The EU Data Act is one of the most consequential pieces of technology regulation Europe has passed since the GDPR, and it has a deadline that matters right now. From 12 September 2026, connected products placed on the EU market must be built so that the data they generate is accessible to the people who use them. For anyone who works with location data, that is not a distant legal abstraction. Position data is exactly the kind of machine-generated data the Act is about.
This piece explains what the Data Act is, how it differs from the GDPR, why location data sits at the center of it, and what it means if you build products with a maps or location API.
What the Data Act Actually Regulates
The Data Act, formally Regulation (EU) 2023/2854, answers a simple question that the GDPR does not: who gets to use the data a connected product creates? For years the answer was, in practice, the manufacturer. A machine, a vehicle, or a sensor would generate large volumes of data, and that data flowed back to whoever built the device, often with no straightforward way for the user to get at it.
The Data Act changes the default. The user of a connected product, the person or business that bought or leased it, has a right to access the data it generates and to share that data with a third party of their choosing. The manufacturer can no longer treat that data as an exclusive asset. The law also introduces rules on fair contract terms for data sharing, safeguards against unfair clauses imposed on smaller businesses, and obligations that make it easier to switch between cloud providers.
Crucially, the Act covers both personal and non-personal data. That is the part people miss. The GDPR only reaches data about identifiable people. The Data Act reaches the whole stream a device produces, whether or not any individual is identifiable in it.
Data Act and GDPR: Two Laws, One Data Stream
The most common confusion is that the Data Act somehow replaces or dilutes the GDPR. It does neither. The two are designed to work together, and they govern different things.
The GDPR governs personal data: it sets the conditions under which you may collect, process, and share information about identifiable people. The Data Act governs access to and portability of machine-generated data: it obliges manufacturers to open up the data their products create and lets users move it elsewhere.
Where they meet, both apply. Consider a location trace from a connected vehicle. It is machine-generated, so the Data Act's access and portability rules apply. It also identifies a driver's movements, so it is personal data, and the GDPR applies too. A Data Act sharing request never overrides the GDPR: you still need a lawful basis, you still owe the usual safeguards, and you still cannot hand personal data to a third party in a way the GDPR would forbid. The Data Act opens a door; the GDPR still decides who may walk through it.
Why Location Data Sits at the Center
Of all the data connected products generate, location data is among the most valuable and the most sensitive, which is precisely why it is a defining test case for the Act.
Connected vehicles, fleet trackers, delivery hardware, agricultural machinery, and countless IoT sensors produce a continuous stream of position data. Under the Data Act, the user of that product has a right to reach that stream and to port it to a service they prefer. A logistics company running someone else's telematics hardware can ask for its own movement data in a usable form. A farmer can take machine data to an independent analytics tool. A driver can move their trip history.
For the teams that build these products, three duties move from optional to structural:
- Access by default. From September 2026, a new connected product must be designed so the data it generates is reachable without a bespoke, obstructive process.
- Portability. Users can take their data elsewhere, which means it has to leave in a form another system can actually ingest.
- Interoperability. Data that cannot be understood downstream is not really portable, so open formats and stable references matter.
None of this is satisfied by a proprietary export that only your own tools can read. Portability that depends on your lock-in is not portability.
Designing a Product for the Data Act's Duties
The Act's three duties, access, portability, and interoperability, translate into concrete engineering choices. Get them right while you build and the obligation costs you almost nothing; retrofit them after a user files a request and it costs a great deal.
Build the access path before anyone asks. From September 2026 a new connected product must expose its generated data by default, not through a support ticket and a fortnight's wait. The cheapest time to design a clean, documented endpoint that returns a user their own data is while you are building the feature, not after the right is exercised.
Make the export genuinely portable. Portability that only your own tools can read is not portability. Data that leaves your system as GeoJSON, a documented open standard, satisfies the interoperability duty by construction; a proprietary blob is a complaint waiting to be filed. Open formats are the cheapest insurance the Act offers.
Avoid lock-in on identifiers and geocodes. When you turn an address into coordinates or attach an ID to a place, prefer references another system can resolve, so a user porting their data to a competitor does not arrive with unusable keys. See What Is a Geocode for why the coordinate layer matters here.
One thing the Act does not settle is which jurisdiction's law governs the data in the first place. That is a related but separate question, data sovereignty, and it is worth deciding deliberately rather than by accident of where your API happens to run. We cover it in Data Sovereignty and Location Data.
How MapAtlas Fits the Data Act
The Data Act rewards open, portable, unlocked data, and that is how MapAtlas returns results by default. Our Geocoding API and Search API hand back coordinates and places in documented open formats rather than a proprietary container, so the export you owe your users under the Act is something you already have rather than something you have to reverse-engineer later.
None of that makes compliance automatic. The Data Act is satisfied by how you design your product, write your contracts, and govern your data, not by any single vendor. What the right infrastructure does is remove the retrofit: if your location layer is already open and portable, the Act's hardest duties are met at the source.
For the building blocks, What Is Reverse Geocoding covers turning positions back into addresses, What Is GeoJSON explains the open format that makes the portability duty trivial, and our GDPR-compliant maps page shows how European processing works across the platform. The regulation is demanding, but for once the compliant path and the well-engineered path are the same road.
Frequently Asked Questions
What is the EU Data Act?
The EU Data Act (Regulation (EU) 2023/2854) is a European law that governs who can access and use the data generated by connected products and related services. Its core idea is that the data a device produces, from a car, a sensor, a machine, or a wearable, should be accessible to the user who generated it, not locked away by the manufacturer. Most of its provisions have applied since 12 September 2025, and from 12 September 2026 newly placed connected products must be designed so that this data is accessible by default. It sits alongside the GDPR rather than replacing it: the GDPR governs personal data, while the Data Act governs access to and sharing of both personal and non-personal machine-generated data.
How is the EU Data Act different from the GDPR?
The GDPR is about protecting personal data: it restricts how you collect, process, and share information that identifies a person. The Data Act is about access to and portability of machine-generated data: it obliges manufacturers to make the data a connected product creates available to the user, and lets that user share it with third parties. Where the two overlap, for example a location trace that is both machine-generated and personal, both laws apply at once. The Data Act does not weaken the GDPR; a data-sharing request under the Data Act still has to respect GDPR lawful bases and safeguards.
What does the EU Data Act mean for location data?
Location data is one of the clearest examples of machine-generated data covered by the Act. A connected vehicle, a fleet tracker, a delivery device, or an IoT sensor continuously produces position data, and under the Data Act the user of that product has a right to access it and to port it to a service of their choice. For anyone building location features, the practical consequence is that data portability and interoperability stop being nice-to-haves and become design requirements. If a location trace is tied to a person it is also personal data, so GDPR still applies on top.
When does the EU Data Act take effect?
The Data Act entered into force in January 2024 and became applicable on 12 September 2025. A key further milestone falls on 12 September 2026: connected products and related services placed on the EU market from that date must be designed so that the data they generate is, by default, easily, securely, and where relevant directly accessible to the user. Cloud-switching and interoperability obligations phase in around the same period. Enforcement is handled by competent authorities designated by each member state, so exact penalties vary by country.
How can mapping APIs support compliance with regional regulations like the Data Act?
A maps or location API cannot make you compliant on its own, because compliance depends on your product design, contracts, and data governance. What the right provider does is remove friction: an API that processes location queries inside the EU, exposes data in open, portable formats like GeoJSON, and avoids locking you into proprietary identifiers makes the access, portability, and interoperability duties of the Data Act far easier to satisfy, and it eases neighbouring regional regulations like the GDPR at the same time. MapAtlas processes location data inside the EU by default and returns results in open formats, which keeps the compliance surface small.
