EU Data Act (part 1): Cloud control

Most of the EU Data Act (the Act) came into force on 12 September 2025. If you provide cloud services to customers in the EU, this means you will need to get to grips with new obligations to make it easier for your customers to switch to another provider. For part two of this EU Data Act series, which looks at the drive to make data more accessible to the users of connected products and related services, click here.

Switching rights

Providers of cloud services (referred to in the Act as “data processing services”) are now required to include a clause in their contracts that allows customers to terminate in order to:

• Move provider.
• Move to on-premises IT infrastructure.

The Act refers to both of these things as ”switching”.

The definition of “data processing services” providers was left broad by the EU, meaning that most SaaS, IaaS, and PaaS providers to EU customers will be impacted by the Act.

When terminating their contract for the purpose of switching, customers cannot be required to give more than two months’ notice. Switching should then generally be completed by the end of a 30-day transition period. This means that the switching process can be as fast as three months.

Impact on cloud services providers

The obligations imposed on such providers are significant and include: 

• As already mentioned, a requirement to implement contract terms that provide customers with a right to terminate on two months’ notice when switching.
• A requirement to remove obstacles which inhibit customers from switching (whether those obstacles be technical, pre-commercial, commercial, contractual or, organisational).
• Ensuring service continuity during the switching process.

One particular concern for providers is that when customers exercise their termination rights, they may be entitled to a refund on the unused portion of any prepaid term. This would be a particular concern for providers that operate on the basis of fixed terms and prepaid subscriptions. Not only that, from 12 January 2027, most cloud services providers will no longer be permitted to impose switching charges (some services that are custom built will be exempt).

To mitigate against the risk of refunds and safeguard their revenue, providers can charge early termination penalties, provided those penalties are “proportionate”. The contract with the customer should clearly explain what those penalties are and explain the basis on which they are calculated to demonstrate that they are proportionate. Imposing penalties that are opaque, or that customers perceive as disproportionate may lead to disputes.

Looking ahead – how providers can adapt?

In light of these changes, it is crucial for providers of data processing services to adapt their current practices to be legally compliant with the Act and to protect their recurring revenue.

On a practical level, this could mean:

1. Reviewing contract terms to ensure they cover what the Act requires them to cover in relation to switching.
2. Reviewing fixed term business models and consider whether they need to be adapted to remain commercially viable.
3. Responding to new obligations to facilitate customer switching.

The European Commission has published voluntary, but recommended standard contractual clauses, which – despite the fact that they are not officially finalised at the time of writing – are the best place to start when updating your contracts.

How can we help?

Although Mills & Reeve is a UK law firm, we take an active interest in laws beyond our borders where they affect our clients. Our information technology and data lawyers can advise:

• Cloud services providers on how to comply with their new obligations to facilitate customer switching (including on contractual terms and conditions).
• Cloud services customers on their switching rights.