The EU Data Act introduces sweeping obligations for data access
and reuse, especially in mixed datasets combining personal and
non-personal data. While both the Data Act and GDPR share
principles like transparency and fairness, their objectives
diverge: the GDPR protects personal data, while the Data Act
promotes data sharing. Navigating both requires careful data
classification, lawful processing bases, and robust contractual
safeguards. Though GDPR generally prevails in case of conflict, the
Data Act sometimes complements it - especially in IoT contexts.
Enforcement will be split across national authorities, adding
complexity to compliance.
In the previous part of our Data Act series, we
explored how the EU Data Act (Regulation (EU) 2023/2854)
“Data Act” establishes new frameworks
to transform the way organizations handle data, creating new
compliance obligations while opening up substantial opportunities
across both consumer and industrial data ecosystems.
