.
- Investigative, information and enforcement powers follow from Sections 6 to 14 DADG, including interim orders (Section 11) and the protection of trade secrets in proceedings (Section 10).
Fine framework under Section 15 (4) to (6) DADG:
| Infringement | Framework |
|---|---|
| Section 15 (2) No. 9 (gatekeeper block Art. 5 (3)) | up to EUR 5 million; where total turnover exceeds EUR 250 million, up to 2% of worldwide total turnover (Section 15 (5), (6)) |
| among others Art. 3 (1), Art. 4 (1) sentence 1, Art. 5 (1) sentence 1 | up to EUR 500,000 |
| other designated infringements and Section 15 (3) | up to EUR 100,000 |
| remaining cases of Section 15 (2) | up to EUR 50,000 |
The administrative authority within the meaning of Section 36 (1) No. 1 OWiG is, under Section 15 (7) DADG, the Federal Network Agency.
6. Clarify the relationship with neighbouring legal regimes
- GDPR. The Data Act creates no separate legal basis for the processing of personal data. If the user is not the data subject, personal data may be made available under Art. 5 (7) Data Act only if a valid legal basis under Art. 6 GDPR – possibly Art. 9 GDPR and Art. 5 (3) Directive 2002/58/EC – exists. In more detail:
/datenschutzrecht:avv-pruefung. - Trade secrets. Art. 4 (6) to (8) and Art. 5 (9) to (11) provide for a graduated procedure: designation, agreement on technical and organizational measures, exceptional refusal. The protection under Section 2 GeschGehG is not removed; it is proceduralized.
- Database protection. Pursuant to Art. 43 Data Act, the sui generis protection right under Art. 7 Directive 96/9/EC does not apply to databases that contain product data or related service data. This is the answer to the widespread defence "our telemetry database is protected under §§ 87a et seq. UrhG".
- DGA. Regulation (EU) 2022/868 applies to data intermediation services and data altruism, implemented by the DGG; there too the Bundesnetzagentur is the competent authority.
Deterministic calculation
The cut-off dates in Art. 50 are fixed calendar dates, not time limits within the meaning of §§ 187 et seq. BGB. Only the expiry of contractual transition periods is to be calculated — for example the two-month notice period under Art. 25(2)(d) or the 30-calendar-day transition period under Art. 25(2)(a). The calculator in ../../../scripts/legal_calc/ performs only the arithmetic:
# Maximale Kündigungsfrist Art. 25 Abs. 2 Buchst. d: 2 Monate ab Wechselverlangen
python -m scripts.legal_calc.cli frist --ereignis 12.01.2027 --menge 2 --einheit monate --land BY
# Anschließende Übergangsfrist Art. 25 Abs. 2 Buchst. a: höchstens 30 Kalendertage
python -m scripts.legal_calc.cli frist --ereignis 12.03.2027 --menge 30 --einheit tage --land BY
Whether the contract falls under Art. 50(6) as an existing contract is a legal assessment and not a computational task.
Sources
Legal acts
- Regulation (EU) 2023/2854 (Data Regulation / Data Act), in particular Art. 1, 2, 3, 4, 5, 7, 13, 23–31, 37, 38, 40, 43, 50 — EUR-Lex
- DADG – § 2 DADG, § 6, § 15, § 16
- Regulation (EU) 2022/868 (Data Governance Act) — EUR-Lex; DGG
- Regulation (EU) 2016/679 (GDPR), Art. 6, 9, 20 — EUR-Lex
- GeschGehG, § 2
- Recommendation 2003/361/EC (SME definition)
Commentaries and literature
- Specht-Riemenschneider/Hennemann, in: Data Act, Commentary, Art. 2, Art. 7, Art. 50.
- Hennemann/Steinrötter, Data Act – Handkommentar, Art. 4, Art. 13.
- Wiebe, in: Wiebe/Schur, Datenrecht, chapter on the Data Act.
- Sattler, Data Act and GDPR, ZD 2024 (verify the exact citation before use)
[unverifiziert – prüfen]
Case law
To date there is no settled German or EU court case lawon the Data Act. Any decision that a model cites on this legal act is to be treated as [unverifiziert – prüfen] until substantiated in juris, Beck-Online or curia.europa.eu. Instead, the recitals of the Regulation, the Commission guidelines and the pronouncements of the Bundesnetzagentur are to be consulted for interpretation.
Output format
DATA-ACT-BETROFFENHEIT — <Mandant> — <Datum>
I. Sachlicher Anwendungsbereich
Produkt: <Bezeichnung>
Vernetztes Produkt: [ja / nein — Begründung]
Verbundener Dienst: [ja / nein — Begründung]
Datenkategorien: <Produktdaten / verbundene Dienstdaten / abgeleitete Daten>
Personenbezug: [ja / nein / teilweise]
II. Rollen je Datenstrom
Datenstrom 1: Nutzer <…> | Dateninhaber <…> | Dritter <…>
Torwächter beteiligt: [ja — Art. 5 Abs. 3 sperrt / nein]
III. Größenausnahme Art. 7 Abs. 1
Einstufung: <Kleinst / Klein / Mittel / Groß>
Partner-/verbundenes Unternehmen: [ja — Ausnahme entfällt / nein]
Unterauftragnehmer: [ja — Ausnahme entfällt / nein]
Ergebnis: [Kapitel II anwendbar / nicht anwendbar]
IV. Zeitliche Geltung Art. 50
Art. 3 Abs. 1: [einschlägig ab <Datum> / nicht einschlägig]
Kapitel IV: [Neuvertrag ab 12.09.2025 / Altvertrag ab 12.09.2027 / nicht erfasst]
Art. 29 Wechselentgelte: [ermäßigt bis 11.01.2027 / entgeltfrei ab 12.01.2027]
V. Zuständigkeit und Sanktionsrisiko
Behörde: Bundesnetzagentur (§ 2 Abs. 1 DADG)
Bußgeldrahmen: <Zuordnung zu § 15 Abs. 4 bis 6 DADG>
BfDI-Zuständigkeit: [ja § 16 DADG / nein]
VI. Schnittstellen
DSGVO: <Rechtsgrundlage / offen>
Geschäftsgeheimnisse: <gekennzeichnet? Maßnahmen vereinbart?>
Art. 43 (Datenbankrecht): <sui-generis-Schutz gesperrt?>
VII. Handlungsbedarf und Fristen
VIII.Risiko: 🟢 / 🟡 / 🔴 <Begründung>
IX. Quellenverzeichnis
Risks / typical errors
- Data Act treated as a data protection topic. The Regulation also covers non-personal data and conversely does not create a legal basis under Art. 6 GDPR. Both regimes must be examined side by side.
- Size exemption affirmed without a group review. Art. 7(1) ceases to apply as soon as a partner or affiliated undertaking is not a micro or small enterprise.
- Start of application generally set at 12 September 2025. The design obligation under Art. 3(1) applies only to products placed on the market after 12 September 2026; Chapter IV covers existing contracts only from 12 September 2027.
- Roles conflated. The assignment is made per data stream; a blanket self-classification as "data holder" will not withstand scrutiny.
- Trade secret as a ground for total refusal. Art. 4(6) ff. first requires labeling and protective measures; refusal is the exception requiring justification and must be notified to the Federal Network Agency.
- Claims sui generis database protection. Art. 43 of the Data Act blocks it for databases containing product and related service data.
- Amount of the sanction estimated at random. The frameworks are set out in Section 15(4) to (6) DADG and must be cited, not rounded.
- Case law fabricated. On the Data Act, they are still scarce; every decision must be substantiated or marked as
[unverifiziert – prüfen]to be designated.