EU Data Act

EU Regulation on fair access to and use of data - IoT data sharing, cloud switching, B2B/B2G.


Short name	Data Act
Region	Europe
Country or scope	European Union
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Data Act

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for Data Act.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for Data Act and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-DA-3` Access by Design Documentation	Connected products and related services must be designed so that data is accessible to users, which presupposes the maker can name the system and enumerate the software components handling that data (Regulation (EU) 2023/2854 Chapter II, Art. 3 access-by-design obligation)	Scan
`EU-DA-SWITCH` Cloud Switching Completeness	Providers of data processing services must remove obstacles to switching and ensure exportable data and digital assets are fully described, which requires component records complete with both name and version (Regulation (EU) 2023/2854 Chapter VI switching provisions)	Scan
`EU-DA-INTEROP` Interoperability Essential Requirements	Participants in data spaces and data processing services must meet essential interoperability requirements including openly documented, machine-readable structures and formats (Regulation (EU) 2023/2854 interoperability provisions, Chapter VIII)	Scan
`EU-DA-INTL` Safeguards Against Unlawful Access	Providers must take reasonable technical measures to prevent unlawful third-country governmental access to non-personal data, including assurance of the integrity of the software stack holding that data (Regulation (EU) 2023/2854 international access safeguards, Chapter VII)	Scan
`EU-DA-SC` Smart Contract Robustness	Smart contracts used for executing data sharing agreements must meet essential requirements for robustness and access control, which excludes building on vaguely versioned or unpinned components (Regulation (EU) 2023/2854 smart-contract essential requirements)	Scan
`EU-DA-HOLDER` Data Holder Accountability	Data holders making data available under the regulation must be identifiable and accountable for the systems that serve it, requiring the creator or operating organisation of technical records to be documented (Regulation (EU) 2023/2854 data-holder obligations, Chapter II)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DA-Art3`	Right of Access to Product Data
`DA-Art4`	Obligations of Data Holders to Users
`DA-Art5`	Obligations When Making Data Available to Third Parties
`DA-Art13`	Cloud Switching
`DA-Art23`	Business-to-Government Data Sharing
`DA-DataContracts`	Contractual Protections for SMEs
`DA-InteroperabilityStandards`	Interoperability Standards for Data Spaces

Policy templates

Written for Data Act:

EU Data Act Cloud Switching Policy

And 22 from the standard set, adapted to Data Act.