Do I have to give users the data my device or app collects?

Since 12 September 2025 the user of a connected product (a device that collects data) and its related service has the right to access that data and to share it with a third party. For new products placed on the market after 12 September 2026 access must be built into the design (art. 3). Cloud providers must allow switching to another provider. Micro and small enterprises are exempt from the design obligations.

Who must?

Manufacturers of connected devices and providers of related services in the EU; providers of data processing (cloud) services. Micro and small enterprises: only some obligations.

What to do?

1. List which data your device or service collects and where it is kept.
2. Give the user access to the data (API or export) and inform them before the contract (art. 3(2)).
3. For cloud services: contract terms on switching and data export (Chapter VI).

Where to file?

Nothing is filed.

Who checks?

The competent authority in each member state

Fine

Penalties are set by each member state (art. 40); for personal data the GDPR amounts apply.

What if I am already late?

Start with the data list and the export path; new devices from 12 September 2026 must have access built in.