The Data Act enters into force: scheduled end of cloud lock-in

2024-01-11 · Publisher : Union européenne · Domain : Cloud & DevOps

Regulation (EU) 2023/2854, the Data Act, enters into force on 11 January 2024. It will apply from 12 September 2025 and requires cloud providers to make switching to another provider easier.

### Background Regulation (EU) 2023/2854, known as the **Data Act**, published in the Official Journal of the European Union on 22 December 2023, enters into force on 11 January 2024. Most of its provisions will apply 20 months later, from 12 September 2025. Its Chapter VI targets cloud directly: it requires providers of data processing services (IaaS, PaaS, SaaS) to remove obstacles to switching provider and to multicloud use. ### Key facts - Notice period of two months at most, followed by a 30-day transition period during which the outgoing provider keeps the service running and assists the migration. - Switching charges are limited to costs directly linked to the migration until 12 January 2027, then abolished. - Contracts must describe the migration procedure, the customer's rights and data erasure once the transfer is complete. - Providers must disclose where their infrastructure is located and what measures they take against government access to non-personal data. - Micro-enterprises and SMEs are not exempt from these switching rules. ### Why it matters For CIOs, this is the first European text that makes reversibility enforceable by law rather than only negotiable by contract. It adds to the SWIPO self-regulatory codes, whose uptake the Commission had found limited. Exit clauses, egress fees and architectures that depend on proprietary services need to be reviewed before the 2025 deadline. ### Takeaway The text enters into force in January 2024, but the 12 September 2025 date is what sets the timetable for bringing cloud contracts into compliance.

Tags : Réglementation, Europe, Cloud, Données, Multi-cloud