The question "Does the EU Data Act affect us?" is now reaching the agenda of companies that sell smart devices, machinery or connected equipment to Europe, and it comes with concrete dates attached. According to the European Commission, the Data Act entered into force on 11 January 2024 and has applied since 12 September 2025. Moreover, two critical milestones in the timeline are close: the obligation on the design of connected products applies to products placed on the market after 12 September 2026. Cloud provider switching charges, in turn, disappear entirely from 12 January 2027.
In this article, we summarize the routes through which the Data Act may affect Turkish companies, based on the Commission's page and the text of the Regulation on EUR-Lex, and we propose a practical checklist.
What does the Data Act regulate?
Article 1 of Regulation (EU) 2023/2854 lists the matters it covers: the making available of connected product and related service data to the user, data sharing between businesses, the provision of data to public bodies in exceptional circumstances, easier switching between data processing services, safeguards against unlawful foreign access to non-personal data, and interoperability standards.
For Turkish companies, the decisive element is the scope provision. The Regulation applies to manufacturers of connected products placed on the market in the EU and to providers of related services, regardless of where they are established. The same approach holds for providers that offer data processing (cloud) services to customers in the EU. In other words, a manufacturer or software company headquartered in Türkiye has to carry out a scope assessment if it offers its product or service on the EU market.
Under the Regulation's definition, a connected product is an item that generates or collects data about its use or environment and is able to transmit that data by means of an electronic communications service, a physical connection or on-device access. A related service is a digital service, including software, that is connected to the product in such a way that the product would be unable to perform one of its functions without it. This definition can cover a wide range of products, from industrial machinery to household appliances and from vehicle equipment to agricultural sensors.
Obligations for exporters of connected products
Design obligation. Connected products must be designed in such a way that users can access product and related service data by default, together with the metadata needed to interpret it, easily, securely, free of charge and in a machine-readable format. Under Article 50, this obligation applies to products placed on the market after 12 September 2026. New models that go to the EU after that date must therefore meet this requirement at the design stage.
Pre-sale information. Before the contract is concluded, the seller, lessor or manufacturer must clearly state the type, format and estimated volume of the data the product can generate, whether the data is generated continuously and in real time, where it is stored, and how the user will access it.
Access and sharing with third parties. Where the data cannot be accessed directly, the data holder must provide the readily available data to the user on request, without undue delay and free of charge; and when the user or a party acting on the user's behalf asks, the same data must also be passed on to a third party. The Regulation separately provides for measures to protect trade secrets and, in exceptional cases, the possibility of a reasoned refusal.
Limits on your own use. The data holder may use readily available non-personal data only on the basis of a contract with the user, and may not draw inferences from that data about the user's economic situation or production methods that would weaken the user's commercial position.
Small-business exemption. The obligations in this section do not apply to connected products made by micro and small enterprises; however, this requires that the enterprise have no partner or linked enterprise that exceeds this size and that it not carry out contract manufacturing on behalf of others. For a small Turkish supplier that manufactures under contract for a large brand, the exemption is therefore not automatic.
Business-to-business contracts. Data access and use terms that one business unilaterally imposes on another and that deviate grossly from good commercial practice are not binding. These rules apply to contracts concluded after 12 September 2025; for earlier open-ended or long-term contracts, the date of application is 12 September 2027.
For cloud users and cloud service providers
Chapter VI of the Regulation aims to remove the commercial, technical and contractual obstacles that prevent a customer from switching to a service of the same type, to another provider or to its own infrastructure. Under Article 25, the contract must contain at least the following:
- A notice period of at most two months for initiating the switch.
- A switching period of at most 30 calendar days after the notice period; if this is not technically feasible, the provider can notify the customer of its reasons within 14 working days and propose an alternative period of up to seven months.
- A full list of the data and digital assets that can be transferred, a data retrieval period of at least 30 days and, after that, a guarantee of complete deletion.
On charges, Article 29 sets out a phased timetable: until 12 January 2027, providers may charge only a reduced fee that does not exceed the costs directly linked to the switch; after that date, no switching charge may be levied. Providers must also publish on their websites the jurisdiction to which their infrastructure is subject and the measures they take against access by foreign public authorities.
Because these rights are defined for customers in the EU, whether the cloud contract of a company in Türkiye falls within this scope must be assessed separately, depending on the contracting party and where the service is provided. Groups with affiliates in the EU and Turkish software companies that offer SaaS or hosting services to customers in the EU, on the other hand, may fall directly within the scope of this section. For services that are custom-built for a customer and not offered on a broad scale, some technical obligations and the charging rule do not apply. For the general framework of cloud migration, you can refer to our article on where to start with a cloud migration.
Enforcement and the amendment agenda
Penalties are set by the Member States; for infringements of certain parts, such as those on connected product data, data protection authorities can impose administrative fines up to the top penalty tier of the General Data Protection Regulation (GDPR).
In the Digital Omnibus package it presented in November 2025, the Commission proposed targeted exemptions in the cloud switching rules for SMEs, small mid-cap companies and custom-built services. However, this is only a proposal; as of 5 October 2026, the EUR-Lex record shows no act amending the Regulation, only corrigenda. Planning should be based on the current text, and the amendment process should be monitored separately.
Checklist
The steps below are a general framework derived from the text of the Regulation; they should be adapted to your product and contract structure through legal assessment.
- Product inventory: List which products sold to the EU generate and can transmit data, and which apps or software could count as a "related service."
- Date separation: Flag separately the models placed on the market after 12 September 2026; the design obligation applies to them.
- Data map: For each product, document what data is generated, where it is stored, in what format it can be exported and whether the metadata is sufficient.
- Pre-sale information text: Check that the information in Article 3 appears in full in the user manual, the contract and on web pages.
- Request process: Define who will handle data access requests from users or third parties, through which channel and within what time frame; identify in advance any data that contains trade secrets.
- Size and contract-manufacturing check: If you rely on the small-business exemption, document the conditions regarding partnerships, linked enterprises and contract manufacturing.
- Contract review: Review the data access and liability clauses in your contracts with EU business partners in light of the unfair-terms rules.
- Cloud contracts: Clarify with your provider the clauses on the notice period, switching period, data list, retrieval and deletion, as well as the position on switching charges after 12 January 2027.
- Personal data: If the product data contains personal data, assess the precedence of the GDPR together with the obligations under KVKK (Türkiye's data-protection law).
Conclusion
For Turkish companies that offer connected products or cloud services to the EU market, the Data Act is not only a legal matter; it is a digitalization issue that concerns product design, data infrastructure and contract management together. If the inventory and the data map are produced today, the legal assessment and adaptation to possible amendments will proceed much more easily. For another dimension of the EU regulatory timeline, you can also look at the new timeline under the EU AI Act.
Why logistics experience matters here. For a manufacturer shipping connected products to the EU, the first two checklist steps (the product inventory and the date separation) are largely a traceability exercise: which models and serial numbers went to which customers, and when. Shipment, delivery and stock records often already hold much of that information, and the request process in step 5 can borrow from order handling: a single intake point, a named owner, a deadline and proof of completion. One of our consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains through KPI-driven programs. He has also managed nationwide warehouse and transport operations and large-scale distribution networks. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering