The EU Data Act: What The "Switching" Requirement Means For Cloud Service Providers

The EU Data Act, which became effective on September 12, 2025, imposes new requirements on providers of "data processing services", a category that includes Infrastructure as a Service (IaaS), Platform as a service (PaaS), and Software as a Service (SaaS) solutions, along with emerging variations such as "Storage as a Service" and "Database as a Service." Most off-the-shelf cloud services appear to fall within the scope of the Act, which provides only a handful of narrow exemptions for specific types of services, such as cloud services that are custom-built for a particular customer and not offered by the provider at broad commercial scale.

Like other data-related EU regulations, the EU Data Act is extraterritorial, and applies to data processing services that are marketed or provided to customers located in the EU, even if the provider is established outside of the EU.