Overview

• Most core provisions began applying across the EU on September 12, 2025, with extraterritorial reach for providers offering services to EU customers.
• Cloud and other data processing service providers must remove contractual and technical obstacles to switching, include exit clauses enabling migration within a 30‑day transitional period, and disclose switching procedures and limits.
• Switching charges are generally banned from January 12, 2027, and until then may not exceed the provider’s direct costs, while early termination penalties can still apply.
• Users gain rights to data generated by connected products in structured, machine‑readable formats at no charge to the user, with data holders allowed only cost‑based compensation when sending data to third parties designated by the user.
• Member States will designate enforcers and set penalties that may vary, with GDPR‑level fines where personal data is implicated, plus safeguards for non‑EU government access requests and emergency access rights for public authorities.