European UnionData Act, Removing Obstacles to Switching Cloud Providers and the Switching Contract (Articles 23 and 25)
Regulation (EU) 2023/2854, Arts. 23 and 25
In force since .
A switching and interoperability rule binding private bodies.
- Private right of action
- No
- Obligation class
- Contract terms, Prohibition
As of .
What it requires
- If you provide a data processing service, do not impose, and remove, the pre-commercial, commercial, technical, contractual and organisational obstacles that inhibit customers from terminating the contract after the maximum notice period and the successful completion of switching, concluding new contracts with a different provider covering the same service type, or porting their exportable data and digital assets to a different provider or to on-premises ICT infrastructure, including after a free-tier offering (Art. 23, points (a) to (c)).
- Do not inhibit customers from achieving functional equivalence in the use of the new service of the same service type at a different provider (Art. 23, point (d)), or from unbundling, where technically feasible, the services referred to in Article 30(1) from your other data processing services (Art. 23, point (e)).
- Set out the customer's switching rights and your obligations in a written contract, and make that contract available before signing in a way that lets the customer store and reproduce it (Art. 25(1)).
- Include a clause allowing the customer, on request, to switch to a different provider or to port all exportable data and digital assets to on-premises ICT infrastructure without undue delay and within a mandatory maximum transitional period of 30 calendar days, which starts after the notice period and during which the contract stays applicable, you give reasonable assistance, you maintain business continuity, you give clear information on known continuity risks and you maintain a high level of security (Art. 25(2), point (a)).
- Include a notice period for initiating switching of no more than two months, and a data retrieval period of at least 30 calendar days that starts after the transitional period (Art. 25(2), points (d) and (g)).
- Include a clause on support for the customer's exit strategy, including all relevant information, and a clause terminating the contract and notifying the customer on successful switching or, where the customer chooses to erase its data, at the end of the notice period (Art. 25(2), points (b) and (c)).
- Specify exhaustively all categories of data and digital assets that can be ported, at a minimum all exportable data, and specify exhaustively any categories of data specific to the internal functioning of your service that are exempted to protect your trade secrets, provided the exemption does not impede or delay switching (Art. 25(2), points (e) and (f)).
- Include a clause guaranteeing full erasure of the exportable data and digital assets generated directly by the customer or relating to the customer directly after the retrieval period, once switching is complete, and state the switching charges you may impose under Article 29 (Art. 25(2), points (h) and (i)).
- Include clauses letting the customer notify, on expiry of the notice period, a decision to switch to a different provider, to switch to on-premises ICT infrastructure, or to erase its exportable data and digital assets (Art. 25(3)).
- If the 30-day transitional period is technically unfeasible, notify the customer within 14 working days of the switching request, justify the unfeasibility and indicate an alternative transitional period of no more than seven months, with service continuity throughout, and give the customer the right to extend the transitional period once (Art. 25(4) and (5)).
- Before concluding a contract for a service that Article 31 takes outside part of this Chapter, tell the prospective customer which obligations of the Chapter do not apply (Art. 31(3)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The competent authorities that each Member State designates to be responsible for the application and enforcement of the Regulation (Article 37(1)), which for Articles 23 to 31, 34 and 35 must have experience in the field of data and electronic communications services (Article 37(4), point (b)); an entity falls under the competence of the Member State where it is established (Article 37(10)).
Settledness
- As of
- Open questions
- Will the Digital Omnibus (procedure 2025/0360(COD)) be adopted with the Council mandate's Article 31(1a), which would excuse certain contracts concluded on or before from Chapter VI other than Article 29?
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32023r2854
What this law does
Article 23 of Regulation (EU) 2023/2854 requires a provider of data processing services to take the measures in Articles 25, 26, 27, 29 and 30 to enable customers to switch to a different provider's service of the same service type, to switch to on-premises ICT infrastructure, or to use several providers at the same time.
Article 23 requires a provider to remove the pre-commercial, commercial, technical, contractual and organisational obstacles that inhibit customers from the steps it lists, which run from terminating the contract to unbundling services. Article 25(1) requires the customer's switching rights and the provider's obligations to be clearly set out in a written contract that the provider makes available before signing in a way that allows the customer to store and reproduce it.
Article 25(2) sets the minimum content of that contract, including a mandatory maximum transitional period of 30 calendar days, a notice period of no more than two months, a data retrieval period of at least 30 calendar days and a clause guaranteeing full erasure afterwards.
Article 25(3) requires the contract to include clauses that let the customer notify its decision to switch to a different provider, to switch to on-premises ICT infrastructure or to erase its exportable data and digital assets. Article 25(4) requires a provider that finds the 30-day transitional period technically unfeasible to notify the customer within 14 working days, to justify the unfeasibility and to indicate an alternative transitional period of no more than seven months.
Article 25(5) requires the contract to give the customer the right to extend the transitional period once. Article 31(1) excludes from Article 23, point (d), a data processing service of which the majority of main features has been custom-built for an individual customer, or whose components were all developed for an individual customer, where it is not offered at broad commercial scale via the provider's service catalogue.
Article 31(2) excludes the obligations of Chapter VI for a data processing service provided as a non-production version for testing and evaluation purposes and for a limited period of time. Article 40(1) leaves the rules on penalties for infringements of the Regulation to the Member States, which must make them effective, proportionate and dissuasive. Article 50 applies the Regulation from .
The Permanent Representatives Committee agreed the Council's mandate for negotiations with the European Parliament on the Digital Omnibus on . The Digital Omnibus text in that mandate would insert Article 31(1a), which would excuse from Chapter VI other than Article 29 a data processing service, other than one within Article 30(1), adapted to the specific needs of the customer under a contract concluded before or on .
The same text would insert a parallel relief where the provider is a small and medium-sized enterprise or a small mid-cap. It would also allow proportionate early termination penalties in a contract of fixed duration.
When LexLint raises it
When your app profile says your app provides cloud services.