Key parts of the EU’s Data Act (the Act), which many lawyers describe as the most significant change to technology contracts since the introduction of the GDPR, have now been fully in-force for almost 5 months, yet many customers, suppliers and indeed lawyers don’t seem to be aware of the disruption it could still bring.

Background

Whether the parties realise it or not, the Act applies to every cloud service agreement, every SaaS platform contract, every data processing arrangement with an EU dimension – whether the parties realise it or not. This is because the Act has retrospective effect, and so its terms apply not just to new contract but also active contracts (i.e. contracts entered into before September 2025, the date the Act’s substantive rights obligations apply from).

In essence, the Act means that cloud and data processing service providers now face hard limits on erecting switching barriers, whilst customers gain statutory rights to move providers (i.e. to terminate existing agreement early). Despite Brexit, this EU legislation remains highly relevant to UK technology businesses operating across UK-EU  markets, whether as suppliers to EU customers or as customers of EU providers.

Yet six months on, both technology suppliers and customers are sleepwalking into trouble. Suppliers are leaving contracts exposed to regulatory challenge. Customers are failing to exercise rights that could save them hundreds of thousands of pounds. For technology companies, SaaS businesses, and their customers operating across UK-EU markets, the cost of inaction is mounting.

What changed on 12 September 2025?

The Act’s Chapter VI applies to “data processing services” – defined as digital services enabling ubiquitous, on-demand network access to a shared pool of configurable, scalable computing resources that are rapidly provisioned with minimal management effort.

This definition explicitly includes:

• Cloud infrastructure services (IaaS) – i.e. where a provider supplies the underlying computing power and storage,
• Platform services (PaaS) – i.e. where a provider offers a development environment for building applications, and
• Software services (SaaS) – where a provider delivers out of the box software applications normally accessed through a web browser or app).

In this way, it catches the vast majority of technology offerings that many organisations will be familiar with.  As noted above, this includes:

• Analytics platforms,
• Performance tracking systems,
• Rights management systems, and
• Engagement databases.

However the definition of “data processing services” does create uncertainty for providers of online B2B software services which share some, but not all, of the technical characteristics of SaaS Services within the scope of the Act. 

For example software providers in the financial services industry have developed a hybrid model – managed software hosting – which offers dedicated or virtual servers with higher customization and security for specific needs, which is different from true SaaS (which is typically standardised and multi-tenant with pooled computing resources).

Grey areas like this will require case-by-case analysis and likely regulatory clarification, but the definition is deliberately broad and, in our view, will catch most cloud and SaaS arrangements impacting businesses across all sectors, including real estate, advertising/media, retail, financial services, healthcare, and manufacturing.

Three points to be aware of:

1. Customers gain statutory switching rights: Customers can terminate contracts after giving notice and completing the switching process, with notice periods capped at a maximum of two months. Once notice is given, customers benefit from:

• • a mandatory maximum transition period of 30 calendar days – (extendable to seven months only if the provider can demonstrate that a shorter period is technical unfeasible;
  • mandatory data portability – meaning the technology supplier must export all of the customer’s data in usable format;
  • service separation where technically feasible – meaning that if a customer uses multiple services from the save supplier, it can switch away from one service without being forced to terminate the others.

However, subject to the foregoing,  the Act still permits fixed-term contracts provided there are proportionate early termination penalties to cover early termination. This essentially means customers have a statutory right to exit (before the end of the fixed term), but may need to pay justified compensation for breaking minimum terms.

2. Switching charges are being eliminated: As readers will be familiar with, IT agreements often contain express obligations on suppliers to provide termination assistance to customers on termination/expiry – but with such support often coming with the ability for the supplier to charge unspecified amounts for this.

However, from 12 January 2027, fees imposed specifically for migrating away (e.g. data egress fees, export charges, technical migration costs) will be prohibited. Until then, only reduced cost-recovery charges are permitted.

3. Early termination fees remain – but only if proportionate: The Act permits suppliers to charge early termination fees provided they are “proportionate” but provides no further guidance, or indeed methodology, as to how this is determined.

Importantly, proportionality will be assessed by reference to applicable national contract and unfair terms law. This means outcomes may vary significantly across Member States. A penalty considered lawful under German contract law might be struck down under French or Italian unfair terms legislation, for example. Unfortunately, this creates uncertainty for suppliers and strategic opportunities for customers, which is likely to remain until we have clearer guidance through court decisions, guidance notes or further legislation.

The opportunity & risk

For customers locked into a fixed long-term agreement or an agreement that only allows the customer to terminate if it pays an extortionate early termination fee, this creates an amazing opportunity. The Act gives customers a statutory right to terminate early without paying a high price for this – as a customer will only be exposed to a proportionate early termination fee (rather than the full remaining contract value) and, from January 2027, no switching charges at all.

For suppliers, it creates urgent risk. An entire contract portfolio may now not only contain prohibited switching charges but also, more worryingly, the ability for your customers to terminate for convenience on just two months’ notice (subject only to those customers paying proportionate exit fees). This means customers can exit long-term commitments by a giving maximum of two months’ notice and paying only justified costs – not the full remaining contract value. Additionally, switching charges (data egress fees, migration costs) are prohibited from 12 January 2027 and limited to cost-recovery until then. Suppliers who’ve built business models on customer lock-in through high exit barriers now face revenue concentration risk.

Yet our experience at Three Points suggests both sides are missing this.

Why UK businesses can’t ignore this

While this is an Act of the EU, it has extraterritorial and retrospective reach across three key categories:

1. UK suppliers serving EU customers: A UK-based analytics platform, customer engagement tool, or enterprise software system serving EU businesses must comply;
2. UK customers of EU providers: UK organisations using EU-established services can invoke switching rights against contracts signed years ago under the Act; and
3. Mixed UK-EU arrangements: UK organisations using services from providers with EU establishments, or UK suppliers whose customers have EU operations or subsidiaries that use the same services, may trigger obligations where the services are provided to customers in the EU too.

Practical tips for Customers

The biggest missed opportunities lie with customers who don’t realise the Act applies to their existing contracts.  A customer, for example, locked into a contract with a clause that suggests that there’s a £50,000 “data migration fee” and early termination penalty equal to 100% of remaining value, may now take heart as both fees may be challengeable. Three types of charges are or will shortly be unlawful:

1. Data export fees to retrieve your historical performance data and other records or similar assets
2. Technical migration support charges beyond genuine cost recovery (and only until January 2027)
3. API access fees during the switching period

Further, termination penalties/fees will require justification. So a £200,000 early termination charge in an existing contract is now subject to challenge. A customer in this instance could demand transparent cost breakdowns behind such charges showing what supplier losses it’s designed to recover, for example.

Practical tips for Suppliers

As outlined above, every contract signed before September 2025 with EU customers may now contain unenforceable switching charges or vulnerable termination fees.

1. Reassess legacy contracts and finance projects – accounting/finance predictions that assume customers will pay 100% termination penalties to exit legacy contracts may be overstating committed revenue and therefore these agreements and the associated financial estimates should now be reassessed accordingly.
2. Don’t wait for customers to challenge or regulators to enforce. Approach high-value clients proactively and seek to agree modifications to existing agreements that may be contrary to the Act. This will help avoid the uncertainty that may follow from customers’ enforcing their rights proactively.
3. Update templates and practices – despite the fairly restrictive nature of the Act, there is still room for suppliers to update standard form agreements and indeed the approach to pricing that could significantly mitigate the impact of the changes. We have worked with a number of clients on this and would be happy to share practical solutions on this.

For instance, where you are seeking to levy early termination fees, document and maintain transparent records of: initial investments made when onboarding each client, bespoke development work undertaken for them, integration costs incurred and any volume discounts or pricing concessions provided. Frame termination charges more as liquidated damages clauses with clear cost methodology rather than revenue protection mechanisms.

What Comes Next: Three Key Developments

Through 2026–2027, watch for three critical developments:

1. Enforcement actions against suppliers still charging switching fees from legacy contracts
2. Court guidance on “proportionate” as customers challenge pre-2025 termination penalties, establishing benchmarks across Member States
3. January 2027 cliff edge when switching charge prohibition becomes absolute and even cost-recovery charges are eliminated

Three Points Law’s Recommendation

The Act’s retrospective application represents the most significant shift in B2B technology contracting power in years.

So in summary, given that Three Points was created to serve both corporates who regularly procure tech solutions, as well as innovative tech companies that supply those corporates, here are the Three Points that you should definitely be aware of going forwards:

1. For customers: Every pre-September 2025 data processing contract is now worth reviewing. Potential savings from exiting early or challenging unfair termination fees may now be more in reach than they were before and the Data Act may well be your new best friend here.
2. For suppliers: Every contract with switching charges or termination charges signed before (and indeed after) September 2025 now poses a regulatory and commercial risk that you should consider mitigating against. Proactive compliance is cheaper than reactive defence – so now may be a good time to revisit your templates and key customer agreements in case changes can be made to better protect you.
3. For everyone: The Act is a significant piece of legislation that has been largely ignored in the UK so far. But, given the potential impact that it has, all stakeholders would be well-advised to familiarise themselves with the key provisions as soon as possible, and keep their eyes out for further guidance that is likely to arise from judicial interpretation of the Act provided by courts across key jurisdiction in the months and years to come.

Simon Leaf

Article includes input from Chirayato Bannerjee, full-time judge, dual-qualified lawyer and data specialist England & Wales and India.

Three Points is a pioneering tech-enabled law firm built for innovative businesses, fast-growth tech companies and elite sports professionals. Our clients include fast-growing tech companies (including tech unicorns and leading AI providers), well-established FTSE-listed businesses, international athletes and agents, major rightsholders, top creative/media agencies and well-known brands.  

Founded in 2025 by experts with 25+ years’ experience at top international firms, we bridge the gap between traditional legal advice and modern client needs. We deliver legal services that match the pace and ambition of our clients and are recognised leaders in Technology, Sports and Commercial/IP law.