Consumers and businesses get more control over and access to (usage) data as of 12 September 2025: is your business well prepared for the European Data Act?

Contract Law

21 August 2025

Consumers and businesses get more control over and access to (usage) data as of 12 September 2025: is your business well prepared for the European Data Act?

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

Are you an ICT service provider, SaaS, PaaS, IaaS provider or IoT (Internet of Things) supplier active within the EU? Then there is important legal news you should not miss! On 12 September 2025, the European Data Act enters into force. This regulation has major consequences if you supply digital services or products in which you collect usage data. It affects the operational practices surrounding this data and the contracts and general terms and conditions that must be adapted accordingly. The Data Act prohibits certain terms while at the same time requiring other terms to be explicitly included.

In this blog we explain what the Data Act means for your organisation and how to avoid unwanted risks.

No more unreasonable terms within business relationships (B2B)

The Data Act mainly protects the “weaker” contracting party, normally the consumer, but that protection will now also apply to business counterparties. With large cloud services and IoT suppliers, negotiation is often barely possible: businesses (and consumers) usually only get a “take it or leave it” contract. The Data Act now provides that such unilaterally imposed, unfair terms towards businesses are also no longer binding.

A term is regarded as unfair if it deviates significantly from good commercial practice or is contrary to good faith and fair dealing. In doing so, the law looks not only at provisions on data, but also at liability and the customer’s rights in the event of breach or termination of the contract.

Examples of black and grey terms that are no longer permitted

To be concrete:

Black = Always unfair:

Exclusion of liability for intent or gross negligence
Limitation of remedies in the event of breach of contract
Supplier alone may assess whether data complies with agreements or interpret contracts

Grey = Presumed unfair:

Unilateral price changes without the possibility of termination
Use of customer data in a manner that harms customer interests
Disproportionate limitation of the supplier’s liability or expansion of that of the customer/consumer

Preventing vendor lock-in through a contractual exit arrangement

The Data Act also aims to remove switching barriers that effectively “lock in” the customer. Long notice periods, high costs for data export, or other restrictions on switching to another supplier are no longer permitted. Under the Data Act, contracts must from now on contain a clear exit arrangement, so that customers can take their data with them within 30 days and business continuity is preserved.

What does this mean for your contracts?

Make sure the contracts and general terms and conditions you conclude with customers from 12 September 2025 onwards comply with the Data Act immediately.
Make sure that, with regard to existing contracts, you check which transitional periods apply, since this depends on the duration and end date.
Check your general terms and conditions for black and grey terms, such as those on data access, liability, price changes, and ensure you have the correct exit arrangements in place.

Sanctions for non-compliance with the European Data Act

This European regulation has direct effect, meaning that Dutch consumers or business counterparties can invoke it directly before a court as if it were Dutch law. This means that if you continue to apply provisions or act in a manner contrary to this Data Act, this is void or voidable and you may become liable for damages, i.e. liable for the resulting harm.

Furthermore, if you fail to comply with the Data Act after 12 September 2025, an administrative fine can be imposed by the Dutch Data Protection Authority, provided the violation falls within the scope of the GDPR/Dutch GDPR Implementation Act. The maximum fine is 20 million euros or 4% of worldwide annual turnover, whichever is higher (Section 17 of the Dutch GDPR Implementation Act).

The exact amount of the fine is aligned with the severity of the violation and the degree of culpability (Section 5:46 of the General Administrative Law Act).

Other administrative sanctions (such as periodic penalty payments or directives) are possible if provided for in the national implementing legislation itself, but this is still being further elaborated.

Keep control over your services and data

The lesson is clear: as an ICT service provider, you must now proactively review your contracts and general terms and conditions. This way you avoid legal disputes and risks, and protect your customers in the right way. You also remain compliant with European legislation and avoid the sanctions.

Do you need advice on contract terms, compliance, or switching procedures? The lawyers at The Legal Company are happy to help ICT service providers draft or review contracts that comply with the Data Act and with the specific needs of your organisation. Contact us via info@thelegalcompany.nl or call 020-3450152.

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.