Data Act: the Commission's model contract terms and cloud contract clauses
Recommendation (EU) 2026/2394 gives non-binding model terms for data sharing and clauses for cloud contracts, ahead of free switching on 12 January 2027.
The European Commission adopted Recommendation (EU) 2026/2394 on 29 October 2026, and it was published in the Official Journal on 6 November 2026. It contains the model contractual terms for data access and use and the standard contractual clauses for cloud contracts that Article 41 of the Data Act asked the Commission to develop.
What is in it
Both sets are non-binding: parties may use, adapt or ignore them. They were written mainly for contracts between businesses, with SMEs as the primary audience, and dispute settlement bodies under the Data Act should take them into account.
Four sets of model terms for data from connected products and related services:
- between a data holder and the user of a connected product;
- between a user and a third party the user wants to share data with;
- between a data holder and a data recipient, when the data holder must make data available at the user's request;
- for voluntary data sharing between businesses.
Standard clauses for data processing services, for IaaS, PaaS and SaaS alike: switching and exit, termination, security and business continuity during switching, non-dispersion of contract documents, liability, non-amendment, and shared definitions. They do not cover the GDPR: a data processing agreement is still needed alongside them.
The date that matters: 12 January 2027
The switching clauses repeat the rule of Article 29: until 12 January 2027 a provider may charge for switching only at cost, and after that date it may not charge for switching at all. Where a customer uses several services in parallel, providers may still pass on data egress costs (Article 34).
More on the Data Act's dates: Data Act: new duties for connected products, free cloud switching next.
What to do now
Put the clauses next to your current contracts: as a customer, check exit, termination and switching fees; as a provider of a SaaS or cloud service, check that your terms already match them before January. Dazr Compliance keeps every supplier in a vendor register with review and contract dates and reminders 30 days and 7 days ahead, and links them to your GDPR records of processing.
Sources
- Commission Recommendation (EU) 2026/2394 of 29 October 2026
- Regulation (EU) 2023/2854 (Data Act), Articles 29, 34 and 41
For information only, not legal advice. Last updated 7 November 2026.
Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål