The entry into application of the EU Data Act on 12 September 2025 marks one of the most significant developments in European data regulation since the adoption of the General Data Protection Regulation (GDPR). While the GDPR established a comprehensive framework for the protection of personal data, the Data Act introduces a new legal regime designed to improve access to and use of data generated by connected products and related digital services.

For businesses operating in the European Union, the key challenge is not understanding each regulation in isolation, but determining how they interact in practice. Many organizations already have mature GDPR compliance frameworks, but the Data Act creates additional obligations that require them to share data with users and third parties. Where those datasets contain personal data, compliance with the Data Act must be reconciled with the GDPR.

This article explains the relationship between the Data Act and the GDPR in practical terms. It highlights the main legal issues and outlines the steps businesses should take to prepare.

What Is the Data Act?

The Data Act, Regulation (EU) 2023/2854, is part of the European Union’s broader strategy to build a single market for data. Its purpose is to ensure that users of connected products and related services can access the data they generate and, in certain circumstances, require that such data be shared with third parties.

The regulation is intended to rebalance the relationship between manufacturers, service providers and users. In many industries, companies that design connected products control large volumes of data generated through use of those products. The Data Act seeks to ensure that users are able to benefit from this data rather than being locked into a single ecosystem.

The regulation applies to both personal and non-personal data, which is one of the key differences from the GDPR.

Examples of products and services covered by the Data Act include smart watches, connected vehicles, industrial machinery, medical devices, smart home appliances, agricultural equipment and software applications that process the data generated by such products.

What Is the GDPR?

The GDPR governs the processing of personal data relating to identified or identifiable natural persons. Its objective is to protect privacy and ensure that personal data is processed lawfully, fairly and transparently.

The GDPR applies whenever data relates to an individual and a controller or processor carries out an operation such as collecting, storing, sharing or analyzing that data.

Unlike the Data Act, the GDPR does not grant a broad right of access to all data generated by products. It focuses solely on personal data and establishes rights such as access, rectification, erasure and portability.

The Relationship Between the Data Act and the GDPR

The Data Act expressly states that it is without prejudice to EU and national laws on personal data protection, privacy and confidentiality of communications. In practical terms, this means that the Data Act does not override the GDPR. If a company is required to provide data under the Data Act and the dataset contains personal data, the GDPR continues to apply in full.

This principle has several important consequences.

First, the Data Act does not create a new legal basis for processing personal data. A company cannot rely on the Data Act alone to justify collecting, disclosing or otherwise processing personal data.

Second, organizations must continue to comply with all GDPR principles, including purpose limitation, data minimization, storage limitation and security.

Third, where there is a conflict between the two regulations, the GDPR prevails in relation to personal data.

Why This Matters in Practice

Most data generated by connected products is not purely personal or purely non-personal. Instead, businesses often deal with mixed datasets.

A connected vehicle, for example, may generate information on speed, fuel consumption, component performance, geolocation and driver behavior. Some of this information clearly relates to an identifiable person and therefore qualifies as personal data. Other elements may be technical or operational in nature.

Where personal and non-personal data are inextricably linked, organizations should assume that the GDPR applies to the dataset as a whole unless the data can be effectively separated.

This means that compliance with the Data Act often requires a GDPR analysis before any disclosure can take place.

Practical Example: Smart Watch Data

A consumer uses a smart watch that collects heart rate, sleep patterns, exercise metrics and location information. The consumer wishes to transfer the data to a third-party health application.

Under the Data Act, the user may request access to the data generated by the device and ask the manufacturer to transmit the data to another provider.

Because the dataset contains information relating to an identifiable person, the GDPR applies.

In this scenario, the manufacturer must verify that the request is valid, ensure the transmission is secure and process the data in accordance with the GDPR. The Data Act creates the obligation to provide the data, but the GDPR determines how the transfer must be carried out.

Practical Example: Industrial Equipment

A manufacturing company leases connected machinery that generates data concerning temperature, output, wear and maintenance cycles. The company wants to share this data with an independent maintenance provider.

The Data Act allows the user to request access to the data and to require the data holder to share it with a third party.

If the dataset contains no personal data, the GDPR may not apply.

However, if the data includes operator IDs or logs that can identify employees, GDPR considerations arise. The data holder must assess whether a lawful basis exists for sharing those elements.

Key Roles Under the Data Act and the GDPR

The terminology used by the two regulations differs, but the concepts often overlap. Under the Data Act, the principal roles are the data holder, the user and the data recipient. Under the GDPR, the key roles are the controller and processor. In practice, a data holder will often act as a controller because it determines the purposes and means of processing personal data. A business user receiving data may also become a controller if it decides how the data will be used.

This distinction is important because the recipient of data under the Data Act may inherit independent GDPR obligations.

Data Portability: How the Data Act Expands Existing Rights

The GDPR grants individuals a right to data portability, but this right is limited to personal data provided by the data subject and processed on the basis of consent or contract. The Data Act significantly broadens this concept.

It applies to data generated through the use of connected products and related services, regardless of whether the data is personal or non-personal.

For businesses, this means that existing GDPR portability procedures will usually not be sufficient. Organizations may need entirely new technical and contractual frameworks to handle Data Act requests.

Trade Secrets and Confidential Information

One of the most common concerns raised by businesses is the protection of proprietary information. The Data Act recognizes that data may contain trade secrets and allows data holders to implement safeguards such as confidentiality agreements, access controls and contractual restrictions. However, trade secret protection is not an automatic ground for refusing access. A refusal is permitted only in exceptional circumstances where disclosure would likely cause serious economic harm and where protective measures are insufficient.

In practice, businesses should assume that most requests will need to be fulfilled, subject to appropriate safeguards.

Smart Contracts

The Data Act introduces specific requirements for smart contracts used to automate data sharing.

Where businesses use blockchain-based or automated systems to execute data-sharing arrangements, those systems must meet standards relating to security, integrity and the ability to terminate or interrupt execution where necessary. Although this aspect of the regulation may not affect all organizations, it is highly relevant to businesses deploying decentralized or automated contractual technologies.

Cloud Switching and Digital Assets

The Data Act also addresses switching between providers of data processing services, including cloud providers. Customers must be able to move digital assets such as applications, configuration files, metadata and access credentials to another provider more easily. Organizations that offer cloud or platform services should review their contractual and technical arrangements to ensure that customers can migrate without undue barriers.

Legal Basis for Processing Personal Data

A recurring misconception is that the Data Act itself authorizes disclosure of personal data. This is incorrect. Whenever personal data is involved, a valid legal basis under the GDPR remains necessary. The applicable legal basis will depend on the circumstances. In some cases, processing may be necessary for the performance of a contract. In others, consent or legitimate interests may be relevant. Where the user requesting the data is a business rather than the individual to whom the data relates, the requesting party may need to demonstrate that it has an independent lawful basis for processing the personal data.

What Businesses Should Do

Organizations should begin by identifying whether they fall within the scope of the Data Act. Businesses that manufacture connected products, provide related services, control access to product-generated data or offer cloud services are the most likely to be affected. The next step is to map the data generated by products and services. This exercise should identify what data is collected, whether it includes personal data, who controls it and with whom it may be shared.

Once the data landscape is understood, businesses should review the legal bases for processing any personal data contained in those datasets.

Policies and procedures should then be updated to address Data Act requests. Existing GDPR processes will rarely be sufficient because they are designed primarily for requests from individuals, not business-to-business data sharing.

Contracts with customers, partners and recipients should be revised to address data use restrictions, confidentiality obligations, trade secret protections and security measures.

Technical teams should ensure that systems can provide data in accessible formats, authenticate requesters, record disclosures and protect sensitive information.

Finally, legal, compliance, IT and customer support teams should be trained so that they understand how to manage requests consistently.

Common Pitfalls

Businesses preparing for the Data Act frequently make several mistakes. The first is assuming that the Data Act overrides the GDPR. In reality, the GDPR remains fully applicable whenever personal data is involved. The second is underestimating the complexity of mixed datasets. The third is relying too heavily on trade secret arguments to resist disclosure. The fourth is failing to update contracts and operational procedures.

The fifth is treating compliance as a purely legal issue rather than a multidisciplinary project involving legal, IT, security and commercial teams.

Enforcement and Business Risk

Failure to comply with the Data Act may result in regulatory investigations, disputes with customers and partners, and reputational damage. Where personal data is mishandled, GDPR enforcement risks also arise, including potentially significant administrative fines. For this reason, businesses should approach the Data Act as a strategic compliance project rather than a narrow contractual exercise.

Conclusion

The Data Act and the GDPR are complementary regulations that pursue different objectives. The GDPR protects individuals and their personal data. The Data Act promotes broader access to data generated by connected products and services. When those datasets contain personal data, organizations must apply both regimes simultaneously. The Data Act creates the obligation to make data available, while the GDPR determines the conditions under which personal data may be processed and shared.

Businesses that rely on connected products, IoT ecosystems, industrial data or cloud services should begin preparing well in advance.

Organizations that invest now in data mapping, contractual updates, technical controls and internal governance will be best positioned to comply with the new rules and to leverage data as a strategic asset.

Client Alert

EU Data Act Applies from 12 September 2025: Is Your Business Ready?

The EU Data Act introduces a new framework governing access to data generated by connected products and related services. It applies from 12 September 2025 and will affect manufacturers, software providers, cloud providers and businesses that rely on connected technologies.

The regulation grants users the right to access data generated by products they use and to request that such data be shared with third parties.

Where the data includes personal data, the GDPR remains fully applicable.

For many organizations, the Data Act will require updates to contracts, technical systems and operational procedures.

Businesses should begin by identifying whether they control product-generated data, determining whether datasets include personal data, and assessing whether existing systems can support secure and compliant data sharing.

Organizations should also review trade secret protections and update agreements with customers and business partners.

Companies that prepare early will be better positioned to meet legal obligations and capitalize on new opportunities arising from increased data portability.

Data Act Implementation Checklist

An effective implementation project should begin with a governance assessment to determine which internal teams will be responsible for legal analysis, technical implementation and operational oversight.

The organization should then conduct a comprehensive data mapping exercise covering all connected products, related services and cloud environments. This exercise should distinguish between personal data, non-personal data and mixed datasets.

A legal review should be undertaken to confirm the GDPR legal bases for processing personal data and to identify any restrictions arising from confidentiality obligations or trade secret protections.

Customer terms, data-sharing agreements, cloud contracts and internal policies should be revised to reflect Data Act requirements.

Technical teams should ensure that systems are capable of exporting data in usable formats, authenticating requesters, logging disclosures and protecting confidential information.

Operational procedures should be established for receiving, reviewing and responding to requests.

Training should be delivered to legal, compliance, IT, security and customer-facing teams.

The EU Data Act Meets the GDPR: What Businesses Need to Know

With the EU Data Act becoming applicable from 12 September 2025, we’re entering a new era of data regulation in Europe — one that doesn’t replace the GDPR, but fundamentally reshapes how it operates in practice.

For many organizations, the challenge is no longer GDPR vs. Data Act, but how both frameworks work together when data is shared, accessed, and reused.

The key reality?
Most data generated by connected products is mixed — personal and non-personal at the same time. And that changes everything.

Key takeaway:

The Data Act creates obligations to share data, but the GDPR still governs how personal data can be processed and transferred. The Data Act never overrides GDPR requirements.

What this means in practice:

• No new legal basis for processing personal data under the Data Act
• GDPR principles (minimization, purpose limitation, security) still fully apply
• Trade secrets don’t automatically block access requests
• Data portability rights are significantly expanded beyond GDPR scope
• Cloud and IoT ecosystems will need major technical and contractual updates

The real challenge for businesses

Compliance is no longer just legal — it’s operational and technical.

Organizations will need to:
Map all product-generated data
Identify where personal data is involved
Update contracts and data-sharing frameworks
Build secure, auditable data access systems
Align legal, IT, and compliance teams

Bottom line:

The Data Act doesn’t replace the GDPR — it adds a new layer of complexity on top of it. Companies that prepare early will not only reduce compliance risk but also gain a competitive advantage in the emerging EU data economy.

Artykuł Interplay Between the Data Act and the GDPR: A Practical Guide for Businesses pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

An unauthorized transaction is a financial transaction made without the consent of the account or cardholder, for example, as a result of data theft. In such a situation, the bank is obligated to return the funds unless it can prove the customer’s intentional act or gross negligence.

Currently, there is a noticeable increase in unauthorized transactions. This causes payers and banks to lose nearly a billion złoty annually. The Polish Financial Ombudsman is noticing a growing number of requests for intervention regarding unauthorized payment transactions. In the first half of 2020 alone, it received 416 requests. This is more than in all of 2018, when there were 367. In 2019, there were 612 requests, an increase of almost 60%. It is worth noting that in the first half of 2020, requests regarding unauthorized transactions accounted for 80% of all requests related to violations of the Payment Services Act.

Legal definition

The Payment Services Act [1] (which has been harmonized with EU law[2]) lacks a definition of an unauthorized transaction, but it can be derived from Article 40(1) of the Act. A payment transaction is considered authorized if the payer has consented to executing the payment transaction in the manner provided for in the contract between the payer and their payment service provider. Consent may also apply to subsequent payment transactions. In simple terms, an unauthorized payment transaction is one to which the payer has not consented, i.e., has not authorized it. Authorization should be distinguished from authentication, i.e., a technical act involving the provision of payer data, use of an appropriate financial token, etc. An authenticated transaction may remain unauthorized due to the use of various manipulation and social engineering techniques, such as phishing.

Bank account agreement

Pursuant to Article 725 of the Civil Code, through a bank account agreement, the bank undertakes to the account holder, for a specified or unspecified period, to hold their funds and, if the agreement so provides, to conduct monetary settlements on their behalf. The bank is therefore the owner of the funds and should ensure their security.

• the funds become the property of the bank
• the account holder’s entitlement constitutes a claim against the bank, and its size is indicated by the account balance.

Possibility of receiving a refund

It is possible to obtain a refund from a bank in the event of an unauthorized transaction. The Payment Services Act, in this case, assumes a shift in the burden of proof from the customer to the bank (reversed burden of proof). Article 45, paragraph 1 of the Act states that the user’s provider bears the burden of proving that the payment transaction was authorized and correctly recorded in the provider’s payment transaction processing system and that it was not affected by a technical failure or other defect related to the payment service provided by that provider, including the provider providing the payment transaction initiation service.

Under the Act, the bank is obligated to respond to a complaint within 15 days (and exceptionally within 35 days in particularly complex cases). If the response deadline is extended, the bank must inform the client within 15 days of the extension and the basis for it. Communication is in writing, but with the client’s consent, electronic contact is also possible. If the complaint is upheld, the refund must be made immediately, within one business day of notification to the bank. If the bank disagrees with the client, it must notify law enforcement authorities and may then waive the refund. The payer will be required to return the funds once the bank proves that the client:

• himself made the transaction in order to defraud the bank or
• has intentionally or through gross negligence violated the user’s obligations.

The user’s obligations are as follows:

• immediately report theft of funds or unauthorized third-party access to the account,
• using the account in accordance with the contractual terms,
• storing individual authentication data with due diligence (in particular not making them available to unauthorized persons).

Accidental transfer and unauthorized transaction

Unauthorized transactions should be distinguished from erroneous transfers. In the case of a transfer, the payer intends to complete the transaction (authorizes) and confirms login details (authenticates), but due to an error, the funds are transferred to the wrong recipient’s bank account. The customer should immediately notify the bank of the error. The bank will contact the recipient of the erroneous transfer within three days, informing them of the consequences of failing to refund within 30 business days. The bank will provide the recipient with a technical account to eliminate the risk of data leaks. The payer receives the refund from the technical account. The recipient remains anonymous and cannot be charged any fees. The bank may, however, pass on the costs of the refund to the payer. If the recipient of the transfer does not transfer the funds to the technical account within 30 days, the bank will share the recipient’s data with the payer, who will then be able to pursue civil claims.

Exceptions to the return obligation

Pursuant to Article 46 of the Payment Services Act: “the payer is liable for unauthorized payment transactions up to (…) the equivalent of EUR 50 (…) if the unauthorized transaction is a result of: using a payment instrument lost by the payer or stolen from the payer, or misappropriation of a payment instrument. The above provision cannot be applied in the event that:

• the payer had no possibility of detecting the theft of the payment instrument before executing the payment transaction, except in the case of intentional action by the payer, or
• the loss of the payment instrument before the execution of the payment transaction was caused by an act or omission on the part of an employee of the bank’s supplier.

[1]Act of 19 August 2011 on payment services (consolidated text: Journal of Laws of 2025, item 611, as amended).

[2]Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC, 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ EU L 337, 2015, No. 337, p. 35, as amended)

Unauthorized transactions are becoming an increasingly serious challenge for both customers and financial institutions. Banks are generally required to refund stolen funds unless they can prove intentional misconduct or gross negligence by the customer. It is also important to distinguish unauthorized transactions from accidental transfers, where the payer willingly authorizes the payment but sends it to the wrong account. Growing cyber threats and phishing attacks highlight the importance of financial awareness, data protection, and rapid response to suspicious activity.

UnauthorizedTransactions #CyberSecurity #BankingSecurity #FinancialSafety #FraudPrevention #DigitalBanking #PaymentSecurity #PhishingAwareness #FinancialEducation #RiskManagement #ConsumerProtection #CyberFraud #FinTech #DataProtection #OnlineSecurity

Artykuł Unauthorized Transactions and Consumer Protection in Modern Banking pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

According to an analysis by lawyers from KG LEGAL KIELTYKA GLADKOWSKI, legal concepts such as incident and cyberattack are key elements in the EU cybersecurity and data protection law ecosystem. The fragmentation of cybersecurity law into various sectoral legal acts necessitates a comprehensive analysis of the coherence of all the legal acts comprising this ecosystem. This article demonstrates that the legal layer of cybersecurity in an incident is a highly sensitive issue from the perspective of the responsibility to protect, and therefore, responsible entities should examine the differences in the legal scope of application of individual acts. These concepts are intuitively understood but in legal practice are only superficially identical and lead to different regulatory obligations. The following summary is original and creative and can be used by entities to properly analyze their obligations under current EU law.

INCIDENT vs. CYBERATTACK

Artykuł INCIDENT vs. CYBERATTACK – based on current EU provisions pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On September 12-14, 2025, lawyers from KIELTYKA GLADKOWSKI KG LEGAL participated in the annual Futurology Congress in Krakow.

The participants, among which there was AGH University of Science and Technology’s Artificial Intelligence Center of Excellence discussed aspects of new technologies, including:

• Optical Illusions in AI Systems: The Danger of Adversarial Attacks. Adversarial attacks on vision systems are a topic of growing interest in both science and the technology industry – not only due to autonomous vehicles but also medical systems. The panelists demonstrated how subtle, almost invisible image modifications can completely confuse AI algorithms, leading to situations where the algorithm fails to recognize a STOP road sign or makes an error when analyzing medical images. Examples of such attacks from both transportation and medicine were presented, highlighting their impact on everyday life and safety. There were explained the mechanisms behind these phenomena and their consequences for machine learning-based systems. In this area, there is a constant race between the creators of such attacks and the engineers developing protection methods, and ensuring complete security remains a major challenge for the AI industry.

• The development of the Polish space sector, combining engineering, science, and modern technologies. Domestic entities are among the leaders building Poland’s position in the global space industry supply chain. During the panel, there were discussed the most important achievements and participation of Polish teams in prestigious international missions. Representatives of key companies discussed their projects, challenges, and role in the global space ecosystem. There were also considered barriers to sector development and legislative and financial needs. The panel was an opportunity to look to the future and attempt to answer the question of Poland’s potential role in the exploration and use of space. Participants shared their experiences collaborating with the European Space Agency and other international partners.

• Modern biotechnology. Biotechnology is becoming one of the pillars of modern civilization, offering breakthrough solutions in medicine, diagnostics, agriculture, and environmental protection. Faced with global challenges such as aging societies, the growing number of lifestyle diseases, and the need for sustainable development, the dynamic development of biotechnology is opening up new opportunities to improve the quality of life. The panel discussed the potential of gene and cell therapies, the importance of innovative drugs in the fight against cancer, and the role of collaboration between science, the investment sector, and industry. Guests addressed ethical, regulatory, and social issues related to the implementation of new biological technologies. The discussion explored how biotechnology can truly benefit humanity in the coming decades.

The Congress lectures are related to specific examples and problems that scientists are struggling with in daily lives – for example, how to easily delude artificial intelligence in software in an unmanned vehicle resulting in a failure to recognize a STOP sign

source: https://www.drmalinowski.edu.pl/posts/2824-adwersarialne-ataki-na-sztuczna-inteligencje

Artykuł Optical Illusions in AI Systems, the Danger of Adversarial Attacks, Biological Technologies, Explainable AI – topics discussed during Futurology Congress 2025 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On 10 June 2021 KIELTYKA GLADKOWSKI will participate in the training “Digital transformation of the law firm” organised by The New Technologies Committee of the Polish Bar. The training will discuss new technologies used in legal services, technologies as a factor in changing the model of legal services, the application of artificial intelligence in legal tech as well as practical implementation of technologies in law firms.

KIELTYKA GLADKOWSKI has broad experience in legal tech sector, including technologies in document analysis, data set analysis, AI in analyses of case law and legal doctrine, Document Creation Automation, Process Automation, Data Security and Risk Analysis, cybersecurity, compliance, data, document and collaboration platforms, Online Dispute Resolution, Smart contracts, custom legal tech tool development, debt collection and document management.

Artykuł KIELTYKA GLADKOWSKI PARTICIPATES IN THE TRAINING DIGITAL TRANSFORMATION OF THE LAW FIRM ORGANISED BY THE POLISH ATTORNEY BAR – 10 JUNE 2021 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.