The EU Data Act for SaaS: Cloud Switching Becomes a Customer Right

Most SaaS founders met the Data Act as a rumour about connected cars. Then their enterprise customers' procurement teams read Chapter VI — and suddenly every contract negotiation in the DACH market includes questions about switching support, egress charges, and exportable data formats. The regulation stopped being someone else's law the day it became a purchasing checklist.

The frame: Regulation (EU) 2023/2854 entered into force in January 2024 and has applied since 12 September 2025. Its best-known chapters govern access to data from connected products. But for software companies, the operative part is the cloud-switching regime: providers of data-processing services — IaaS, PaaS, and yes, SaaS — must remove obstacles that keep customers from switching to another provider or moving on-premise.

What the Switching Regime Actually Demands

• Contract content: agreements must spell out switching rights — a notice period of no more than two months for initiating the switch, a transition period of no more than 30 calendar days (which the provider may extend to at most seven months only where the switch is technically unfeasible, and which the customer may extend once), and the categories of exportable data.
• Egress economics: switching charges are capped at cost during the transition and disappear for standard switching from 12 January 2027 — data ransom as a retention strategy is legislated away.
• Exportable data: the customer's data and, for many services, relevant metadata must leave in a structured, commonly used, machine-readable format.
• Functional equivalence: for infrastructure-layer services the bar is higher still; for SaaS, the practical duty is open interfaces and honest documentation of what portability means for the service.
• International access safeguards: providers must resist unlawful third-country government access to non-personal data — a contractual and architectural point DACH customers increasingly probe.

“

The Data Act turns “how do we leave?” from an awkward renewal question into a right the customer already owns. Providers who answer it well convert compliance into a trust advantage.

Why This Lands Harder in the DACH Market

German and Austrian enterprise buyers were vendor-lock-in sceptics long before Brussels legislated the topic; the Data Act hands their procurement departments statutory language for instincts they always had. Add the financial sector overlay: banks and insurers buying SaaS must reconcile Data Act switching rights with DORA exit strategies — two frameworks that rhyme, and that a well-prepared vendor can answer with one architecture. A provider that shows up with a documented exit process, export tooling, and clean sub-processor transparency is simultaneously Data-Act-ready, DORA-friendly, and culturally fluent.

There is also an offensive reading for challengers: switching rights lower the moat of incumbent platforms. The cost of leaving your competitor just fell by regulation — market entrants who build genuinely easy onboarding-from-export pipelines get a structural tailwind.

A Vendor Checklist

1. 01Repaper standard terms: notice, transition period, data categories, and — from January 2027 — no switching charges for standard cases.
2. 02Build export as a product feature, not a support ticket: formats, completeness, and documentation.
3. 03Map metadata: decide, document, and defend what is exportable beyond raw customer data.
4. 04Align the Data Act exit process with DORA-grade exit support for regulated customers — one process, two compliance answers.
5. 05Prepare the third-country access answer: where data lives, who can compel access, and what you would do about it.

Enforcement and the Question of Teeth

Directive-style scepticism — “nice text, who enforces it?” — underestimates this regulation's channels. Formal enforcement runs through national authorities designated per member state, with penalty regimes attached; but the faster teeth are private: customers can invoke the mandatory switching rules directly in negotiations, and whether a clause that contradicts them would stand up in court is at least doubtful under national contract law — which hands every customer legal department a lever at renewal time. In practice the Data Act will be enforced the way the GDPR's processor terms were — through thousands of procurement negotiations where the customer's template quietly becomes the market standard. Vendors can fight that trend clause by clause, or ship compliant terms first and sell the certainty.

One planning nuance for regulated-industry vendors: the Data Act's switching rules and DORA's exit expectations overlap but do not merge — DORA speaks to the financial institution's duties, the Data Act to the provider's. Building the provider-side capability once, with documentation both audiences understand, is the efficient path through the pair. One to watch: with the Digital Omnibus (COM(2025) 837), the Commission proposed in November 2025 to ease the switching rules — mainly for smaller providers and for services largely customised to one customer under contracts concluded on or before 12 September 2025. The proposal has not been adopted yet.

Conclusion

The Data Act quietly rewrites SaaS competitive dynamics in Europe: retention must now be earned by product, not by exit friction. For vendors entering the DACH market, that is less a burden than an audition — the buyers here have always rewarded providers who make leaving easy and staying worthwhile. Aegiron Capital Group supports SaaS firms in making their contracts and architecture DACH-procurement-ready; legal advice comes from the law firm you engage.