Your product does more than work: it measures. And it does more than measure: it communicates, for example with an app, the cloud or a platform. This is precisely the kind of product many businesses now earn revenue from, and the kind addressed by the EU Data Act. The Netherlands Authority for Consumers and Markets (ACM) has now published provisional guidance explaining what businesses offering connected products or related services must do.
At its core, the Data Act is a data-sharing framework. It determines who has access to which data, on what terms and for which purposes. This affects more than the party generating data in an Internet of Things (IoT) device. Depending on the chapter, data holders, data recipients—third parties—and sometimes public authorities may have obligations. Users primarily gain rights: access and the right to have data forwarded.
What are smart products under the Data Act?
The ACM expressly identifies these in its guidance: devices that generate or collect data and can exchange those data, known as connected products or smart devices.
The rules do not concern hardware alone. The Data Act also covers related services: digital services connected with the product that can influence its functionality, behaviour or operation, such as an app controlling a smart thermostat.
As a rule of thumb for businesses, if your product produces data and is connected, it will often fall within scope. If your app or cloud service can control its operation, you may also fall within scope as the provider of a related service.
Who must do what: user, data holder and data recipient?
Under the Data Act, roles matter more than labels such as “manufacturer” or “platform”.
The user
The starting point for the user, which can also be a legal entity, is control over data collected through use of the connected product. The user may request access and may also request transmission to a third party.
The data holder
The data holder is the party entitled or obliged, often under a contract, to use or make data available. This is often the manufacturer or related-service provider, but other arrangements are possible: the role can be transferred contractually, and several data holders may exist.
The data recipient: a third party
A third party receiving data must observe clear usage limits. The ACM notes, for example, that the recipient may not pass data to Digital Markets Act gatekeepers, use them in ways adversely affecting safety, or disregard agreed measures protecting trade secrets.
What exactly must you do when placing smart products on the market?
Before the contract: inform the customer before signing
The Data Act imposes a transparency obligation: before concluding an agreement to buy, rent or lease the product, or receive a related service, the user must receive information about data access and use. For connected products, that obligation falls on the seller, rental provider or lessor.
This includes the type of data generated, format and estimated volume, including continuous or real-time generation; where and for how long the product stores data; and how the user can access, request or erase them. The information should be clear and comprehensible and supplied again if it changes.
Transmission to third parties: “send my data to party X”
The user can ask the data holder to give a third party access. That option exists regardless of whether the user has direct or indirect access themselves. For third-party access, the data holder must agree terms, and potentially compensation, with that third party.
What should you arrange now?
If you offer connected products or related services, approach this as integrating a new right into your product and contractual chain:
1) Determine scope: is this a connected product or related service? Check two-way app or cloud interaction.
2) Allocate roles: who is the data holder, and are there several?
3) Prepare pre-contract information: data type, format and volume, storage and retention periods, and access method.
4) Build access: direct access where appropriate, particularly looking towards 2026, or otherwise immediate access on request with proportionate verification.
5) Make third-party sharing workable: terms, a fair, reasonable and non-discriminatory (FRAND) framework, and an operational process.
6) Prepare safeguards: substantiated trade secret and security measures, with a notification route.