Data Act: When Cloud Switching Becomes Mandatory - What Companies Now Need to Know

The EU’s Data Act brings extensive changes for cloud providers, their customers, and partners. Starting in September 2025, providers will be required to facilitate and actively support switching between cloud services. However, the implementation poses challenges and raises questions about its practical applicability.

Based on the Internet of Things (IoT), vast amounts of data are being generated. The EU has adopted legislation to regulate who is allowed to use the data, in what way, and with whom they must share it. To this end, the EU Commission adopted the Data Act in November 2023, which came into force on 11 January 2024. From 12 September 2025 onwards, the first rules established under regulation will become applicable. The Data Act regulates the sharing of data that is generated by and during the use of connected devices (e.g. household appliances, machines, vehicles).

The regulation also applies to hosting and cloud providers whose infrastructures or systems process this data – but not only that. The rules for cloud providers are not limited to IoT but apply generally to cloud services. The legislative text generically refers to “data processing services.” In Recital 81 of the Data Act, these services are specified as the cloud models, named as Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a -Service (SaaS). There is no doubt that the Data Act, which regulates the process of switching between providers – known as “Cloud Switching” – and sets interoperability requirements, will have far-reaching consequences for cloud providers.

Cloud Switching requirements and provider obligations

The Data Act, together with other EU regulations such as the Digital Markets Act, the Digital Services Act, or the AI Act, is one of the components of a comprehensive data economy law that regulates the handling of data within the Union and access to it. The aim of this legislation is to create a single market for data, ensuring Europe’s global competitiveness and data sovereignty. Overall, the goal is to make more data available for use in the economy and society, while ensuring that companies and individuals who generate the data retain control.

The Data Act stipulates that only users of connected devices should decide how to handle the data they have helped to create – how this data is processed and whether it is shared with third parties. Furthermore, the regulation aims to ensure fair conditions for the data exchange between businesses (B2B), between businesses and consumers (B2C) and between businesses and authorities (B2G). Not least, it should become easier for users to migrate their data from one processing service to another or back to their own systems.

With the provisions on “Cloud Switching,” new obligations will arise for cloud providers. These obligations are listed in Chapter VI of the Data Act, titled “Switching Between Data Processing Services.” Articles 23 to 31 regulate the contractual terms, notification requirements, technical implementation, and costs involved with such a switch.

Challenges in implementing the Data Act: What providers need to know

For cloud providers, this means that they not only have to remove all commercial, technical, contractual, and organizational obstacles to customer data migration; they must also actively support their customers in the switching process, ensuring that no data is lost, and functionality is not impaired. In addition, the legislation is gradually reducing the migration costs. From 12 January 2027, providers will no longer be allowed to charge any switching fees.

“In the future, cloud providers will have the obligation to enable their customers to switch, assist them in the process, and ensure that their business operations continue without interruption and with a high level of security during the switching phase. They can also ultimately use the service with a third-party provider or on their own systems with equivalent functionality,” summarizes Dr. Eckhardt. In addition to the technical and organizational measures that need to be taken to achieve this, providers must also implement the new rules in their contracts. This applies not only to new contracts concluded from 12 September 2025, but also to all contracts that are still in effect at that time.

“It can be said that the legislation has taken the regulation on number portability from the telecommunications sector as a model for Cloud Switching,” the specialist lawyer continues. This also shows the EU’s determination to implement the Data Act. After all, number portability was also implemented a decade and a half ago, despite industry objections regarding technical feasibility.

Impact on the cloud service ecosystem

For providers who have not yet taken any steps with regard to the Cloud Act, it could become challenging in individual cases to fulfill the obligations in time. “Changing the technology, adjusting the pricing model, changing the contracts – doing all of that in the remaining time is ambitious,” emphasizes Dr. Eckhardt. “That’s why we at EuroCloud Deutschland have been working intensively since mid-2024 on the Data Act and particularly with the articles on Cloud Switching.”

The Cloud Act is not only relevant for cloud providers themselves but also for their sales and service partners. For example, cloud-native service providers who resell a provider’s services and provide related integration or configuration services can be held accountable by their customers if a switch is pursued. “Insofar as they are at the forefront with customers, cloud natives may appear as providers of data processing services,” the expert explains. There is a risk that “they could end up in an uncomfortable ‘sandwich position’ if the cloud provider supplying the service has not adequately implemented the provisions of the Data Act.”

What makes the implementation of the EU regulation challenging for all parties involved is the “poorly crafted nature of the law,” as Dr. Eckhardt clearly criticizes. The rules on Cloud Switching in the Data Act are not only extensive and sometimes complex, but some of the provisions are also “internally inconsistent, which requires a careful interpretation of the legislative text.”

Time is pressing. Cloud providers and their partners must thoroughly examine the requirements of the Data Act to be able to act in time. The complexity and partly inconsistent regulations require careful analysis and close collaboration within the industry. Only in this way can a smooth transition be guaranteed and a patchwork of implementation be avoided.

As Manager of EuroCloud Deutschland, Michael Hase is responsible for coordination and further development of cloud topics at eco. He joined the association in November 2023. Prior to that, he worked for more than 20 years as an IT journalist and wrote for industry magazines such as IT-Business and CRN. His focus was on the ecosystems within the IT market.