Data Act: what changes for your SaaS contract starting September 2025

Starting from September 12, 2025, a new era begins for users of SaaS software, and particularly of professional CRMs. The European Data Act (Regulation EU 2023/2854) comes fully into effect. This text, adopted by the European Parliament and the Council of the European Union, aims to restore control of data to those who generate it: companies and their users.

Concretely, the Data Act imposes new rules on software publishers: customers will be able to terminate their SaaS contract at any time, retrieve all of their data, and switch providers without technical blockages or unfair fees.

In other words: binding lock-in contracts of two or three years are a thing of the past.

For companies using a CRM, an ERP, or a commercial management SaaS solution, this is a major turning point. You are no longer dependent on a publisher who locks up your data or limits your freedom of choice. You regain control of your tools and your digital strategy.

In this article, we will first explain what the Data Act entails, who is affected, and why it is transforming the SaaS market. We will then see what this changes concretely for you, as a company using or purchasing a CRM or a SaaS service, and how to take advantage of it starting now.

Who is affected by the Data Act?

The European Data Act aims to give more power and freedom to users of connected products and services, whether individuals or businesses. Today, data generated by connected objects is often controlled exclusively by the manufacturer or service publisher. The Data Act wants to reverse this logic: the data produced by a device or service belongs to the user, not the manufacturer or provider.

Therefore, since September 12, 2025:

• all affected companies must comply with the new rules (termination, portability, data sharing, contractual clauses, etc.);

• clients and users can assert their rights (access to their data, switching SaaS providers, etc.).

The Data Act does not target a single sector (such as health or energy), but rather all economic actors involved in the creation, collection, processing, or sharing of data.

It is a cross-sectoral regulation, meaning it applies to all areas of the digital economy.

Manufacturers of connected objects

→ Watches, cars, household appliances, industrial machines, sensors...

This means that any physical product that collects or generates digital data is affected.

Manufacturers must:

• design their products so that data can be shared (with the user or an authorized third party),

• guarantee clear, documented, and secure access to this data,

• not restrict the user's use of the data (except for legal reasons of confidentiality or security).

For example, a connected car must allow its owner to access driving or maintenance data, not just the manufacturer.

Providers of digital services linked to these objects

→ Applications, platforms, Cloud

This means that publishers of software, SaaS platforms, or cloud services that collect, host, or analyze data from these connected objects are also directly affected.

They must:

• respect the right to data portability,

• allow switching providers without technical blockages or unfair fees,

• ensure the security, confidentiality, and transparency of the processed data,

• specify in their contracts the conditions for accessing, using, exporting, or deleting data.

For example, a SaaS CRM publisher hosting a company's customer data, an IoT analytics platform collecting data from industrial sensors, or a cloud provider storing data generated by connected objects.

These actors must be technically capable of providing all data at the customer's request and ensuring its reversibility.

Companies using these products in their business

→ Manufacturers, transporters, you

This means that companies using these connected objects in their operations are also affected, as beneficiaries of new rights.

They now have the right to:

• access data produced by their own machines or devices,

• use it to improve their performance,

• share it with other partners or service providers,

• and switch providers without losing their data.

For example, a transporter using connected vehicles will be able to retrieve geolocation and fuel consumption data to optimize their routes, or a manufacturer can extract usage data from a connected machine, even if the manufacturer wanted to keep it for themselves.‍

And especially… any company that generates, processes, or shares data

→ In a B2B or B2C context via connected services or products

It is important to understand that the Data Act is not limited to the Internet of Things (IoT).

It applies to any economic activity in which digital data is collected, analyzed, stored, or exchanged between actors, whether in a business-to-business (B2B) or business-to-consumer (B2C) relationship.

‍In other words, a SaaS publisher, an e-commerce site, a marketing platform, or even an SME that collects and analyzes customer data are all affected by the Data Act.

For example:

• A CRM stores a company's customer data. It must allow the customer to export and transfer it elsewhere.

• An online invoicing tool processes financial data. It must guarantee its portability and confidentiality.

• An e-commerce site collects browsing or order data. It must be transparent about the use and reuse of this data.

The Data Act in brief: the new measures explained

We have covered the actors affected by the Data Act and what it implies for each of them. Let’s now move on to the concrete changes, presented measure by measure.

To know exactly what this changes for you as a business, you can also consult this LinkedIn feed dedicated to the Data Act.

Increasing legal certainty

What the text says: businesses and consumers who produce data (for example through connected objects, applications, or SaaS services) now benefit from clear rules on who can use this data, how, and under what conditions.

The idea is to avoid contractual gray areas and abuses, while ensuring that the companies collecting or hosting this data continue to invest in its quality and security.

The Data Act creates a framework of trust.

‍Before, each contract had to define from scratch who had the right to do what with the data. Now, the rights and duties of each party are harmonized at the European level. In other words, the data producer knows what they can share or not, the user knows what they can exploit, and the confidentiality rules are the same everywhere in the European Union.

In practice, this facilitates the sharing and flow of data between providers, partners, and customers, while ensuring the legal certainty of contracts. Publishers will also be able to rely on model contractual clauses drafted by the European Commission, to simplify their Terms of Service, for example.

Mitigating the abuse of contractual imbalances

What the text says: The Data Act wants to protect businesses against unfair clauses imposed by much more powerful players (large cloud providers, dominant publishers, essential platforms, etc.).

The Data Act aims to balance the contractual relationship. When you sign a contract with your SaaS provider, you will have a fairer negotiation framework and greater transparency. Publishers will no longer be able to unilaterally impose unfavorable exit, export, or data usage conditions.

Access and use of data by the public sector

What the text says: Public authorities (local governments, health organizations, civil protection authorities, etc.) will be able to access certain data held by the private sector, in situations of public interest or public emergency (natural disasters, health crises, etc.).

This strengthens public-private cooperation and responsiveness in the event of a crisis. However, the text clearly specifies that this access must remain proportionate and respect commercial confidentiality and personal data protection.

Switching from one provider to another (SaaS and cloud portability)

This is the famous measure against “vendor lock-in” (contractual customer lock-in).

What the text says: The Data Act creates a framework to allow customers to more easily switch data processing service providers (SaaS, cloud, PaaS, etc.).

Until now, changing CRM or cloud provider could be a headache: unfair multi-year contracts, incompatible data formats, high costs, lack of APIs, impossible export... From now on, SaaS providers must:

• offer standardized export formats,

• ensure service continuity during transition,

• and limit or eliminate exit fees.

For example, if you wish to change your SaaS CRM provider, you can now terminate at any time, with 30 days' notice. Your publisher is obliged to facilitate portability and document the export/migration processes.

You finally become the sole master of your data. We share this philosophy: at Sidely, our customers have always owned their data and have always been able to export it at any time.

Balance between data holders and users (and revision of database rights)

The Data Act reviews certain aspects of the sui generis database right (Directive 96/9/EC). The objective is to clarify in which cases a database producer can prohibit or allow the reuse of data, especially when it comes from the Internet of Things (IoT).

What the text says: Some companies relied on the "database right" to block access to or reuse of data they hosted, even if that data came from a user or a connected device belonging to a customer. The Data Act corrects this imbalance.

This means that if you use a connected device, a SaaS application, or a platform that collects data, you must be able to retrieve and use that data. Publishers can no longer hide behind database rights to deny you access.

Concretely, what does this change for you?

You regain control

Until now, many companies signed SaaS contracts with long-term commitments, often 24 or 36 months, with no real possibility of early exit. In case of dissatisfaction or a change in strategy, it was common to get "stuck": the publisher held your data, formats were closed, and migration fees were prohibitive.

The Data Act puts an end to this situation: “The customer may at any time terminate their data processing service contract, subject to reasonable notice, without disproportionate fees or technical obstacles.” (Article 23 of Regulation UE 2023/2854)

You can terminate your contract whenever you want

From September 2025, any SaaS customer will be able to end their contract at any time, simply by giving reasonable notice.

In practice, most providers will align this period with 30 days.

This means:

• no more obligation to wait for the end of a 2 or 3-year contract;

• possibility to switch solutions if it no longer meets your needs;

• more flexibility in budget management and tool planning.

If you currently use a field CRM with a 36-month commitment. You want to switch to a more mobile tool or one better suited to your sales force: you can terminate with a simple 1-month notice, request the return of your data, and migrate to a new provider.

Fortunately, at Sidely, we can migrate your data quickly!

Your data belongs to you, completely

The Data Act reaffirms a fundamental principle: the data generated by the use of a service belongs to you. The SaaS publisher is no longer the owner of the information you input.

This gives you:

• a permanent right of access to your data,

• a right to export in a structured and commonly used format,

• and the ability to transfer it to another service or store it elsewhere, without loss of quality or restriction of use.

Closed or undocumented formats will no longer be tolerated.

For example, a CRM must allow you to extract all your customers, opportunities, visits, history, reports, and configurations in a readable format (CSV, JSON, XML...) usable by another system.

You can switch providers freely

The Data Act establishes a clear right: you are free to switch SaaS providers at any time, without technical blockages or unfair fees.

Publishers must guarantee:

• technical compatibility (interoperability) between services;

• documentation allowing a third party to integrate or import the data;

• transparency regarding transfer times and modalities.

This portability applies equally between competing providers and between different cloud environments.

You will thus be able to migrate from an American platform to a European provider without major technical obstacles, which also strengthens your digital sovereignty.

The text clearly aims to eliminate customer lock-in ("vendor lock-in") and promote fair competition among SaaS publishers.

You keep access to your service during transition

The regulation handles that the provider must maintain access to the service until the end of the notice period or until the data migration is complete.

This provision protects companies against sudden service interruptions. You remain operational while your data is being transferred.

In a CRM, this means: your sales reps can continue to work, enter their visit reports, and access their history while the technical switch takes place in the background.

You no longer pay to retrieve your data

Until now, some providers charged "data recovery fees" or "account deactivation fees" that could reach several hundred euros.

The Data Act strictly regulates these practices:

• until January 2027, only the actual and justified technical cost can be charged;

• from that date onwards, all exit fees are prohibited.

You will therefore no longer pay to retrieve what already belongs to you.

At Sidely, exporting your data is already free and unrestricted.

What happens if you have a hybrid CRM provider?

A hybrid CRM provider typically combines:

• a local installation (on-premise): the software runs on the client's servers or computers,

• complementary cloud services: synchronization, backup, hosting of secondary databases, mobile applications, automatic updates, APIs, report storage, etc.

A typical example is a CRM installed on your internal servers, but which synchronizes sales data with a mobile application hosted by the publisher.

In this case, the Data Act applies only to the Cloud / SaaS part of the service. This means that your provider must allow the full export of data stored in the cloud portion, guarantee portability to another provider, eliminate unfair exit fees, and maintain service access during the migration period. If we take our example, your customer database is hosted locally, but your reports, business cards, and mobile data are synchronized on the provider's cloud. You can request to export all data from the hosted part (reports, cards, mobile data) in an open format and transfer it to another cloud provider.

However, you won't be able to do this for the local database. Indeed, the Data Act does not apply directly to what is hosted exclusively in your internal infrastructure, since you already control this data. Still, the provider must guarantee that the data can be exported in an open format, not impose technical lock-in (proprietary format making export impossible), and clearly inform the customer about the distinction between local and cloud elements.

So, if you find that your proprietary database has no export option on your local application, you are within your rights to ask your publisher for a technical migration solution, otherwise they would be in contradiction with the spirit of the Data Act.

Am I affected by the end of commitment contracts?

The Data Act now prohibits contractual lock-in for data processing services in the cloud. Providers can no longer restrict access to your hosted data, nor prevent its transfer to another provider, nor charge unduly for these operations.

On the other hand, for hybrid solutions, the application is more nuanced. If your contract covers a software license installed locally (on-premise), the regulations do not apply directly to the license, as it does not fall under data processing within the meaning of the text. However, as soon as part of the service relies on the cloud (synchronization, backup, remote support...) then the Data Act applies. In other words, a provider can neither restrict your access to your own data, nor condition its transfer on unfair fees, once it is hosted remotely. Even if your solution is partially local, these obligations apply to the cloud portion. However, for the purely local part (installed on your servers), there may be a maintenance or license commitment, but the provider can no longer use it to lock down the data itself.

But what about purely on-premise software? If you use a solution installed exclusively on your servers, the Data Act does not apply. The local software license does not fall within the scope of "data processing services". You therefore do not benefit, in this case, from the new rights regarding portability, termination, or the prohibition of fees.

What you can do as a customer

As a customer company of a hybrid solution, you must:

1. Identify the boundary between what is hosted locally and what is in the cloud.

2. Check the contract clauses: which data belongs to whom? what are the export terms? what formats are provided?

3. Demand a complete portability clause on the entire cloud portion.

4. Request open formats on the on-premise portion to facilitate any future transfer.

5. Negotiate starting now the absence of exit fees on hosted services.

How to take advantage of it starting now?

Check your current contracts

Begin by reviewing your existing SaaS or CRM contracts:

• What is the commitment duration?

• Is there an early termination clause?

• Are the data export modalities specified?

• Are exit fees defined?

If these elements are unclear, now is the time to prepare for the transition.

You can already negotiate an amendment anticipating the rules of the Data Act. Many providers will agree to adjust their terms to maintain your trust.

Anticipate your migration projects

The Data Act makes migration easier, but it must be planned ahead:

• List the data you wish to transfer;

• Check the available export formats;

• Evaluate compatibility between your old and new provider;

• Plan a 30-day overlap period for the transition.

At Sidely, for example, the integration team assists customers in exporting and importing their data to ensure a smooth and loss-free migration.

Choose transparent and compliant publishers

From now on, the choice of a CRM will not only be based on features or price, but also on the transparency of contract terms, ease of export and interoperability, and compliance with the Data Act.

Before signing, ask these questions:

• Can I terminate at any time?

• How do I retrieve my data?

• What export formats are available?

• Are there any exit fees?

• Is the publisher already committed to respecting the Data Act?

A publisher that is clear and transparent on these points is a trusted partner.

For sales departments and IT departments

The Data Act is also a strategic opportunity.

• For ITDs, it facilitates governance and the flow of data between systems.

• For sales managements, it reduces the risk of dependence on a tool and strengthens control over the pipeline and customer histories.

• For field teams, it guarantees continuity of work in the event of a change in solution.

In short, the Data Act puts data back at the service of your performance, not the other way around.

A new era of contractual transparency

Publishers must now:

• state clearly in white and black the terms of termination and portability,

• provide a clear migration guide,

• describe the data formats available for export,

• and communicate the timelines and eventual costs related to the transfer.

For you, as a CRM user, this means more clarity and fewer risks. General terms will no longer be able to hide unfair constraints or automatic renewal clauses without explicit consent.

The Data Act marks a profound disruption in the SaaS world: companies are no longer bound by long-term contracts nor prisoners of their data.

Starting in September 2025, you will be able to terminate freely, export your information, and switch CRM or SaaS providers without fear of losing your history or suffering unreasonable costs.

This development is much more than a legal change: it is a cultural transformation.

Data becomes once again a strategic asset that you control.

The SaaS market itself becomes more transparent, more competitive, and more focused on real value for the customer.

Anticipate starting now. Check your contracts, evaluate your providers, and choose partners who already respect these principles.

If you are looking for a mobile CRM designed for travelling teams and already in line with the spirit of the Data Act, try Sidely!