Data Act
Implementation in
Germany.
Data Act
Implementation in
Germany.
from
The EU Data Regulation (Data Act) came into force on 12.09.2025. Now the implementation into German law also came into force on 30.05.2026.
We summarize what is important.
What is behind the DADG?
Which authority will monitor whether companies comply with data access rights in future? Who is responsible if there is a dispute? And what fines can be imposed for violations? The Act on the Application and Enforcement of the Data Regulation (DADG), which came into force on 30.05.2026, provides answers for Germany.
Background: What is the EU Data Act?
The EU Data Regulation (Data Act) came into full force on September 12, 2025. It regulates who has access to the data generated by networked products and digital services – such as data from smart home devices, vehicles or industrial machines. This gives users the law to view, share and port their data. Manufacturers and providers are obliged to be transparent and to make this data technically available.
What was missing until now was the concrete national implementation: Which authority is responsible for enforcement in Germany? What fines can be imposed? How are disputes resolved? The DADG closes this gap.
The Federal Network Agency as the central supervisory authority
The DADG designates the Federal Network Agency as the competent authority for the application and enforcement of the Data Act in Germany. This decision is remarkable, as the Federal Network Agency has so far been known primarily as the regulatory authority for the energy, telecommunications, postal and railroad sectors. Now the completely new task of data access has been added.
As the central point of contact, the authority informs the public, processes complaints and exercises national supervision. It approves dispute resolution bodies, examines data requests from federal authorities and draws up recommendations for action for companies. It also reports annually to the European Commission on rejected data access requests.
Data protection remains with the BfDI
A central structural feature of the DAG is the division of tasks between the Federal Network Agency and the Federal Commissioner for Data Protection and Freedom of Information (BfDI). While the Federal Network Agency is responsible for all general data access issues, the BfDI remains the supervisory authority for the protection of personal data at non-public bodies.
The two authorities should work closely together. If the Federal Network Agency determines in a procedure that the lawfulness of the processing of personal data must be examined, the BfDI must be involved. The result is binding for the Federal Network Agency and becomes part of its final decision. The BfDI must be summoned to appear in court proceedings.
This design avoids conflicts of jurisdiction, but also creates new coordination requirements. Companies that come into contact with the authorities as part of a complaint can therefore have to deal with two authorities at the same time.
Dispute resolution: Authorization and supervision by the Federal Network Agency
In accordance with the Data Act, disputes between data owners and data recipients can also be settled out of court. The DADG regulates the approval procedure for corresponding dispute resolution bodies in Germany.
An entity wishing to act as a dispute resolution body must submit a formal application to the Federal Network Agency and prove that it meets the organizational and technical requirements set out in Art. 10 (5) Data Act. The Federal Network Agency maintains a public list of all authorized bodies and regularly forwards this to the EU Commission.
Authorized bodies must inform the Federal Network Agency and the BfDI about the start and conclusion of each procedure. Upon request, procedural documents including personal data and business secrets must also be handed over. The Federal Network Agency charges a fee for authorization.
Enforcement powers and procedures
The Federal Network Agency can pursue violations of the Data Act both on complaint and ex officio. If it identifies a non-compliance, it first requests the company concerned to remedy the situation within a reasonable period of time. If the company does not comply with this request, the authority can order the necessary measures.
The Federal Network Agency has a full range of investigative instruments at its disposal to enforce these measures: it can demand information, request documents, question witnesses and issue interim orders. Fines of up to 500,000 euros can be imposed to enforce orders. In the event of several similar complaints, the authority can conduct a lead procedure and suspend the other procedures.
Framework of fines: What are the consequences of violations?
The DADG creates a graduated framework of fines for violations of the Data Act. The amount of the possible sanction depends on the severity of the breach.
- Up to € 5,000,000
Unlawful request for data provision by third parties (Art. 5 para. 3 lit. a, b Data Act / Art. 15 para. 2 no. 9 DADG) - Up to €500,000
Incorrect product design, failure to provide data, unauthorized use or disclosure of data (DADG) - Up to €100,000
Various breaches of deletion obligations, prohibitions of discrimination, interface obligations (DADG) - Up to €50,000
Other breaches of information and contractual obligations (DADG) - Up to 2% of global annual turnover
For companies > € 250 million total turnover for violations of Art. 5 para. 3 lit. a, b Data Act (DADG)
The special regulation for large companies is particularly noteworthy: Companies with a global annual turnover of more than 250 million euros risk a fine of up to two percent of their total global annual turnover for certain breaches of data provision obligations. This brings the DADG closer to the sanction system of the GDPR.
Special regulation in copyright law: database protection law and Data Act
Article 2 of the DADG contains an amendment to the Copyright Act (UrhG). The new Article 87b (3) UrhG excludes the database producer’s right to protection in the cases specified in Article 43 of the Data Act.
In concrete terms, this means that if the Data Act establishes an obligation to disclose data, a data owner cannot claim that a database is protected by copyright as a database work and may therefore refuse access. Database protection law may therefore not be used as an instrument to block the data access obligations of the Data Act.
This is an important clarification, as it has often been discussed in practice whether database protection law could conflict with the Data Act under the Copyright Act. The legislator has now clearly resolved this issue in favor of data access.
Conclusion
Whether the DADG will succeed in effectively enforcing the Data Act in practice remains questionable. The Federal Network Agency is already considerably burdened by its current tasks. Cooperation between the Federal Network Agency and the BfDI with regard to personal data also harbors the risk of considerable procedural delays. For affected companies, this means long periods of uncertainty in case of doubt.
The Federal Network Agency must now draw up recommendations for the practical implementation of the Data Act. These can only follow after the authority has established its new role operationally. Until then, the interpretation of key obligations remains subject to considerable uncertainty for many companies.
We are happy to
advise you about
Data Act!
