EU Model Clauses for the Data Act: Scope and Limitations

The European Commission has released a package of non-binding model contractual terms (MCT) and standard contractual clauses (SCC) designed to simplify contracting under the Data Act (Regulation (EU) 2023/2854). This document does not create new legal obligations but provides a reference framework for parties, especially SMEs, to draft contracts that comply with data access and use provisions generated by connected products.

The primary objective is to reduce contractual fragmentation and minimize friction in negotiations between companies. The clauses are drafted primarily for B2B relationships, although the official text indicates they can also be adapted to business-to-consumer relationships if relevant consumer protection rules are incorporated. Their use is voluntary and modifiable, meaning they do not replace the need for specific legal review for each case.

The package includes four sets of clauses covering the mandatory data exchange relationships established in the Data Act. The first set regulates the relationship between the data holder and the user, defining the rights of access and use of data generated by a connected product. The second addresses the relationship between the user and a third-party data recipient, when the user instructs the holder to share the data.

The other two sets focus on interactions between the data holder and third-party recipients, covering both cases where the holder is legally obliged to provide data and the conditions for compensation for such exchange. These clauses comply with Chapter IV of the Data Act, which states that unilaterally imposed clauses are not binding if considered abusive, thus offering a basis for contractual balance.

It is fundamental to distinguish these Data Act clauses from the GDPR Standard Contractual Clauses (SCC) already used by providers like Microsoft, IBM, and AWS for international transfers of personal data. While GDPR SCCs focus on protecting personal data outside the European Economic Area, the new Data Act MCTs focus on access to data generated by connected products, including non-personal data.

Major cloud providers already offer compliance mechanisms for data sovereignty and data residency, but the new model clauses introduce a specific focus on product data portability. This does not invalidate existing privacy policies but adds a specific contractual layer for the exchange of operational data from connected devices, an area that standard cloud policies often do not detail with the same granularity.

For companies managing cloud infrastructure in the EU, the main implication is the need to review their service contracts to incorporate these clauses if they wish to align their operations with the Data Act. This is particularly relevant for SMEs, which can use these models as a starting point to avoid complex negotiations. Adopting these clauses can accelerate contracting processes and offer greater legal certainty.

However, companies should not assume that including these clauses guarantees full compliance. They must verify that their cloud providers technically support the required data access and export mechanisms. The practical decision is to evaluate whether the provider offers data export APIs compatible with Data Act requirements, as contractual clauses cannot impose technical capabilities that the provider does not possess.

The model clauses do not address performance, technical security, or availability of cloud services. They focus exclusively on data access, use, and sharing rights. Therefore, companies must continue to rely on service level agreements (SLAs) and specific security policies of each provider to ensure the integrity and availability of their infrastructures.

Furthermore, being non-binding, these clauses do not have the force of law in themselves. Their value lies in standardization and the reduction of transaction costs. Organizations must be aware that any modification to these clauses could invalidate their alignment with the Data Act, so it is recommended to keep them intact or make minimal modifications supervised by legal experts.