Since 12 September 2025, Art. 13 Data Act has subjected to review clauses that one business unilaterally imposes on another concerning data access, data use and liability. This article explains when the provision applies and which clauses it prohibits.
In Arts. 3 to 12, the Data Act (Regulation (EU) 2023/2854) obliges businesses to make data accessible or available. In practice, this amounts to an obligation to contract (Kontrahierungszwang). Because there is often an imbalance of power between the parties involved, the stronger party should not be able to exploit this situation through unfair contractual terms. To this end, Art. 13 provides for a review of terms in contracts between businesses, limited to data-related content.
All businesses are protected, not only small and medium-sized enterprises. This was still different in the Commission's proposal. The model for the provision is the law on standard terms for consumers under the Unfair Terms Directive 93/13/EEC.
Three conditions must be met together. First, the matter must concern a contract between businesses. Second, the clause must relate to data, i.e. govern access to data, its use, or liability and remedies for the breach or termination of data-related obligations. Third, the clause must have been unilaterally imposed.
A clause is unilaterally imposed if it was supplied by one party and the other party was unable to influence its content despite an attempt to negotiate it (para. 6). The clause need not have been pre-formulated for a large number of contracts; a single contract is sufficient. The party that supplied the clause must prove that it was not unilaterally imposed. Only the disadvantaged party, not the party using the clause, can rely on its invalidity. The parties cannot exclude or vary Art. 13 by contract (para. 9).
In terms of time, Art. 13 applies to contracts concluded after 12 September 2025. For older contracts, it applies from 12 September 2027 if they are of indefinite duration or run for at least ten years from 11 January 2024 (Art. 50).
According to the account by Hoeren and Pinelli, Art. 13 requires an objectively ascertainable attempt to negotiate, and indeed for each individual clause. On this view, anyone who merely clicks a button to accept has not negotiated, and Art. 13 would not be applicable. The authors criticise this outcome: it severely restricts the scope of application, is easy to circumvent and partly fails to achieve the aim of protecting new market participants in particular.
For practice, this means: anyone who wishes to rely on Art. 13 later should express requests for changes in writing and keep the other side's responses. The tactic known from German standard terms law (AGB-Recht) of deliberately not negotiating does not help here.
The price and the main subject matter are not reviewed (para. 8). A clause such as “The workshop pays €5,000 per month for data access” cannot be challenged under Art. 13. The amount of the consideration is instead governed by Art. 9.
Likewise exempt are clauses that merely reflect mandatory law (para. 2). The sentence “The workshop may not use the data to develop a competing product” is therefore unproblematic, as this already follows from Art. 6(2).
A hypothetical case serves as an illustration: a machine manufacturer, as data holder, makes machine data available to an independent workshop. The manufacturer dictates the clauses; the workshop tried unsuccessfully to negotiate them.
Three types of clause are unfair without any scope for assessment. First, the exclusion of liability for intent or gross negligence (point (a)). The clause “The manufacturer is not liable for incorrect or incomplete data, on whatever legal grounds” applies without exception and therefore also covers these cases.
Second, the exclusion of remedies of the disadvantaged party or of the liability of the party using the clause (point (b)), for example: “If the manufacturer does not supply the data or supplies it late, the workshop shall have no claims.”
Third, the clause under which the party using it alone decides whether the data conforms to the contract or how the contract is to be interpreted (point (c)): “Whether the data provided conforms to the contract shall be determined solely by the manufacturer.”
Here there is scope for assessment, but unfairness is presumed. The law names seven categories.
Liability or remedies are unduly limited (point (a)), for instance by “The manufacturer's liability is limited to €50 per claim.” This also applies the other way round to “The workshop is liable irrespective of fault for any misuse of the data.”
The party using the clause obtains access to the other side's data in a manner significantly detrimental to it (point (b)): “The manufacturer shall have access to the workshop's customer and pricing data.” A competitor in the service business would thereby gain insight into trade secrets.
The use of one's own data is impeded (point (c)): “Data that the workshop itself feeds into the manufacturer's portal may not be used outside the portal.”
The disadvantaged party is prevented from terminating within a reasonable period (point (d)): “The contract has a fixed term of ten years and cannot be terminated by the workshop by ordinary notice.”
The disadvantaged party cannot obtain a copy of its own data, either during the term or within a reasonable period thereafter (point (e)): “Upon termination of the contract, all data uploaded by the workshop will be deleted; no export is provided for.”
The party using the clause can terminate at unreasonably short notice (point (f)): “The manufacturer may terminate data access at any time with three days' notice.” For a workshop whose business depends on data access, this can threaten its existence.
The party using the clause reserves a unilateral right to make changes (point (g)): “The manufacturer may change the scope and format of the data at any time.” This is permissible if the contract states valid reasons for the right to make changes, changes are announced in good time and the other party can then terminate free of charge (second subparagraph).
For both lists, it is sufficient that the clause has the prohibited object or effect. Neither intent nor actual damage needs to be proven.
Anything that is not on either list but grossly deviates from good commercial practice in data access and use or is contrary to good faith and fair dealing is unfair. A conceivable example would be an obligation to analyse the data exclusively with fee-based software from the manufacturer. Whether such a clause is unfair remains open. There is neither case law nor model clauses on what good commercial practice means in relation to data. Under Art. 41, the Commission is to develop non-binding model contractual terms that will specify this in future.
An unfair clause is not binding on the disadvantaged party, by operation of law, without a court having to decide on it. The remainder of the contract remains effective if the clause can be severed and the contract remains balanced and capable of performance without it (para. 7). If it cannot be severed, the entire contract is not binding. The Data Act does not govern what takes the place of the invalid clause. Replacement clauses and severability clauses (salvatorische Klauseln) are therefore only permissible to a limited extent.
Public enforcement is governed by Art. 37. In private law, according to the literature, claims under §§ 280(1), 241(2) BGB (German Civil Code) and § 826 BGB may be considered, as well as competition law claims under the UWG (German Act against Unfair Competition), because Art. 13 is a rule regulating market conduct (§§ 8, 3a UWG).
The Unfair Terms Directive applies only between businesses and consumers, Art. 13 of the Data Act only between businesses. In Germany, however, §§ 305 et seq. BGB also apply in dealings between businesses. This can lead to conflicts.
One example from the literature is the exclusion of liability for simple negligence. According to case law on § 307(2) no. 2 BGB, such an exclusion is generally invalid. Art. 13(4)(a), by contrast, covers only intent and gross negligence. Whether EU law takes precedence in such a case is unresolved and will have to be decided by the CJEU (EuGH).
Anyone who dictates data contracts should review and adjust exclusions of liability, notice periods, rights to make changes and provisions on the export of the other party's own data. Anyone who is offered such contracts should request changes and document the negotiations, because the applicability of Art. 13 may depend on this. The assessment partly follows the account by Hoeren and Pinelli on the Data Act.
This article is for general information purposes only and does not replace advice in an individual case.
SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read articleThe BGH sets out what determines the amount of GDPR damages: punitive character or deterrence are not criteria.
Read articleA mobile operator reports pure contract data to SCHUFA. The Schleswig-Holstein Higher Regional Court considers this lawful.
Read article