Chapter VI - Switching between data processing services (Art. 23-31)

Art. 23 Data Act - Removing obstacles to effective switching arrow_right_alt

Providers of data processing services shall take the measures provided for in Articles 25, 26, 27, 29 and 30 to enable customers to switch to a data processing service, covering the same service type, which is provided by a different provider of data processing services, or to on-premises ICT infrastructure, or, where relevant, to use several providers of data processing services at the same time. In particular, providers of data processing services shall not impose and shall remove pre-commercial, commercial, technical, contractual and organisational obstacles, which inhibit customers from:

1. terminating, after the maximum notice period and the successful completion of the switching process, in accordance with Article 25, the contract of the data processing service;
2. concluding new contracts with a different provider of data processing services covering the same service type;
3. porting the customer’s exportable data and digital assets, to a different provider of data processing services or to an on-premises ICT infrastructure, including after having benefited from a free-tier offering;
4. in accordance with Article 24, achieving functional equivalence in the use of the new data processing service in the ICT environment of a different provider of data processing services covering the same service type;
5. unbundling, where technically feasible, data processing services referred to in Article 30(1) from other data processing services provided by the provider of data processing services.

78
79
93
94

Recital 78

The ability of customers of data processing services, including cloud and edge services, to switch from one data processing service to another while maintaining a minimum functionality of service and without downtime of services, or to use the services of several providers simultaneously without undue obstacles and data transfer costs, is a key condition for a more competitive market with lower entry barriers for new providers of data processing services, and for ensuring further resilience for the users of those services. Customers benefiting from free-tier offerings should also benefit from the provisions for switching that are laid down in this Regulation, so that those offerings do not result in a lock-in situation for customers.

Recital 79

Regulation (EU) 2018/1807 of the European Parliament and of the Council⁽¹⁾ encourages providers of data processing services to develop and effectively implement self-regulatory codes of conduct covering best practices for, inter alia, facilitating the switching of providers of data processing services and the porting of data. Given the limited uptake of the self-regulatory frameworks developed in response, and the general unavailability of open standards and interfaces, it is necessary to adopt a set of minimum regulatory obligations for providers of data processing services to eliminate pre-commercial, commercial, technical, contractual and organisational obstacles, which are not limited to reduced speed of data transfer at the customer’s exit, which hamper effective switching between data processing services.

^{(1) Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union (OJ L 303, 28.11.2018, p. 59).}

Recital 93

Providers of data processing services should also be required to remove existing obstacles and not impose new ones, including for customers wishing to switch to an on-premises ICT infrastructure. Obstacles can, inter alia, be of a pre-commercial, commercial, technical, contractual or organisational nature. Providers of data processing services should also be required to remove obstacles to unbundling a specific individual service from other data processing services provided under a contract and make the relevant service available for switching, in the absence of major and demonstrated technical obstacles that prevent such unbundling.

Recital 94

Throughout the switching process, a high level of security should be maintained. This means that the source provider of data processing services should extend the level of security to which it committed for the service to all technical arrangements for which such provider is responsible during the switching process, such as network connections or physical devices. Existing rights relating to the termination of contracts, including those introduced by Regulation (EU) 2016/679 and Directive (EU) 2019/770 of the European Parliament and of the Council⁽¹⁾ should not be affected. This Regulation should not be understood to prevent a provider of data processing services from providing to customers new and improved services, features and functionalities or from competing with other providers of data processing services on that basis.

^{(1) Directive (EU) 2019/770 of the European Parliament and of the Council of 20 May 2019 on certain aspects concerning contracts for the supply of digital content and digital services (OJ L 136, 22.5.2019, p. 1).}

Art. 24 Data Act - Scope of the technical obligations arrow_right_alt

Art. 25 Data Act - Contractual terms concerning switching arrow_right_alt

The rights of the customer and the obligations of the provider of data processing services in relation to switching between providers of such services or, where applicable, to an on-premises ICT infrastructure shall be clearly set out in a written contract. The provider of data processing services shall make that contract available to the customer prior to signing the contract in a way that allows the customer to store and reproduce the contract.
Without prejudice to Directive (EU) 2019/770, the contract referred to in paragraph 1 of this Article shall include at least the following:
1. clauses allowing the customer, upon request, to switch to a data processing service offered by a different provider of data processing services or to port all exportable data and digital assets to an on-premises ICT infrastructure, without undue delay and in any event not after the mandatory maximum transitional period of 30 calendar days, to be initiated after the maximum notice period referred to in point (d), during which the service contract remains applicable and during which the provider of data processing services shall:
  1. provide reasonable assistance to the customer and third parties authorised by the customer in the switching process;
  2. act with due care to maintain business continuity, and continue the provision of the functions or services under the contract;
  3. provide clear information concerning known risks to continuity in the provision of the functions or services on the part of the source provider of data processing services;
  4. ensure that a high level of security is maintained throughout the switching process, in particular the security of the data during their transfer and the continued security of the data during the retrieval period specified in point (g), in accordance with applicable Union or national law;
2. an obligation of the provider of data processing services to support the customer’s exit strategy relevant to the contracted services, including by providing all relevant information;
3. a clause specifying that the contract shall be considered to be terminated and the customer shall be notified of the termination, in one of the following cases:
  1. where applicable, upon the successful completion of the switching process;
  2. at the end of the maximum notice period referred to in paragraph (d), where the customer does not wish to switch but to erase its exportable data and digital assets upon service termination;
4. a maximum notice period for initiation of the switching process, which shall not exceed two months;
5. an exhaustive specification of all categories of data and digital assets that can be ported during the switching process, including, at a minimum, all exportable data;
6. an exhaustive specification of categories of data specific to the internal functioning of the provider’s data processing service that are to be exempted from the exportable data under point (e) of this paragraph where a risk of breach of trade secrets of the provider exists, provided that such exemptions do not impede or delay the switching process provided for in Article 23;
7. a minimum period for data retrieval of at least 30 calendar days, starting after the termination of the transitional period that was agreed between the customer and the provider of data processing services, in accordance with point (a) of this paragraph and paragraph 4;
8. a clause guaranteeing full erasure of all exportable data and digital assets generated directly by the customer, or relating to the customer directly, after the expiry of the retrieval period referred to in point (g) or after the expiry of an alternative agreed period at a date later than the date of expiry of the retrieval period referred to in point (g), provided that the switching process has been completed successfully;
9. switching charges, that may be imposed by providers of data processing services in accordance with Article 29.
The contract referred to in paragraph 1 shall include clauses providing that the customer may notify the provider of data processing services of its decision to perform one or more of the following actions upon termination of the maximum notice period referred to in paragraph 2, point (d):
1. switch to a different provider of data processing services, in which case the customer shall provide the necessary details of that provider;
2. switch to an on-premises ICT infrastructure;
3. erase its exportable data and digital assets.
Where the mandatory maximum transitional period as provided for in paragraph 2, point (a) is technically unfeasible, the provider of data processing services shall notify the customer within 14 working days of the making of the switching request, and shall duly justify the technical unfeasibility and indicate an alternative transitional period, which shall not exceed seven months. In accordance with paragraph 1, service continuity shall be ensured throughout the alternative transitional period.
Without prejudice to paragraph 4, the contract referred to in paragraph 1 shall include clauses providing the customer with the right to extend the transitional period once for a period that the customer considers more appropriate for its own purposes.

82
85
87
96

Recital 82

Undermining the extraction of the exportable data that belongs to the customer from the source provider of data processing services can impede the restoration of the service functionalities in the infrastructure of the destination provider of data processing services. In order to facilitate the customer’s exit strategy, avoid unnecessary and burdensome tasks and to ensure that the customer does not lose any of their data as a consequence of the switching process, the source provider of data processing services should inform the customer in advance of the scope of the data that can be exported once that customer decides to switch to a different service provided by a different provider of data processing services or to move to an on-premises ICT infrastructure. The scope of exportable data should include, at a minimum, input and output data, including metadata, directly or indirectly generated, or cogenerated, by the customer’s use of the data processing service, excluding any assets or data of the provider of data processing services or a third party. The exportable data should exclude any assets or data of the provider of data processing services or of the third party that are protected by intellectual property rights or constituting trade secrets of that provider or of that third party, or data related to the integrity and security of the service, the export of which will expose the providers of data processing services to cybersecurity vulnerabilities. Those exemptions should not impede or delay the switching process.

Recital 85

Switching is a customer-driven operation consisting of several steps, including data extraction, which refers to the downloading of data from the ecosystem of the source provider of data processing services; transformation, where the data is structured in a way that does not match the schema of the target location; and the uploading of the data in a new destination location. In a specific situation outlined in this Regulation, unbundling of a particular service from the contract and moving it to a different provider should also be considered to be switching. The switching process is sometimes managed on behalf of the customer by a third-party entity. Accordingly, all rights and obligations of the customer established by this Regulation, including the obligation to cooperate in good faith, should be understood to apply to such a third-party entity in those circumstances. Providers of data processing services and customers have different levels of responsibilities, depending on the steps of the process referred to. For instance, the source provider of data processing services is responsible for extracting the data to a machine-readable format, but it is the customer and the destination provider of data processing services who are to upload the data to the new environment, unless a specific professional transition service has been obtained. A customer who intends to exercise rights related to switching, which are provided for in this Regulation, should inform the source provider of data processing services of the decision to either switch to a different provider of data processing services, switch to an on-premises ICT infrastructure or to delete that customer’s assets and erase its exportable data.

Recital 87

Data processing services are used across sectors and vary in complexity and service type. This is an important consideration with regard to the porting process and timeframes. Nonetheless, an extension of the transitional period on the grounds of technical unfeasibility to allow the finalisation of the switching process in the given timeframe should be invoked only in duly justified cases. The burden of proof in that regard should fall fully on the provider of the data processing service concerned. This is without prejudice to the exclusive right of the customer to extend the transitional period once for a period that the customer considers to be more appropriate for its own purposes. The customer may evoke that right to an extension prior to or during the transitional period, taking into account that the contract remains applicable during the transitional period.

Recital 96

To facilitate interoperability and switching between data processing services, users and providers of data processing services should consider the use of implementation and compliance tools, in particular those published by the Commission in the form of an EU Cloud Rulebook and a Guidance on public procurement of data processing services. In particular, standard contractual clauses are beneficial because they increase confidence in data processing services, create a more balanced relationship between users and providers of data processing services and improve legal certainty with regard to the conditions that apply for switching to other data processing services. In that context, users and providers of data processing services should consider the use of standard contractual clauses or other self-regulatory compliance tools provided that they fully comply with this Regulation, developed by relevant bodies or expert groups established under Union law.

Art. 26 Data Act - Information obligation of providers of data processing services arrow_right_alt

The provider of data processing services shall provide the customer with:

1. information on available procedures for switching and porting to the data processing service, including information on available switching and porting methods and formats as well as restrictions and technical limitations which are known to the provider of data processing services;
2. a reference to an up-to-date online register hosted by the provider of data processing services, with details of all the data structures and data formats as well as the relevant standards and open interoperability specifications, in which the exportable data referred to in Article 25(2), point (e), are available.

95

Recital 95

The information to be provided by providers of data processing services to the customer could support the customer’s exit strategy. That information should include procedures for initiating switching from the data processing service; the machine-readable data formats to which the user’s data can be exported; the tools intended to export data, including open interfaces as well as information on compatibility with harmonised standards or common specifications based on open interoperability specifications; information on known technical restrictions and limitations that could have an impact on the switching process; and the estimated time necessary to complete the switching process.

Art. 27 Data Act - Obligation of good faith arrow_right_alt

Art. 28 Data Act - Contractual transparency obligations on international access and transfer arrow_right_alt

Art. 29 Data Act - Gradual withdrawal of switching charges arrow_right_alt

From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process.
From 11 January 2024 to 12 January 2027, providers of data processing services may impose reduced switching charges on the customer for the switching process.
The reduced switching charges referred to in paragraph 2 shall not exceed the costs incurred by the provider of data processing services that are directly linked to the switching process concerned.
Before entering into a contract with a customer, providers of data processing services shall provide the prospective customer with clear information on the standard service fees and early termination penalties that might be imposed, as well as on the reduced switching charges that might be imposed during the timeframe referred to in paragraph 2.
Where relevant, providers of data processing services shall provide information to a customer on data processing services that involve highly complex or costly switching or for which it is impossible to switch without significant interference in the data, digital assets or service architecture.
Where applicable, providers of data processing services shall make the information referred to in paragraphs 4 and 5 publicly available to customers via a dedicated section of their website or in any other easily accessible way.
The Commission is empowered to adopt delegated acts in accordance with Article 45 to supplement this Regulation by establishing a monitoring mechanism for the Commission to monitor switching charges, imposed by providers of data processing services on the market to ensure that the withdrawal and reduction of switching charges, pursuant to paragraphs 1 and 2 of this Article are to be attained in accordance with the deadlines laid down in those paragraphs.

88
89
113

Recital 88

Switching charges are charges imposed by providers of data processing services on the customers for the switching process. Typically, those charges are intended to pass on costs which the source provider of data processing services may incur because of the switching process to the customer who wishes to switch. Common examples of switching charges are costs related to the transit of data from one provider of data processing services to another or to an on-premises ICT infrastructure (data egress charges) or the costs incurred for specific support actions during the switching process. Unnecessarily high data egress charges and other unjustified charges unrelated to actual switching costs inhibit customers from switching, restrict the free flow of data, have the potential to limit competition and cause lock-in effects for the customers by reducing incentives to choose a different or additional service provider. Switching charges should therefore be abolished after three years from the date of entry into force of this Regulation. Providers of data processing services should be able to impose reduced switching charges up to that date.

Recital 89

A source provider of data processing services should be able to outsource certain tasks and compensate third-party entities in order to comply with the obligations provided for in this Regulation. A customer should not bear the costs arising from the outsourcing of services concluded by the source provider of data processing services during the switching process and such costs should be considered to be unjustified unless they cover work undertaken by the provider of data processing services at the customer’s request for additional support in the switching process which goes beyond the switching obligations of the provider as expressly provided for in this Regulation. Nothing in this Regulation prevents a customer from compensating third-party entities for support in the migration process or parties from agreeing on contracts for data processing services of a fixed duration, including proportionate early termination penalties to cover the early termination of such contracts, in accordance with Union or national law. In order to foster competition, the gradual withdrawal of the charges associated with switching between different providers of data processing services should specifically include data egress charges imposed by a provider of data processing services on a customer. Standard service fees for the provision of the data processing services themselves are not switching charges. Those standard service fees are not subject to withdrawal and remain applicable until the contract for the provision of the relevant services ceases to apply. This Regulation allows the customer to request the provision of additional services that go beyond the provider’s switching obligations under this Regulation. Those additional services, can be performed and charged for by the provider when they are performed at the customer’s request and the customer agrees to the price of those services in advance.

Recital 113

In order to take account of technical aspects of data processing services, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in respect of supplementing this Regulation in order to establish a monitoring mechanism on switching charges imposed by providers of data processing services on the market, and to further specify the essential requirements in respect of interoperability for participants in data spaces that offer data or data services to other participants. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making⁽¹⁾. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

^{(1) OJ L 123, 12.5.2016, p. 1.}

Art. 30 Data Act - Technical aspects of switching arrow_right_alt

Providers of data processing services that concern scalable and elastic computing resources limited to infrastructural elements such as servers, networks and the virtual resources necessary for operating the infrastructure, but that do not provide access to the operating services, software and applications that are stored, otherwise processed, or deployed on those infrastructural elements, shall, in accordance with Article 27, take all reasonable measures in their power to facilitate that the customer, after switching to a service covering the same service type, achieves functional equivalence in the use of the destination data processing service. The source provider of data processing services shall facilitate the switching process by providing capabilities, adequate information, documentation, technical support and, where appropriate, the necessary tools.
Providers of data processing services, other than those referred to in paragraph 1, shall make open interfaces available to an equal extent to all their customers and the concerned destination providers of data processing services free of charge to facilitate the switching process. Those interfaces shall include sufficient information on the service concerned to enable the development of software to communicate with the services, for the purposes of data portability and interoperability.
For data processing services other than those referred to in paragraph 1 of this Article, providers of data processing services shall ensure compatibility with common specifications based on open interoperability specifications or harmonised standards for interoperability at least 12 months after the references to those common specifications or harmonised standards for interoperability of data processing services were published in the central Union standards repository for the interoperability of data processing services following the publication of the underlying implementing acts in the Official Journal of the European Union in accordance with Article 35(8).
Providers of data processing services other than those referred to in paragraph 1 of this Article shall update the online register referred to in Article 26, point (b) in accordance with their obligations under paragraph 3 of this Article.
In the case of switching between services of the same service type, for which common specifications or the harmonised standards for interoperability referred to in paragraph 3 of this Article have not been published in the central Union standards repository for the interoperability of data processing services in accordance with Article 35(8), the provider of data processing services shall, at the request of the customer, export all exportable data in a structured, commonly used and machine-readable format.
Providers of data processing services shall not be required to develop new technologies or services, or disclose or transfer digital assets that are protected by intellectual property rights or that constitute a trade secret, to a customer or to a different provider of data processing services or compromise the customer’s or provider’s security and integrity of service.

80
81
92

Recital 80

Data processing services should cover services that allow ubiquitous and on-demand network access to a configurable, scalable and elastic shared pool of distributed computing resources. Those computing resources include resources such as networks, servers or other virtual or physical infrastructure, software, including software development tools, storage, applications and services. The capability of the customer of the data processing service to unilaterally self-provision computing capabilities, such as server time or network storage, without any human interaction by the provider of data processing services could be described as requiring minimal management effort and as entailing minimal interaction between provider and customer. The term ‘ubiquitous’ is used to describe the computing capabilities provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). The term ‘scalable’ refers to computing resources that are flexibly allocated by the provider of data processing services, irrespective of the geographical location of the resources, in order to handle fluctuations in demand. The term ‘elastic’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. The term ‘shared pool’ is used to describe those computing resources that are provided to multiple users who share a common access to the service, but where the processing is carried out separately for each user, although the service is provided from the same electronic equipment. The term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. The term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected, for instance in a connected data processing device. Edge computing, which is a form of such highly distributed data processing, is expected to generate new business models and cloud service delivery models, which should be open and interoperable from the outset.

Recital 81

The generic concept ‘data processing services’ covers a substantial number of services with a very broad range of different purposes, functionalities and technical set-ups. As commonly understood by providers and users and in line with broadly used standards, data processing services fall into one or more of the following three data processing service delivery models, namely Infrastructure as a Service (IaaS), Platform as a service (PaaS) and Software as a Service (SaaS). Those service delivery models represent a specific, pre-packaged combination of ICT resources offered by a provider of data processing service. Those three fundamental data processing delivery models are further complemented by emerging variations, each comprised of a distinct combination of ICT resources, such as Storage as a Service and Database as a Service. Data processing services can be categorised in a more granular way and divided into a non-exhaustive list of sets of data processing services that share the same primary objective and main functionalities as well as the same type of data processing models, that are not related to the service’s operational characteristics (same service type). Services falling under the same service type may share the same data processing service model, however, two databases might appear to share the same primary objective, but after considering their data processing model, distribution model and the use cases that they are targeted at, such databases could fall into a more granular subcategory of similar services. Services of the same service type may have different and competing characteristics such as performance, security, resilience, and quality of service.

Recital 92

Providers of data processing services should be required to offer all the assistance and support within their capacity, proportionate to their respective obligations, that is required to make the switching process to a service of a different provider of data processing services successful, effective and secure. This Regulation does not require providers of data processing services to develop new categories of data processing services, including within, or on the basis of, the ICT infrastructure of different providers of data processing services in order to guarantee functional equivalence in an environment other than their own systems. A source provider of data processing services does not have access to or insights into the environment of the destination provider of data processing services. Functional equivalence should not be understood to oblige the source provider of data processing services to rebuild the service in question within the infrastructure of the destination provider of data processing services. Instead, the source provider of data processing services should take all reasonable measures within its power to facilitate the process of achieving functional equivalence through the provision of capabilities, adequate information, documentation, technical support and, where appropriate, the necessary tools.

Art. 31 Data Act - Specific regime for certain data processing services arrow_right_alt

The obligations laid down in Article 23, point (d), Article 29 and Article 30(1) and (3) shall not apply to data processing services of which the majority of main features has been custom-built to accommodate the specific needs of an individual customer or where all components have been developed for the purposes of an individual customer, and where those data processing services are not offered at broad commercial scale via the service catalogue of the provider of data processing services.
The obligations laid down in this Chapter shall not apply to data processing services provided as a non-production version for testing and evaluation purposes and for a limited period of time.
Prior to the conclusion of a contract on the provision of the data processing services referred to in this Article, the provider of data processing services shall inform the prospective customer of the obligations of this Chapter that do not apply.

98

Recital 98

Data processing services which concern services of which the majority of main features has been custom-built to respond to the specific demands of an individual customer or where all components have been developed for the purposes of an individual customer should be exempted from some of the obligations applicable to data processing service switching. This should not include services which the provider of data processing services offers at a broad commercial scale via its service catalogue. It is among the obligations of the provider of data processing services to duly inform prospective customers of such services, prior to the conclusion of a contract, of the obligations laid down in this Regulation that do not apply to the relevant services. Nothing prevents the provider of data processing services from eventually deploying such services at scale, in which case that provider would have to comply with all obligations for switching laid down in this Regulation.

Data Act