Turkish hardware and IoT companies have spent two years asking whether the EU Data Act applies to them. It does, and the question has become urgent: Regulation (EU) 2023/2854 has applied since 12 September 2025, and from 12 September 2026 every connected product and related service placed on the EU market must be designed so that its data is accessible to the user by default. The Regulation is not a data-protection law; it is a data-access and contract-fairness law that sits on top of the GDPR and reaches manufacturers, data holders and cloud providers “irrespective of their place of establishment” when their products, data recipients or customers are in the Union. For a Turkish company that sells a connected device, a sensor-driven service or a SaaS platform into Europe, it changes product design, the terms of service, the compensation model for data and, for anyone offering cloud or edge services, the exit terms. This article explains who is caught, what the four operative chapters require, the dates that matter, and what to change in a Turkish company’s documents. It builds on our SaaS terms and data processing agreement guides.
Scope: products, data holders and cloud providers, wherever established
Article 1(3) lists the persons to whom the Regulation applies. The three that matter for a Turkish exporter are manufacturers of connected products placed on the market in the Union and providers of related services, irrespective of their place of establishment (point (a)); data holders, irrespective of their place of establishment, that make data available to data recipients in the Union (point (c)); and providers of data processing services, irrespective of their place of establishment, providing such services to customers in the Union (point (f)). A “connected product” under Article 2(5) is an item that obtains, generates or collects data concerning its use or environment and can communicate product data through an electronic communications service, physical connection or on-device access, and whose primary function is not storing, processing or transmitting data for others; a “related service” is a digital service, including software, connected with the product at purchase in a way without which the product would not perform a function, or later connected by the manufacturer or a third party to add or adapt functions. Smart meters, industrial sensors, connected vehicles and machines, wearables, agricultural equipment and the apps and platforms that operate them are inside; a laptop or a general-purpose server is not. Chapter II covers data on the performance, use and environment of the product and service, excluding content. Article 7(1) exempts data generated by products or services of a microenterprise or small enterprise, unless it has a partner or linked enterprise that is not one, or is subcontracted to manufacture or design a connected product or to provide a related service; many Turkish suppliers to European OEMs lose the exemption through that last limb.
Chapter II: access by design and the user’s rights
Article 3(1) requires connected products and related services to be designed and provided so that product and related-service data, with the metadata needed to interpret them, are by default easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible to the user. Article 50 makes this design obligation apply to products and services placed on the market after 12 September 2026, which is why hardware roadmaps for the EU need a data-access feature now. Article 3(2) adds pre-contract disclosure: before the sale, rent or lease the seller must tell the user, among other things, the type, format and estimated volume of data the product can generate, whether it generates data continuously and in real time, how the user can access and erase it, and the identity of the data holder. Article 4 gives the user the right to access readily available data on request, without undue delay, free of charge, and Article 4(13) reverses the default the industry has lived by: the data holder may use readily available non-personal data only on the basis of a contract with the user, and may not use it to derive insights about the user’s economic situation, assets or production methods in a way that undermines the user’s commercial position. Article 5 lets the user direct the data to a third party of its choice, on the same quality and terms, with the third party bound by Article 6 to use it only for the agreed purpose and to erase it afterwards; designated gatekeepers under the Digital Markets Act may not be eligible third parties.
Chapters III and IV: FRAND terms, compensation and unfair clauses
Where a data holder must make data available to a business recipient, Article 8 requires fair, reasonable and non-discriminatory terms and a transparent process, and Article 9 allows compensation that is non-discriminatory and reasonable and may include a margin, taking into account the costs of making data available and the investment in collecting it; where the recipient is an SME or a not-for-profit research organisation without larger partner or linked enterprises, compensation may not exceed the costs of making the data available. Chapter IV applies to all business-to-business contracts about data access and use. Article 13 renders non-binding a contractual term on data access and use, or on liability and remedies for breach of data obligations, that one enterprise unilaterally imposes on another if it is unfair, and lists terms that are always unfair (excluding or limiting liability for intentional acts or gross negligence, excluding remedies for non-performance, granting the imposing party the exclusive right to determine conformity) and terms presumed unfair (inappropriate limits on remedies, unilateral access to the other party’s data used to its detriment, preventing the other party from using its own data, and others). Turkish companies that supply European customers under their own standard terms are the “imposing” party; those that buy platforms from European vendors are protected by the same rules. Article 50 applies Chapter IV to contracts concluded after 12 September 2025, and from 12 September 2027 to earlier contracts of indefinite duration or with at least ten years to run from 11 January 2024.
Chapter VI: switching cloud and edge services
Providers of data processing services, the Regulation’s term for cloud, edge and similar services, must under Article 23 remove pre-commercial, commercial, technical, contractual and organisational obstacles to a customer switching to another provider of the same service type, to on-premises infrastructure or to a multi-vendor set-up. Article 25 requires the customer’s rights and the provider’s obligations to be set out in a written contract made available before signature, containing at least: a clause allowing the customer to switch or to port all exportable data and digital assets within a mandatory maximum transitional period of thirty calendar days, starting after the notice period, during which the provider assists, maintains continuity and informs of risks; a maximum notice period for initiating the switch of no more than two months; an exhaustive specification of the data and digital assets that can be ported and of the data specific to the provider’s internal functioning that is excluded; and provisions on retrieval after the transitional period. Article 29 phases out switching charges: reduced charges limited to the provider’s directly linked costs were allowed from 11 January 2024, and from 12 January 2027 no switching charges may be imposed. Article 31 relieves custom-built services and non-production test versions of some of these obligations. Article 32 requires providers to take technical, organisational and legal measures against third-country governmental access to non-personal data held in the Union where that access would conflict with Union or Member State law, a clause Turkish providers with EU-hosted customers should mirror in their own contracts.
Enforcement and penalties
Each Member State designates one or more competent authorities under Article 37, with a data coordinator where there are several, and where personal data is concerned the GDPR supervisory authorities remain competent. Penalties are set nationally under Article 40 and must be effective, proportionate and dissuasive, taking into account the criteria the Regulation lists; for infringements of the obligations in Chapters II, III and V, the GDPR supervisory authorities may, within their competence, impose administrative fines up to the Article 83(5) GDPR ceiling (Article 40(4)). Article 37(11) requires any entity within the scope of the Regulation that makes connected products available or offers services in the Union without being established there to designate a legal representative in a Member State, in the same way as Article 27 of the GDPR, so a Turkish manufacturer selling connected products into the EU needs an EU representative for the Data Act even if it already has one for the GDPR.
What to change in a Turkish company’s documents
For a manufacturer or related-service provider: a data-access specification for each product placed on the EU market after 12 September 2026, a pre-contract data disclosure under Article 3(2) for the sales channel, a user-facing data-use contract under Article 4(13) replacing the assumption that machine data belongs to the vendor, and a third-party access procedure under Articles 5 and 6 with identity checks and purpose limits. For any B2B data supplier or buyer: a review of standard terms against the Article 13 lists, with the unilaterally imposed clauses on data use, liability and remedies rewritten. For a cloud, hosting or edge provider serving EU customers: switching and exit terms meeting Article 25, a migration cost schedule that reaches zero by 12 January 2027, a specification of exportable data and formats, and an Article 32 clause on third-country access requests. And for everyone, the KVKK and GDPR layers remain: personal data in product data still needs a legal basis under Article 6 of the GDPR, which Article 4(12) of the Data Act expressly preserves, and the cross-border transfer rules we discussed in personal data in model APIs apply to data flowing back to Türkiye.
We sell components to a German OEM that makes the connected product. Are we caught?
Usually as a data holder or related-service provider if you receive product data, and the Article 7 small-enterprise exemption is lost if you are subcontracted to manufacture or design a connected product or to provide a related service. Expect the OEM to pass the Article 3 design requirements down the supply chain in any case.
Our SaaS runs on a hyperscaler. Do the switching rules apply to us or to them?
To both. The hyperscaler owes you switching terms; you owe your EU customers the same under Article 25 for your own service. Custom-built services and test environments have partial relief under Article 31.
Is there a Turkish equivalent?
Not yet. Türkiye’s data-access rules are sectoral (open banking, e-commerce data under Law 6563, health data). The Medium-Term Programme’s alignment commitments point towards convergence, which we discussed in KVKK–GDPR alignment by 2027.
Related: EU Data Act · cross-border data transfer · sub-processor · SaaS terms of service.
Sources. Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act), OJ L, 22 December 2023, Articles 1–9, 13, 23, 25, 29, 31, 32, 37, 40, 50; European Commission, Data Act explanatory material and FAQ.
This article is provided for general information only and does not constitute legal advice. Please seek legal support for an assessment of any specific matter.
