Does the EU Data Act Apply to Small Companies? The SME Exemptions, Explained

A comforting rumour circulates among founders: the Data Act is for big companies, small ones are exempt. Like most comforting rumours about EU law, it is one-third true, and the two false thirds are where the risk lives.

The true third: the Chapter II carve-out

The data-sharing chapter, the one that gives users rights to access product data and route it to third parties, is not expected to apply to data generated by connected products manufactured, or related services provided, by micro and small enterprises. Under the EU's standard definition, that generally means fewer than 50 employees and annual turnover or balance sheet not exceeding 10 million euros. There is also transitional breathing room: an enterprise that has recently grown into the medium category is expected to keep the exemption for a limited period, and similar relief is aimed at newer product lines of medium-sized makers.

So a five-person hardware startup shipping a connected sensor into the EU is, in most readings, outside the heaviest obligations: no user data-access machinery, no third-party sharing procedure, no access-by-design engineering duty for now.

The first false third: size is measured with your group, not alone

The SME definition counts partner and linked enterprises. A small subsidiary of a large group, a startup majority-owned by a corporate, or a company with significant cross-shareholdings can fail the test even with a tiny headcount of its own. If investors or a parent company sit on your cap table in size, have someone actually run the calculation before you rely on the exemption. And the exemption is about who makes the product or provides the related service, if a small company operates the companion app for a large manufacturer's device, the manufacturer's duties do not disappear.

The second false third: cloud switching has no small-company escape

Chapter VI, the cloud-switching regime, applies to providers of data processing services offered to EU customers and is generally read to include SaaS of any size. The mandatory exit rights, a maximum notice period of two months, a 30-day transition, export in a machine-readable format, and switching charges expected to be withdrawn from 12 January 2027, reach a two-person SaaS exactly as they reach a hyperscaler. The same goes for Article 13 on unfair contract terms, which was written to protect smaller businesses, not to exempt them, and the regime around it has applied to new contracts since 12 September 2025.

Growing out of the exemption is a cliff you can see coming

Exemptions tied to size expire on the day you stop being that size. A small manufacturer that crosses the threshold inherits the data-sharing duties after the transitional period, and products placed on the EU market once you are in scope meet the access-by-design expectations that have applied since 12 September 2026. Teams that ignored the Data Act entirely while small tend to discover the retrofit cost at exactly the moment they can least afford the distraction. The cheap move is to design the access path early even while exempt, paperwork later is easy, re-engineering later is not.

Enforcement still notices small companies

Penalties are set nationally, and authorities such as Germany's Bundesnetzagentur have been enforcing since May 2026, with tiered fines of up to EUR 500,000 and GDPR-level exposure where personal data is involved. Regulators rarely open with a small company, but customers do: a business customer invoking switching rights, or a lawyer invoking Article 13 in a dispute, does not check your headcount first.

The honest checklist for a small company

1. Confirm your size category properly, counting partner and linked enterprises.
2. If you make devices or run related services: note which duties you are exempt from, and write the date assumptions down.
3. If you provide SaaS or cloud: do the switching work, the exemption does not cover you.
4. Screen your standard contract against Article 13 either way.

Our free readiness assessment asks about your size and role and shows which obligations actually apply to your setup, so you rely on the real exemption, not the rumoured one.