Cloud and SaaS switching under the Data Act

Anyone wanting to switch their cloud or software provider knows the hurdles: long notice periods, data available only in a proprietary format, fees for export. Since 12 September 2025, Chapter VI of the Data Act (Regulation (EU) 2023/2854) has governed what providers of data processing services – infrastructure, platform and software, i.e. IaaS, PaaS and SaaS – must enable when a customer switches and what they may charge for it. A customer is any business that uses such a service under a contract.

What the provider must enable

The provider must not impose contractual, technical or organisational obstacles to termination, to concluding a contract with a new provider or to porting data (Art 23 Data Act). The customer's rights belong in a written contract that the customer can store before signing (Art 25 Abs 1 Data Act). Minimum content under Art 25 Abs 2 Data Act:

• A notice period for initiating the switch of no more than two months (lit d).
• A transitional period of no more than 30 calendar days thereafter, during which the provider supports the switch and keeps the service running (lit a); only where technical unfeasibility is substantiated, up to seven months (Abs 4).
• An exhaustive specification of all data and digital assets that can be ported, including at a minimum all exportable data (lit e); exemptions on grounds of trade secrets must likewise be listed exhaustively (lit f).
• A retrieval period of at least 30 calendar days after the transition (lit g), followed by full erasure (lit h).
• The obligation to support the customer's exit strategy with all relevant information (lit b).

Exportable data are the input and output data, including metadata, generated through use of the service; digital assets are, for example, applications in which the customer holds a right of use (Art 2 Nr 32 and 38 Data Act). As long as no common interoperability specifications have been published, exportable data must be handed over on request in a structured, commonly used and machine-readable format (Art 30 Abs 5 Data Act); SaaS and PaaS providers must also make open interfaces available free of charge (Abs 2). Functional equivalence – the service essentially continuing to run the same way with the new provider – is owed only by an infrastructure provider (Art 30 Abs 1 Data Act, recital 86). Anyone switching industry software therefore obtains their data from the old provider, not the same functions with the new one.

What the provider may charge for it

Switching charges are all charges for the switching actions required by the regulation, including charges for data egress (Art 2 Nr 35 and 36 Data Act). Art 29 Data Act withdraws them in two steps:

• Until 12 January 2027, only reduced switching charges are permitted, capped at the costs incurred by the provider that are directly linked to the switch (Abs 2 and 3).
• From 12 January 2027, no charges may be imposed for the switching process (Abs 1).

The date 12 September 2027, which is sometimes cited, does not concern the charges but the application of Chapter IV to pre-existing contracts (see below). Standard service fees until the end of the contract and proportionate early termination penalties under a fixed-term contract remain unaffected; additional services ordered by the customer may be charged by the provider at the price agreed in advance (recital 89).

Exceptions

For services most of whose main features have been built for an individual customer and which are not offered via the general service catalogue, the rules on charges and on functional equivalence do not apply (Art 31 Abs 1 Data Act); time-limited test versions are exempt from Chapter VI altogether (Abs 2). The provider must disclose both before the contract is concluded (Abs 3).

Pre-existing contracts, authority, GDPR

Art 50 Data Act contains no transitional rule for Chapter VI; the switching obligations have applied since 12 September 2025 to contracts concluded earlier as well. Chapter IV, with its prohibition of unfair terms on data access and data use between businesses (Art 13 Data Act), is different: it applies to contracts concluded from 12 September 2025, and only from 12 September 2027 to older contracts of indefinite or long duration. Under it, unilaterally imposed terms that prevent the customer from obtaining a copy of their data after termination are not binding (Art 13 Abs 5 lit e Data Act).

The competent authorities and the penalties are determined by the Member States (Art 37 and 40 Data Act). Austria has not yet done so: a motion for a resolution in the National Council of 20 May 2026 (886/A(E) XXVIII. GP) calls on the federal government to act; no implementing act can be found in the Legal Information System (RIS) as of October 2026. The provider's obligations nevertheless apply directly, and in a dispute over the contract the customer can rely on them in court.

Where the provider processes personal data on the customer's behalf, the GDPR continues to apply alongside: after the end of the service, the provider must delete or return the data at the choice of the controller (Art 28 Abs 3 lit g DSGVO). The Data Act adds deadlines, formats and the specification of exportable data.

What you can do now

• Check your existing contract against Art 25: notice period, transitional and retrieval periods, erasure commitment, specification of exportable data, export format, charges. If something is missing, the obligation still binds the provider.
• Record an exit plan: which data are exported in which format, who is responsible for the import. The provider owes the information on procedures and formats (Art 26 Data Act).
• Calculate deadlines and costs: two months' notice, up to 30 days' transition, at least 30 days' retrieval – realistically a switch takes three to four months. Switching charges are limited to cost until 12 January 2027 and fall away entirely afterwards.
• New contracts: minimum terms and early termination penalties remain permissible – that is where the provider's room for manoeuvre lies. Term, automatic renewal and notice period must fit together.

For software companies that offer services themselves

Anyone offering SaaS or hosting is a provider within the meaning of the regulation. Contracts and standard terms and conditions need the minimum clauses of Art 25; the website needs information on switching procedures and formats (Art 26) as well as on the jurisdiction of the infrastructure and on protection against governmental access from third countries (Art 28). From 12 January 2027, the price list may no longer contain switching charges.

This information is general in nature and does not replace advice on an individual case.