EU Data Act (Part 1): Cloud Control

In this blog post, authors Emily Chan, Nick Smallwood, Peter Wainman & Samuel Wigley (Mills & Reeve) dive into the provisions of the EU Data Act that took effect on 12 September 2025, introducing major new obligations for cloud service providers operating in the EU. Central to the reforms are enhanced switching rights, which require providers to allow customers to terminate contracts on no more than two months’ notice to move to another provider or to on-premises infrastructure. Switching must typically be completed within a 30-day transition period, meaning the entire process may take as little as three months.

The authors emphasize that these requirements apply broadly to SaaS, IaaS, and PaaS providers and come with significant operational implications. Providers must remove technical and commercial barriers to switching, ensure service continuity, and prepare for customer refunds on unused prepaid terms. Compounding this, from January 2027 most providers will be prohibited from imposing switching charges. To manage financial risk, they may introduce proportionate early-termination penalties, but these must be clearly explained and transparently calculated to avoid disputes.

Looking ahead, the post encourages providers to review and adapt their business models to remain both compliant and commercially sustainable. This may involve updating contractual terms, reassessing fixed-term subscription structures, and preparing internal processes that support smoother customer switching…

CONTINUE READING…