Data Act: switching cloud provider is a right, not a negotiation

Yes, in two capacities. As a customer of cloud services you have the rights of Chapter VI (switching between providers, pre-contractual information, switching charges) whatever your size and the provider’s. As a user of connected products, machines, vehicles, sensors and devices, you have the right to access the data they generate and to share it with third parties of your choice. The data-sharing obligations of Chapter II, instead, do not fall on micro and small enterprises that manufacture connected products, unless they are linked to larger enterprises.

Since 12 September 2025 the provider may only charge the costs directly linked to the switch; from 12 January 2027 no switching charges at all (Article 29). The contract must provide a maximum notice period of two months to start switching, a 30-day transitional period, which the customer has the right to extend once (Article 25(5)); where switching within 30 days is technically unfeasible, the provider gives reasons and indicates an alternative period of up to seven months (Article 25(4)); and a period of at least 30 days after switching to retrieve the data (Article 25). Note that early-termination penalties under a minimum-term contract are a different matter and remain governed by the contract.

All exportable data, that is the data you uploaded and the data generated by using the service, in a structured, commonly used and machine-readable format, with reasonable assistance during the switch. The contract must exhaustively list the categories of data and digital assets that can be ported, the formats must be published in an online register and, once the switch is complete, the provider must erase your data. For infrastructure services (IaaS) the provider must take all reasonable measures in its power so that the customer achieves functional equivalence in the new environment (Article 30(1)).

That every provider of data processing services must publish on its website the jurisdiction to which the infrastructure used to deliver the services is subject and the measures adopted to prevent international governmental access to non-personal data held in the Union, where that would conflict with Union or Member State law. AtWorkStudio does so on the page Jurisdiction and governmental access to data, referred to in its contracts.

Yes: they are data processing services in every respect. The right exists on paper; exercising it requires an inventory of what lives where, export in the right formats and a verified migration. That is the part we do.

Chapter II covers connected products and related services: whoever uses a machine, a vehicle or a plant that generates data has the right to access it and to share it with a third party, for example an independent maintenance provider. Products placed on the market after 12 September 2026 must be designed so that the data is accessible by default. For a manufacturing SME it is often the first concrete contact with the regulation.

In three ways. The three catalogue services qualified by the Italian National Cybersecurity Agency (ACN) follow the switching rules of Chapter VI in full; the exit terms are defined in the contracts. Every other service is custom-built for the individual customer and falls under Article 31: we tell you before you sign, with the exit terms written in the contract. The jurisdiction of the infrastructure and the measures against governmental access are on the Jurisdiction page. We do not give legal advice: your lawyer reads the contract, we tell you what is technically true.