EdLaw
Data Act (Regulation (EU) 2023/2854)
The EU's connected-device data-access law, published in the Official Journal on 22 December 2023 (OJ L, 2023/2854), in force since 11 January 2024 and applying since 12 September 2025 (Art. 50). It gives users of connected products rights over the data those products generate: the data must be accessible ("accessible by design" for products placed on the market after 12 September 2026, Art. 3(1) via Art. 50), the user can access and use it (Art. 4), and the user can require it to be shared with a third party (Art. 5).
Applicability to EdTech
- A headset is very likely a "connected product": "an item that obtains, generates or collects data concerning its use or environment and that is able to communicate product data" (Art. 2(5)); the cloud service operating it is a candidate "related service" (Art. 2(6)). That makes the manufacturer/provider a data holder for "readily available" product and related-service data.
- The user holding the rights is the school (or whoever bought/leases the device) — usage telemetry, sensor data and related-service data are things the customer can demand, in a comprehensive, structured, machine-readable format, and can have ported to a competitor or integrator (Arts. 4–5).
- Pre-contractual information duties (Art. 3(2)–(3)): before purchase/rent/lease, the customer must be told what data the product generates, how to access it, whether the seller intends to use it, and more — a sales-collateral obligation, not just an engineering one.
- Timing: rights exercisable since 12 September 2025; access-by-design binds products placed on the market after 12 September 2026 (Art. 50).
Contents
| Document | Covers |
|---|---|
| SCOPE-AND-DEFINITIONS.md | Arts. 1–2 — subject matter, scope, definitions |
| DATA-ACCESS-RIGHTS.md | Arts. 3–5 — access by design, user access, sharing with third parties |
| APPLICATION.md | Art. 50 — entry into force and application dates |
Scope note: compensation and dispute settlement (Arts. 8–12), B2G access (Chapter V), cloud-switching (Chapter VI), interoperability (Chapter VIII), penalties (Art. 40) and enforcement can be added with the same tooling when needed. A Commission "Digital Omnibus" proposal to amend the Data Act was pending at last check — re-verify amendment status on rebuild.
Key obligations at a glance
- Design and manufacture so that product/related-service data is "directly accessible to the user" where relevant and technically feasible (Art. 3(1)) — for post-12 Sep 2026 products.
- Provide pre-contractual data information (Art. 3(2)–(3)).
- Make readily available data accessible to the user without undue delay, free of charge, and continuously and in real-time where relevant (Art. 4(1)).
- Share with a user-designated third party on request (Art. 5(1)); trade secrets are protected through agreed measures, not blanket refusal (Art. 4(6) and Art. 5(9)).
Enforcement
National competent authorities and penalties (Arts. 37, 40 — not extracted); GDPR authorities police the interplay for personal data. Data-holder duties are also privately enforceable through the user rights themselves.
Licence
The corpus reproduces the Official Journal text of Regulation (EU) 2023/2854 (CELEX 32023R2854) from EUR-Lex.
The EUR-Lex legal notice (eur-lex.europa.eu/content/legal-notice/legal-notice.html, read 2026-10-01 in the Internet Archive copy captured that day, because EUR-Lex refuses non-browser clients) says: "© European Union, 1998-2026 The Commission’s document reuse policy is based on Decision 2011/833/EU. Unless otherwise specified, you can re-use the legal documents published in EUR-Lex for commercial or non-commercial purposes." For consolidated texts it adds: "The copyright for the editorial content of this website, the summaries of EU legislation and the consolidated texts, which is owned by the EU, is licensed under the Creative Commons Attribution 4.0 International licence. This means that you can re-use the content provided you acknowledge the source and indicate any changes you have made."
Commission Decision 2011/833/EU on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39, read in the Publications Office Cellar copy on 2026-10-01) provides in Article 4 that "All documents shall be available for reuse: (a) for commercial or non-commercial purposes under the conditions laid down in Article 6", and Article 6(2) lists the conditions that may be attached: "(a) the obligation for the reuser to acknowledge the source of the documents; (b) the obligation not to distort the original meaning or message of the documents; (c) the non-liability of the Commission for any consequence stemming from the reuse."
Conditions, and how this corpus meets them:
- Acknowledge the source: each extracted provision carries a
{.meta}provenance line naming EUR-Lex and the CELEX number, and Sources links the EUR-Lex text. - Indicate changes: the provision text is unchanged; the changes are the selection of provisions, the Markdown layout and the added anchors, all described in Meta.
- Do not distort the meaning: the text is reproduced verbatim and checked mechanically against the source (see Meta).
- No endorsement or liability: the corpus does not claim that the EU or the Publications Office endorses it, and only the Official Journal text is authentic.
The Commission policy page listed in Sources is cited, not reproduced.
Related
- EU GDPR — the Data Act is without prejudice to it; much headset telemetry about identifiable pupils is personal data, so both regimes apply
- Product-safety cluster — the same devices' market-access rules