Does the EU Data Act Apply to UK Companies After Brexit?

Brexit took the UK out of the EU, but it did not take UK companies out of the reach of EU digital regulation. Like the GDPR before it, the EU Data Act applies based on where products are sold and where users are located, not on where the company is incorporated. If your UK business sells connected products, provides related services, or offers cloud services to customers in the EU, the Data Act is expected to apply to you in much the same way it applies to a competitor based in Munich or Lyon. The regulation has been applicable since 12 September 2025, so for most UK firms with EU customers this is no longer a future problem.

The extraterritorial scope, in plain English

The Data Act attaches to activity in the EU market. In practice, a UK company is likely to be caught in three main situations: it manufactures connected products that are placed on the EU market, it provides related services (such as a companion app or analytics platform) to users in the EU, or it offers data processing services, including cloud and edge services, to EU customers. The nationality of the company does not matter. A smart thermostat designed in Cambridge and sold in Germany carries the same data access obligations as one designed in Berlin.

There is one structural consequence of being outside the EU: companies without an EU establishment that fall within scope are generally expected to appoint a legal representative in one of the member states where their products or services are offered. This mirrors the GDPR representative requirement that many UK firms will already know, but it is a separate appointment under a separate regulation.

Which obligations matter most for UK businesses

For UK manufacturers of connected products, the core duty is user data access. Users in the EU can request the data their devices generate, and that data may also have to be shared with third parties the user chooses, such as a repair shop or an insurer. Since 12 September 2026, the access-by-design requirement has been in force for new product designs, meaning data access should be built in rather than bolted on afterwards.

For UK cloud and SaaS providers serving EU customers, the switching provisions are the headline. Contracts must support customer switching, and the charges that can be levied for switching are being phased out, with the full withdrawal of switching charges expected from 12 January 2027. UK providers that have not yet reviewed their EU customer contracts for termination notice periods, data export commitments and switching assistance should treat that as a near-term priority.

There is also a contract cleanup deadline on the horizon. Existing agreements concluded before the Data Act became applicable benefit from a transition period, but legacy contracts of indefinite duration or running beyond 2034 are expected to need alignment by 12 September 2027.

Enforcement: who comes after a UK company?

Enforcement sits with national authorities in each EU member state, which means a UK company could in principle face scrutiny from several regulators at once, depending on where its users are. Germany is the most concrete example so far. Its implementing law, the DADG, has been in force since 30 May 2026, with the Bundesnetzagentur as the lead enforcer and a tiered fine framework reaching up to EUR 500,000 for Data Act violations. Where personal data is involved, Article 40(4) allows GDPR-level fines of up to 4% of worldwide turnover, but that higher ceiling applies only in those personal data cases, not across the board.

UK companies should not count on the rules softening before enforcement ramps up. The European Commission's Digital Omnibus package does propose easing some Data Act burdens, including possible legacy contract exemptions and SME relief, but these proposals are not law yet and may change substantially during the legislative process.

What about the UK's own rules?

The UK has not adopted an equivalent of the Data Act, so UK-only sales are currently outside this regime. That can tempt firms into running two product lines, one for the EU and one for home. In practice, most manufacturers are expected to build to the EU standard across the board, because maintaining divergent firmware, contracts and data access tooling is usually more expensive than complying once. This is the familiar Brussels effect, and connected products are likely to be its next chapter.

Where to start

A sensible first step is scoping: list your EU-facing products and services, check whether you need an EU legal representative, and map which deadlines apply to you. If you want a quick, structured read on where you stand, our free Data Act readiness assessment walks you through the key questions in a few minutes and highlights the obligations most likely to apply to your business.