If you’ve been keeping an eye on European tech regulation, you already know the EU Data Act has been building momentum for a while. But now that its key provisions are actively shaping obligations for cloud providers and their customers, the conversation has shifted from what’s coming to what do we do about it. For IT leaders and infrastructure teams across Europe, that’s a genuinely important question — and the answers have real consequences for how you architect your cloud environment today.

The EU Data Act, which entered into force in January 2024 and began applying in stages through 2025, is one of the most significant pieces of data legislation since GDPR. It touches on who can access data, how it can be shared, and critically — how easily you can move it between providers. If your current cloud strategy doesn’t account for these requirements, now is the time to revisit it.

What the EU Data Act actually requires

At its core, the Data Act is about fairness and access. It establishes rights for businesses and individuals to access data generated by connected products and services — think IoT devices, industrial sensors, smart systems. But for cloud customers specifically, the provisions around switching and data portability are where things get particularly interesting.

Cloud providers operating in the EU are now required to make it technically and contractually feasible for customers to switch providers without disproportionate friction. That means eliminating egress fees that act as switching penalties, providing standardised data export formats, and ensuring continuity of service during transitions. The regulation explicitly targets the kind of vendor lock-in that has quietly become the norm in the hyperscaler world.

There’s also a strong emphasis on cloud data sovereignty in Europe. Public sector bodies, in particular, face tighter rules around where their data can be processed and stored. But even private enterprises in regulated industries — finance, healthcare, critical infrastructure — are finding that their own compliance obligations now intersect directly with where and how their cloud provider operates.

Why vendor lock-in is now a compliance risk, not just a strategic one

For years, the argument against vendor lock-in was largely about negotiating leverage and operational flexibility. Those are valid concerns, but they’re somewhat abstract. The EU Data Act makes the stakes concrete: if your infrastructure is so deeply entangled with a single provider that you can’t practically move your data, you may now have a compliance problem, not just a strategic one.

This is especially true for organisations that process data on behalf of European users or operate within the EU’s regulatory perimeter. The ability to demonstrate data portability in the cloud — to show that you could switch providers if required — is increasingly something auditors, regulators, and enterprise procurement teams will ask about.

Key takeaway: The EU Data Act doesn’t just give you the right to move your data — it places obligations on cloud providers to make that movement genuinely possible. If your current provider can’t demonstrate compliance with these portability requirements, that’s a red flag worth taking seriously.

Practically speaking, this means reviewing your current cloud contracts for egress clauses, data export capabilities, and transition assistance provisions. Many organisations are discovering that the fine print in their existing agreements doesn’t align well with what the Data Act now requires of providers.

How this connects to your broader GDPR cloud strategy

It would be a mistake to treat the Data Act as entirely separate from your existing GDPR obligations. The two frameworks are complementary — and for many organisations, the Data Act fills in gaps that GDPR left open, particularly around B2B data sharing and the practicalities of cloud switching.

Your GDPR cloud strategy already requires you to know where personal data is processed, who has access to it, and under what legal basis. The Data Act adds another layer: you also need to be confident that your provider’s architecture doesn’t create structural barriers to data portability or sovereignty. Together, these frameworks are pushing European cloud infrastructure toward greater openness and interoperability — which is, on balance, a good thing for customers.

For IT teams, this is a useful moment to audit your data flows end to end. Where does your data live? Who controls the infrastructure it runs on? And if you needed to move it — whether for compliance, cost, or strategic reasons — how long would that actually take?

What to look for in a European cloud provider

Choosing the right infrastructure partner in this environment matters more than it used to. Here’s what organisations navigating EU Data Act compliance should be evaluating:

  • Data residency guarantees: Can the provider commit to keeping your data within specific EU jurisdictions? This is foundational for cloud data sovereignty in Europe and increasingly non-negotiable for regulated sectors.
  • Transparent egress policies: Are data transfer costs clearly documented, and does the provider offer fee-free or low-cost data portability options in line with the Data Act’s requirements?
  • Open standards and interoperability: Does the provider support standardised APIs and export formats that make switching realistic, not just theoretically possible?
  • EMEA-based operations: Providers headquartered and operating within the EMEA region are subject to European law directly — which can simplify compliance and reduce the legal complexity of cross-border data transfers.
  • Contractual alignment: Do the provider’s standard terms already reflect Data Act obligations, or will you need to negotiate custom clauses just to get to baseline compliance?

These aren’t just nice-to-haves anymore. For many organisations, they’re becoming baseline requirements in procurement processes.

The bigger picture: European digital sovereignty is maturing

Zoom out for a moment and it’s clear that the EU Data Act is part of a broader, deliberate effort to build genuine digital sovereignty for Europe. Alongside the Data Governance Act, the AI Act, and the ongoing evolution of GDPR enforcement, European regulators are constructing a coherent framework that prioritises user rights, data access, and operational independence from non-EU jurisdictions.

This isn’t anti-innovation — it’s a different model of innovation, one that puts structural fairness and accountability at the centre. And for organisations building on European cloud infrastructure, it creates a clearer, more stable operating environment in the long run.

The providers that will thrive in this landscape are those that treat compliance not as a constraint to work around, but as a design principle. That means investing in portability, transparency, and genuinely open architectures — not just ticking regulatory boxes.

What you should do right now

If you haven’t already, start with an honest assessment of your current cloud posture. Review your provider contracts against the Data Act’s portability and switching requirements. Map your data residency against your sovereignty obligations. And ask your providers — directly — how they’re implementing compliance with the new rules.

The organisations that treat the EU Data Act as a strategic prompt — rather than a compliance burden — will come out of this period with more resilient, more flexible infrastructure. That’s worth something well beyond the regulatory deadline.

At DIVERSITY, we’ve built our European cloud infrastructure from the ground up with these principles in mind — operating entirely within the EMEA region, with a clear commitment to data portability, sovereignty, and the kind of transparency that makes compliance straightforward rather than stressful. If you’re reassessing your cloud strategy in light of the Data Act, we’d be glad to be part of that conversation.