Regulation (EU) 2023/2854, known as the Data Act, changes the way businesses access, share and control data generated by connected products and digital services. It is a turning point for any company in the data economy, and in the travel technology sector its impact is particularly far-reaching.
When does the Data Act apply from?
The Data Act has applied generally since 12 September 2025 in all Member States. Some obligations have their own dates: the design obligations for connected products apply to those placed on the market after 12 September 2026, and the rules on unfair terms will extend to certain earlier contracts from 12 September 2027.
Which TravelTech companies are affected?
It affects companies that develop or use technologies such as IoT devices, digital platforms, cloud services, hotel management software, travel apps or mobility solutions. Whether your company is a provider or uses third-party tools that generate or process data, it is very likely to have new obligations.
What changes in practice
The Data Act is not a technical standard: it is a legal instrument with very concrete effects on contracts, customer relationships, product design, data governance and public-private cooperation. In particular, it governs:
- Data access: how you give access to the data generated or managed by your products and services.
- Switching providers: how you allow your customers to switch data processing service providers, such as cloud services.
- Unfair terms: which data-related terms in business-to-business contracts are considered unfair.
- Access by public authorities: the conditions on which they can request data in exceptional situations, such as public health emergencies or natural disasters.
The Data Act and the GDPR: how do they fit together?
The Data Act does not replace the GDPR; it complements it. The GDPR governs personal data and privacy; the Data Act focuses on fair, secure and structured access to data generated by connected products, whether personal or not. Companies that fail to adapt are exposed to penalties, contractual disputes, lost opportunities and reputational damage that is hard to undo.
Our white paper on the Data Act
We have prepared a legal white paper for heads of legal, CEOs, CTOs and strategic decision-makers. It analyses the legal text, identifies the most relevant risks for tourism businesses and sets out concrete recommendations to get ahead.
Download the white paper on the Data Act
Why act now?
Adapting to the Data Act is not only a compliance issue: it is an opportunity to position your company on transparency, interoperability and the strategic use of data. Reviewing your contracts, systems and commercial relationships now saves you from having to renegotiate them in a hurry.
Frequently asked questions
When does the Data Act apply from?
Generally, from 12 September 2025. Some obligations have their own dates, such as the design obligations for connected products (placed on the market after 12 September 2026) or unfair terms in certain earlier contracts (from 12 September 2027).
Does the Data Act replace the GDPR?
No. The GDPR governs personal data; the Data Act governs access to and use of data generated by connected products and related services, whether personal or not. Both apply at the same time.
Does the Data Act affect a hotel that only uses third-party software?
It may affect it as a user of connected products or as a customer of cloud services, with rights to access data and to switch providers. It is worth reviewing the contracts with those providers.
Sources
This article is for information only and does not constitute legal or tax advice.
