### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission. ### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation should be brought forward to address sector-specific needs and objectives , such as for vehicles and access to in-vehicle data and functions and resources thereof. such sectoral legislation should address sectoral complexities where a small number of manufacturers deploys components from a large number of suppliers who would benefit from access to data generated by their components for quality monitoring , product development , or improving safety or sustainability aspects. provisions of sectoral legislation should prevail over this regulation. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. their confidentiality should be preserved through contractual solutions , such as confidentiality agreements and licensing schemes. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. consequently , when providing access to data to users or third-parties , data holders should be able to use technical or organizational measures such as strict access protocols , non-disclosure agreements or any other similar measure meant to ensure the preservation of the secrecy of data considered as trade secrets.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood to be based on the innovation principle and shall facilitate the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , the data holder should not abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. the data holder should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the third party or its assets or production methods or the use in any other way that could undermine the commercial position of the third party on the markets it is active on. ### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , no part should abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. concerned parties should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of another party or its assets or production methods or the use in any other way that could undermine the commercial position of another party on the markets it is active on.


### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , the data holder should not abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. the data holder should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the third party or its assets or production methods or the use in any other way that could undermine the commercial position of the third party on the markets it is active on. ### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , neither the data holder nor the third party should abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. both parties should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the other party or its assets or production methods or the use in any other way that could undermine the commercial position of the other party on the markets it is active on.


### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , the data holder should not abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. the data holder should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the third party or its assets or production methods or the use in any other way that could undermine the commercial position of the third party on the markets it is active on. ### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , the data holder nor the third party should not abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. neither the data holder nor the third party should therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the data holder and third party or its assets or production methods or the use in any other way that could undermine the commercial position of the data holder or third party on the markets it is active on. data intermediation services [as regulated by regulation (eu) 2022/868] may support users or third parties in establishing a commercial relation for any lawful purpose on the basis of data of products in scope of this regulation e.g. by acting on behalf of a user. they could play an instrumental role in aggregating access to data from a large number of individual users so that big data analyses or machine learning can be facilitated , as long as such users remain in full control on whether to contribute their data to such aggregation and the commercial terms under which their data will be used.


### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party. ### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user , unless union or member state law requires disclosure in the name of public access to official documents. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party.


### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec. ### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties are not allowed to rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the regulation (eu) 2022/1925 on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation means that they cannot receive data from the users and from third parties , but it should not prevent these companies from obtaining data through other lawful means , notably , through contractual agreements with manufacturers allowing that data from products they manufacture can be used by a gatekeeper company service , including when desired by a user of such products. the limitation on granting access to gatekeepers would not exclude them from the market and prevent them from offering its services , as voluntary agreements between them and the data holders remain unaffected.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) this regulation shall not prevent micro , small and medium enterprises to participate in the data practices , but given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. in order to increase and encourage micro , small and medium enterprises in the data economy member states shall provide guidance to such enterprises.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) this regulation does not prevent micro and small enterprises to participate in the data sharing practices , however given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. where a micro or small enterprise is sub-contracted to manufacture or design a product the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. in order to increase the participation of micro and small enterprises in the data economy member states should provide guidance to such enterprises.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. in order to increase the participation of micro and small enterprises in the data economy , member states should ensure that digital training and guidance is available to such enterprises.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. in order to increase the participation of micro and small enterprises in the data economy , member states should provide digital training and guidance to such enterprises.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) this regulation does not prevent micro and small enterprises to participate in the data sharing practices , however given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. in order to increase the participation of micro and small enterprises in the data economy , member states should ensure that digital guidance and training is available to those enterprises.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) this regulation does not prevent micro and small enterprises to participate in the data sharing practices , however given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. in order to increase the participation of micro and small enterprises in the data economy , member states should provide digital training and guidance to such enterprises.


### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available or different compensation , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679. ### (41) any agreement concluded in business-to-business relations for making the data available should not discriminate between comparable categories of data recipients , independently whether they are large companies or micro , small or medium-sized enterprises. in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available or different compensation , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679.


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises and of research organisations using the data on a not-for-profit basis or in the context of a public-interest mission recognised in the union or national law , for the costs incurred and investment required for making the data available.


### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. ### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. the same regime should apply to those research organisations that use the data on a not-for-profit basis or in the context of a public-interest mission recognised in the union or national law.


### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when they have been unilaterally imposed on them. ### (51) where one party is in a stronger bargaining position , there is a risk that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances can in particular harm enterprises that , due to their comparatively smaller size , may not have a meaningful ability to negotiate the conditions for access to data and , therefore , may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , in those cases where such imbalances of negotiation power are present , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on those enterprises when they have been unilaterally imposed on them.


### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. ### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed in situations where an imbalance of negotiation power exists between the contracting parties. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the other cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the other or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed.


### (69) the ability for customers of data processing services , including cloud and edge services , to switch from one data processing service to another , while maintaining a minimum functionality of service , is a key condition for a more competitive market with lower entry barriers for new service providers. ### (69) the ability for customers of data processing services , including cloud and edge services , to switch from one data processing service to another , while maintaining a minimum functionality of service , or to use the services of several providers simultaneously without undue data transfer costs , is a key condition for a more competitive market with lower entry barriers for new service providers , and for ensuring further resilience for the users of these services. guarantees for effective switching should be especially reinforced for customers benefiting from large-scale free-tier offerings , so that does not result in a lock-in situation for customers.


### (71) data processing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the service provider could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the data processing service provider , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset. ### (71) data processing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the service provider could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the data processing service provider , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset. however , in order to avoid imposing overly broad obligations , a service should not be considered data processing service where enabling on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources of a centralised , distributed or highly distributed nature is merely a minor and purely ancillary feature of another service. for example , this should not apply to online platforms within the meaning of the digital services act where data storing is merely a minor and purely ancillary feature of another service such as social networks or online marketplaces


### (71) data processing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the service provider could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the data processing service provider , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset. ### (71) data processing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the deployment models of cloud computing should include private , community , public and hybrid cloud. the aforementioned service and deployment models shall be the same as the defined in international standards. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the service provider could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the data processing service provider , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset.


### (71) data processing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the service provider could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the data processing service provider , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset. ### (71) data processing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the service provider could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the data processing service provider , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset. however , in order to avoid imposing overly broad obligations , a service should not be considered data processing service where enabling on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources of a centralised , distributed or highly distributed nature is merely a minor and purely ancillary feature of another service. for example , this should not apply to online platforms within the meaning of the digital services act where data storing is merely a minor and purely ancillary feature of another service such as social networks or online marketplaces.


### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching. ### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence , in a way that does not compromise innovation and competitiveness of european organizations in the global economy. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. switching is an operation consisting of four main successive steps: i) termination of contract; ii) data extraction , i.e downloading data from a originating provider’s ecosystem; iii) transformation , when the data is structured in a way that matches the schema of the target location; iv) load of the data in a new destination location. obstacles of different natures may occur during the different steps of the switching process. cloud service providers and clients have different levels of responsibilities , depending on the steps of the process referred to. obstacles to switching are of different nature , depending on the step of the switching process it is referred to. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. services can only be expected to facilitate functional equivalence for the functionalities that both the originating and destination services offer. this regulation does not instate an obligation of facilitating functional equivalence for data processing services of the paas and/or saas service delivery model. metadata , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching.


### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching. ### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching.


### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching. ### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment in a way that does not compromise innovation and competitiveness of european organisations in the global economy. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers.


### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services. ### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability within the common european data spaces , which are purpose- or sector-specific or cross-sectoral interoperable frameworks of common standards and practices to share or jointly process data for , interalia , development of new products and services , scientific research or civil society initiatives. this regulation lays down certain essential requirements for interoperability. operators within the data spaces , which are entities facilitating or engaging in data sharing within the common european data spaces , including data holders , should comply with these requirements. compliance with these rules can occur by adhering to the requirements laid down , or by adapting to already existing standards via a presumption of conformity. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services. the european data innovation board should build on existing european and global initiatives for cross-sectoral interoperability of data. in particular , the european data innovation board should study the potential of the digital identity of objects framework as established by the regulation (eu)910/214 and systems for the identification of legal entities such as the gleif for that purpose.


### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest: ### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest , on facilitating switching between data processing services , on introducing safeguards against unlawful third party access to non-personal data , and on providing for the development of interoperability standards for data to be transferred and used.


### for the purposes of this regulation , the following definitions apply: ### for the purposes of this regulation , the definitions of regulation (eu) 2016/679 apply to terms used in both regulations.


### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; ### (1) ‘data’ means any digital representation , including in the form of sound , visual or audio-visual recording of acts , facts or information and any compilation of such acts , facts or information , in the form and format in which they are generated;


### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; ### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording , and any underlying digital descriptions , or so-called metadata , of those digital representations;


### (3) ‘related service’ means a digital service , including software , which is incorporated in or inter-connected with a product in such a way that its absence would prevent the product from performing one of its functions; ### (3) ‘related service’ means a digital service , including software , which is at the time of the purchase , rental or leasing agreement inter-connected with a product in such a way that its absence would prevent the product from performing one of its functions;


### (4) ‘virtual assistants’ means software that can process demands , tasks or questions including based on audio , written input , gestures or motions , and based on those demands , tasks or questions provides access their own and third party services or control their own and third party devices; ### (4) ‘virtual assistants’ means software that can process demands , tasks or questions including those based on audio , written input , gestures or motions , and based on those demands , tasks or questions provides access to other services or controls connected physical devices;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person , including a data subject , that owns , rents or leases a product or receives related services;


### maintaining functional equivalence of the service in the it-environment of the different provider or providers of data processing services covering the same service type , in accordance with article 26. ### deleted


### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements or commercial practices provided by the original provider. ### 2. the obligations in this chapter shall only apply to the original provider to the extent they are within its sphere of control , in particular only to the extent that the obstacles referred to in paragraph 1 that are related to the services , contractual agreements pre-commercial or commercial practices provided by the original provider.


### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements or commercial practices provided by the original provider. ### 2. paragraph 1 shall only apply to obstacles that are directly influenced by the services , contractual agreements or commercial practices provided by the original provider.


### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements or commercial practices provided by the original provider. ### 2. paragraph 1 shall only apply to obstacles that are directly influenced by the services , contractual agreements or commercial practices provided by the original provider and which impact the switching process significantly.


### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following: ### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out and made available to the customer in advance of that customer accepting terms and conditions of the service priori to signing up to the service of the provider. without prejudice to directive (eu) 2019/770 , the information to be provided to the customer and the terms and conditions of the service shall include at least the following:


### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following: ### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services or to an on-premise system shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following:


### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following: ### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out and made available to the customer in advance of that customer accepting terms and conditions of the service priori to signing up to the service of the provider. without prejudice to directive(eu) 2019/770 , the information to be provided to the customer and the terms and conditions of the service shall include at least the following:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , with the exception of data used by the provider to operate , maintain and improve the service or data and digital assets that would conflict with the cloud provider's or other customer's intellectual property rights in particular the establishment of a mandatory maximum transition period of 60 calendar days , during which the data processing service provider shall:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly by the customer or which is uniquely relate to that customers own usage of the service , to an on-premise system , in particular the establishment of a mandatory maximum transition period of 60 calendar days , during which the data processing service provider shall execute and provide clear information concerning:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , and in accordance with the contractual agreement in place , to switch to a cloud computing service offered by another provider of cloud computing services or to port all exportable data to an on-premise system , without undue delay , during which the provider of cloud computing services shall:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days or other contractually agreed time for transition , during which the data processing service provider shall:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets directly generated by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a cloud computing service offered by another provider of cloud computing services or to port all data , applications and digital assets generated directly by the customer to an on-premise system , without undue delay , during which the cloud computing services provider shall:


### (1) assist and , where technically feasible , complete the switching process; ### (1) reasonably assist and , where technically feasible , support the switching process , including assisting a third-party entity managing the switching process on behalf of the customer;


### (1) assist and , where technically feasible , complete the switching process; ### (1) assistance with the switching process that the provider can supply including , where technically feasible , complete the switching process from the provider’s side;


### (1) assist and , where technically feasible , complete the switching process; ### (1) assist the customer and third parties authorized by the customer in , and , where technically feasible , complete the switching , exporting or porting process;


### (1) assist and , where technically feasible , complete the switching process; ### (1) assistance with the switching process that the provider can supply including , where technically feasible , completion of the switching process from the provider’s side;


### (1) assist and , where technically feasible , complete the switching process; ### (1) assist and , facilitate the switching process;


### (2) ensure full continuity in the provision of the respective functions or services. ### (2) any risks to continuity in the provision of the respective functions or services from the provider’s side during the switching process and commitment to make every effort on provider’s side to ensure full continuity in the provision of the respective functions or services.


### (2) ensure full continuity in the provision of the respective functions or services. ### (2) ensure which is consistent with contractual agreements related to continuity in the provision of the respective functions or services.


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### an exhaustive specification of all data and application categories exportable during the switching process , including at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service , with the exception of data used by the provider to operate , maintain , or improve the service. providers shall not be required to disclose their own or third parties’ intellectual property , trade secrets or commercially sensitive information;


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### a detailed specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided that can be clearly assigned to the customer , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service;


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service;


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### a detailed specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service;


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### a detailed specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data that can be assigned to the customer;


### a minimum period for data retrieval of at least 30 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2. ### a period for data retrieval of 30 calendar days that may be amended by mutual agreement , starting after the termination of the transition period that was agreed between the customer and the provider of cloud computing services , in accordance with paragraph 1 , point (a).


### a minimum period for data retrieval of at least 30 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2. ### a minimum period for data retrieval of at least 45 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2. after the expiration of this period , the service provider shall permanently delete all data.


### a minimum period for data retrieval of at least 30 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2. ### a minimum period for data retrieval of at least 60 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2.


### the nature and volume of the data likely to be generated by the use of the product or related service; ### the type of data and estimated volume of the data likely to be generated by the use of the product or related service;


### the nature and volume of the data likely to be generated by the use of the product or related service; ### the nature of the data likely to be generated by the use of the product or related service;


### the nature and volume of the data likely to be generated by the use of the product or related service; ### the type of data and the estimated volume of the data likely to be generated by the use of the product or related service;


### whether the seller , renter or lessor is the data holder and , if not , the identity of the data holder , such as its trading name and the geographical address at which it is established; ### deleted