The data your machine generates is yours: what the Data Act gives you and why almost nobody is using it yet

What this Data Act thing is and why it matters to you

If you run a factory, workshop, or industrial facility with modern equipment, there's a good chance much of it is connected. A CNC center logging cycles and temperatures. A forklift reporting its use. Sensors on a packaging line. Compressors, boilers, collaborative robots. All of that generates data every second you operate.

The uncomfortable question is: who has that data? Until now, almost always the manufacturer. You buy the machine, but the data it produces while running ends up in the vendor's cloud. And if you wanted to analyze it, integrate it with your ERP, or give it to another maintenance technician, you depended on their goodwill and whatever a contract you probably never read said.

That's exactly what the Data Act changes. The European Commission says it plainly: the goal is to give users and companies more control over data generated by their connected devices, from cars to industrial machinery. It's not a property law — the regulation deliberately avoids saying "who owns the data" — but an access law. It recognizes that the user of a machine depends technically on the manufacturer, and corrects that imbalance.

Two dates you need to mark

The regulation came into force on January 11, 2024, but that means nothing practical for you. What matters are two later dates.

The first is September 12, 2025. From that date forward most of the standard applies: your rights to access data, the right to share it with third parties, rules against abusive contracts between businesses, and obligations for cloud providers to let you switch. In other words, it's already in effect as you read this.

The second is September 12, 2026. From then on, connected products put on sale in the EU must be designed so their data is accessible "by default and by design". In the jargon they call it data access by design. In plain terms: the next machine you buy will have to let you access its data from day one, with no tolls or intermediaries.

So we're not talking about something that's coming. We're talking about rights you have right now that will get stronger next year.

The three specific rights it gives you

Let's drop the theory. This is what you can now do that you couldn't before, or not easily.

Access the data your machine generates

Article 4 of the regulation gives you the right, as a user, to access data generated from the use of your connected product when you can't reach it directly. That includes both what you input and what the machine generates while working: performance, consumption, operating conditions, interactions. The manufacturer must deliver it free of charge, without undue delay, and in a structured, common, machine-readable format. Not a PDF with screenshots — data you can actually process.

One important caveat. The right covers "observed" and preprocessed data, not inferred data: if the manufacturer invested in building a predictive model from your data, that derivative analysis doesn't automatically transfer. But the raw data from your machine does.

Share it with whoever you choose

Article 5 lets you designate a third party to receive that data. What does that mean for you? That if you want another company to do predictive maintenance on your equipment, or a systems integrator to hook your plant data into your management system, the manufacturer must facilitate that transfer. They can't create technical or economic obstacles to hold you hostage as a captive customer of their aftermarket services.

One relevant exception: you can't designate as recipient one of the large platforms labeled "gatekeepers" under the Digital Markets Regulation. That's a safeguard to keep this data from enriching the usual suspects.

Switch cloud providers without getting trapped

The third block tackles vendor lock-in — that phenomenon where once your data is in one provider's cloud, leaving costs so much you end up staying by force. The Data Act requires cloud service providers to enable switching: gradually reduce exit costs, give reasonable transition periods, and not chain you with abusive early-termination clauses. If your ERP, WMS, or production history lives in a cloud, this gives you negotiation power you didn't have before.

OK, but what is this actually good for?

A right you don't exercise isn't worth anything. Here are realistic moves for a Galician industrial SMB that wants to make the most of it.

Negotiate maintenance with whoever you want. If you were locked into the manufacturer for everything because only they could "see" the machine, now you can request your data and take maintenance to a cheaper or closer third party. Real competition where there was captivity before.

Feed your own analytics. Raw data from your equipment, merged with your ERP or WMS, gives you a picture of your plant that was previously fragmented across multiple vendors. Consumption, downtime, bottlenecks. It's the foundation for decision-making based on numbers, not gut feel. If you're thinking about a digital twin, this is the raw material.

Renegotiate your cloud. Before renewing with your cloud provider, look at the exit clauses. With the Data Act on your side, you have ammunition to demand portability and fair terms. Or to leave for someone who treats you better.

Buy better next time. Ahead of September 2026, demand in your purchase specs that equipment complies with data access by design. It's as legitimate a selection criterion as price or warranty.

What if I also manufacture or sell connected products?

The picture changes. If your SMB makes or sells machinery, sensors, or other connected products, you're no longer just a user — you're a data holder, and you have obligations.

You'll have to respond to access requests from customers in machine-readable format and within reasonable time. You'll need to review your contracts and strip out clauses that, under Article 13, might be deemed abusive between businesses and become void. And for products you launch after September 2026, you'll need to design them with data accessibility built in from the start.

It's not the end of the world, but it takes time to review your contracts and data flows carefully. One important note: when those data include personal data, GDPR still rules. The Data Act doesn't create a new legal basis for processing personal data; it coexists with the data protection regulation, it doesn't replace it.

One detail specific to Spain worth keeping on your radar: to date the country hasn't yet designated the national authority that should oversee the Data Act. That creates some uncertainty in enforcement and makes it likely that, in the early stages, most conflicts will be resolved privately, between companies and in courts. Translation: the contracts you sign now carry more weight than ever.

What to do this week (even without a legal department)

You don't need a committee or a law firm to get started. These steps put you ahead of the pack.

• List your connected machines. Which equipment generates data, who has it right now, and whether you can see it yourself.
• Review contracts with each manufacturer. Hunt for clauses about data and aftermarket services. If something locks you in with no exit, note it.
• Look at your cloud contract. Find the termination and data export conditions. That's where the Data Act gives you leverage.
• Request data from a manufacturer as a test. Pick one piece of equipment, formally ask for access to its data, and watch how they respond. You'll learn a lot from that first request.
• Add it to your next purchase criteria. Make data accessibility a line item on your spec sheet, not a surprise two years later.

The key is understanding this isn't paperwork for its own sake. It's leverage to pay less for maintenance, to know your own plant better, and to avoid being locked into a single vendor. Whoever grasps it first will negotiate better.

Frequently asked questions

When does the Data Act apply in Spain?

EU Regulation 2023/2854 came into force on January 11, 2024 and is applicable from September 12, 2025 across the EU, Spain included. The obligation to design products with data access "by default" (Article 3) arrives September 12, 2026 for products put on the market from that date onward.

What exact rights does it give me over my machinery data?

As a user you have the right to access data your machine generates from use (Article 4) and to share it with a third party you designate (Article 5). The manufacturer must deliver it free of charge, without delay, in a structured, machine-readable format, and on fair and non-discriminatory terms.

Does it obligate me if I only use machinery and don't manufacture it?

Virtually nothing. If you're only a user, the Data Act gives you rights, not duties. The obligations fall on manufacturers, data holders, and cloud providers. Your only "job" is to use them.

Can the manufacturer charge me for my data?

Not you as the product user — they must provide it free. It changes when data goes to a third party, where reasonable compensation can apply under fair conditions. But access to your own machine data is free.

What if the manufacturer refuses to give me my data?

They can limit access in justified cases, like protecting trade secrets, but they can't refuse outright or create disproportionate barriers. Since Spain hasn't yet named a supervisory authority, in practice many disagreements will be settled contractually and, if needed, in court. That's why documenting everything matters.

Does the Data Act replace GDPR?

No. It's horizontal, covers personal and non-personal data, but where personal data is involved GDPR still applies. The Data Act complements rights like portability but doesn't create new legal grounds for processing personal data.