International Transfers of Non-Personal Data Under the EU Data Act

Most teams know the GDPR rules on moving personal data out of the EU. Far fewer have noticed that the EU Data Act, applicable since 12 September 2025, created a parallel regime for non-personal data. Article 32 requires providers of data processing services, which in practice means cloud, edge and many SaaS providers, to take measures preventing international transfer of or third-country governmental access to non-personal data held in the EU, where that transfer or access would conflict with EU law or the national law of a member state.

Why non-personal data suddenly has transfer rules

The GDPR never covered machine data, telemetry, industrial sensor readings or other datasets with no identifiable individuals in them. Yet that data can carry trade secrets, critical infrastructure details and commercially sensitive know-how. Article 32 is the EU's answer: it does not ban transfers, but it does require providers to resist foreign court orders and administrative decisions that have no valid legal basis under EU law. The provision is sometimes described as a data sovereignty clause, and it is one of the reasons European sovereign cloud offerings have multiplied.

What providers are expected to do

The obligation falls on the provider of the data processing service, not on its customers. In practice, providers are expected to take reasonable technical, organisational and legal measures, which may include:

• contractual commitments not to hand over non-personal data held in the EU unless a valid legal route exists,
• technical controls such as encryption and key management arrangements that limit what can be disclosed,
• internal review procedures so that a foreign request is checked by lawyers before anything is produced,
• transparency on the provider's website about the jurisdictions its infrastructure is subject to.

A third-country judgment or administrative decision requesting access is generally only enforceable if it rests on an international agreement, such as a mutual legal assistance treaty, between that country and the EU or a member state. Where no such agreement exists, the provider is expected to assess the foreign legal system against criteria set out in the regulation, including proportionality, specificity of the order and the availability of judicial review, and to provide the minimum amount of data permissible.

What this means if you are the customer

If you buy cloud or data processing services rather than sell them, Article 32 is mostly a due diligence item. It is reasonable to ask your provider where non-personal data is held, which foreign jurisdictions could assert access, and what the provider's documented process is for handling third-country requests. Those answers belong in your vendor file, next to the switching and egress terms that the same chapter of the Data Act regulates. Remember the related deadlines: switching charges must be withdrawn by 12 January 2027, and contracts concluded before the Act's application date fall under its rules for legacy contracts from 12 September 2027.

Enforcement is national, and it varies

Enforcement of the Data Act sits with national authorities. Germany's implementation act, the DADG, has been in force since 30 May 2026 and hands enforcement to the Bundesnetzagentur, with tiered fines of up to EUR 500,000 for Data Act infringements. GDPR-level fines of up to 4% of worldwide turnover apply only where personal data is involved, under Article 40(4). Other member states are at different stages, so the practical enforcement risk depends on where you and your provider operate.

Will the Digital Omnibus change this?

The European Commission's Digital Omnibus proposals would soften parts of the Data Act, including exemptions for legacy contracts and relief for smaller providers. Those proposals are not law yet, and Article 32 has not been a focus of the headline changes, so building your vendor checks on the current text remains the safe course. Treat any claim that the sovereignty requirements have been relaxed with caution until an amending regulation is actually adopted.

Find out where you stand

Whether you provide data processing services or depend on them, the fastest way to see which Data Act obligations apply to you is to run through our free readiness assessment. It takes a few minutes, covers transfers, switching and the core data-sharing duties, and shows you which gaps are engineering work and which are paperwork you can close this quarter.