Data Act: Impact on SaaS Business Models and Contracts

The primary reason for this impact is that one of the key objectives of the Data Act is to make it easier for customers to switch from one provider to another. To support this goal, the Act establishes minimum requirements for SaaS contracts, such as mandating clauses that allow customers to change providers with just two months' notice. These provisions present challenges for traditional SaaS business models that rely on long-term, fixed subscriptions.

SaaS providers should proactively address these challenges by updating their contracts to comply with the requirements of the Data Act, while minimizing disruption to their existing business models. One practical approach is to incorporate well-crafted early termination clauses that specify reasonable penalties for customers who end their contracts early—as permitted by the Data Act. This strategy can help providers safeguard their interests and financial stability, even as they accommodate greater customer flexibility.

The new contractual obligations introduced by the Data Act apply to providers of "data processing services", which the Act defines as "a digital service that is provided to a customer and that enables ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature that can be rapidly provisioned and released with minimal management effort or service provider interaction".

A FAQ document from the European Commission explains that this definition aligns with widely accepted definitions of cloud computing services, such as the definition of cloud computing by the U.S. National Institute of Standards and Technology (NIST). As a result, the scope of the Data Act is intentionally broad and encompasses popular delivery models, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), while also remaining flexible enough to accommodate future technological innovations.

Consequently, as explained in the FAQ, the contractual requirements laid down in the Data Act apply to all SaaS types which display the characteristics listed in the definition of data processing services:

• They enable access to computing resources, including networks, servers, storage, applications, and services;
  
  
• They enable on-demand network access, meaning that a customer can unilaterally provision these computing resources which are available over the network and through standard mechanisms, for example via mobile phones, laptops, or workstations;
  
  
• They can be rapidly provisioned and released with minimal management effort or service provider interaction, which implies that the unilateral provision can be done without significant intervention from the service provider and can be deployed quickly, allowing organisations to start using the resources almost immediately;
  
  
• They are elastic and can be rapidly provisioned, meaning that the solutions can easily scale to accommodate changing needs and that customers can upgrade or downgrade demand based on their requirements.
  
  

Any SaaS provider whose services meet these characteristics must update its customer agreements to comply with the Data Act, and phase out switching charges, meaning those charges imposed on customers to cover the costs associated with transitioning to another provider, such as data egress charges or charges for specific support actions during the switching process. The Data Act mandates that these switching charges be eliminated by 12 January 2027. However, it is important to note that this requirement does not affect early termination penalties, which remain allowed under the Data Act.

All SaaS providers serving customers in the EU should carefully review whether they are subject to the Data Act and update their contracts accordingly.

To assist with this process, providers may find it helpful to review the non-binding standard contractual clauses for data processing services—not to be confused with the SCCs under the GDPR—developed by an expert group convened by the European Commission, which is expected to formally endorse such clauses in the near future.

It is important to highlight that, although the Data Act has not yet been incorporated into the EEA Agreement or Norwegian law, it has been deemed EEA-relevant and is anticipated to be implemented in Norway as well. As a result, the contractual obligations described above will also apply with respect to Norwegian customers once the implementation process is complete.