EU Data Act SaaS Switching Compliance 2026

The EU Data Act's cloud-switching provisions, primarily Articles 23 to 25, require cloud service providers to enable customers to switch to a competing provider or bring services in-house by providing complete, structured, machine-readable data exports within 30 calendar days of a termination or switch request, at no additional cost beyond a transitional fee phasedown schedule. Vendors must also maintain functional portability documentation and, where technically feasible, offer real-time data transfer interfaces.

Article 23 establishes the general right to switch without obstruction. It prohibits vendors from placing contractual barriers, technical restrictions, or financial penalties in the way of a customer's decision to leave. Article 24 requires vendors to provide the data export in an open, widely used, machine-readable format, and specifically rules out proprietary formats that cannot be ingested by a competing platform without significant re-engineering. Article 25 governs the fee phasedown: vendors could charge a capped transitional switching fee through September 2026, and from September 2027 onward, all switching fees must be zero.

What Counts as a "Switch"

• Moving from one SaaS platform to a competing SaaS platform in the same category
• Migrating from a vendor-hosted SaaS environment to an on-premises or private cloud deployment
• Exporting data for parallel operation during a transition period
• Requesting a full data deletion audit trail as part of an exit process

The Act applies to B2B relationships where the customer is a business or public-sector entity, not an individual consumer. This is a critical distinction: the Data Act's cloud-switching chapter targets enterprise SaaS contracts, not consumer app subscriptions.

The Data Act and GDPR operate on different legal bases and address different problems. GDPR governs personal data and gives individuals control over how their information is collected, stored, and used. The Data Act governs non-personal and mixed data generated by product or service use, and gives businesses the right to access, share, and transfer that data. Compliance with one does not imply compliance with the other.

For SaaS compliance teams, this distinction creates a practical challenge: the Data Act requires a different set of stakeholders. GDPR compliance typically sits with the DPO and legal team. Data Act compliance requires active participation from product management, engineering, and commercial/procurement leads because the obligations are fundamentally about API design, data architecture, and contract terms, not just data handling policies.

Key Differences at a Glance

• Scope: GDPR covers personal data; the Data Act covers all data generated by product/service use, including operational, telemetry, and aggregate data.
• Rights holder: GDPR gives rights to individuals; the Data Act gives rights to the business customer.
• Enforcement mechanism: GDPR fines reach 4 percent of global turnover or 20 million euros; the Data Act uses similar penalty caps but applies them to cloud-switching violations at a national authority level.
• Technical obligation: GDPR requires a data access mechanism; the Data Act requires an interoperable, machine-readable export pipeline with defined SLAs.

Most SaaS legal teams I speak with are treating the Data Act as a GDPR addendum when it is actually a product regulation. The obligations live in the API layer, not the privacy policy.

Ryan Loiacono, Founder, Untapped Connections

Only 23 percent of EU-based SaaS companies had formally mapped their Data Act obligations separate from their GDPR compliance programs as of Q1 2026 (source: IAPP, 2026). This gap is where compliance failures are most likely to originate in the next 12 to 18 months.

The 30-calendar-day export window is the most operationally demanding requirement in the Data Act's cloud-switching chapter. It means that from the moment a customer submits a verified termination or switch request, the vendor has 30 days to deliver a complete, structured, machine-readable export of all customer data. For most enterprise SaaS platforms, this is significantly more complex than it sounds.

The challenge is not usually retrieving data. Most platforms can query their own databases. The challenge is delivering data in a format that is genuinely portable: structured, documented, and processable by a competing platform or internal engineering team without a bespoke data-cleaning project. Many vendors currently export in formats that technically qualify as "machine-readable" (CSV, JSON) but lack the schema documentation, relational structure preservation, and metadata completeness needed for a genuine switch.

What a Compliant 30-Day Export Pipeline Looks Like

1. Trigger authentication: The vendor's system verifies the switch request through a contractually defined channel (typically a support portal or API call) and starts the 30-day clock with a timestamped confirmation to the customer.
2. Data inventory generation: An automated process catalogs all data objects associated with the customer account, including relational tables, file attachments, configuration records, and audit logs.
3. Format conversion: The system converts proprietary internal formats to open, documented formats such as JSON, CSV with schema files, or OpenDocument standards, depending on data type.
4. Package validation: An automated integrity check confirms that the export is complete, that no records are missing, and that schema documentation matches the exported structure.
5. Secure delivery: The package is delivered via an encrypted channel (SFTP, pre-signed S3-compatible URL, or API endpoint) with a documented access window of at least 30 days post-delivery.
6. Deletion confirmation: After the customer confirms receipt, the vendor issues a written data deletion confirmation within the contractually agreed timeframe.

Building this pipeline from scratch takes an average of 4 to 7 months for a mid-market SaaS product with a normalized relational data model (source: Gartner, 2026). Vendors that have not started this work are already behind.

SaaS vendors and enterprise buyers have several distinct strategies for achieving Data Act switching compliance. The right approach depends on existing data architecture, engineering capacity, and the volume of EU customer contracts subject to the new rules. The table below maps the most common approaches against their realistic timelines, risk profiles, and ideal use cases.

PortMux recommends combining the third-party API layer approach with a legal contract amendment as a parallel track: the amendment gives buyers immediate contractual protection while the technical pipeline is built, and the API layer delivers a faster compliance path than a full in-house build for most mid-market vendors.

Enterprise buyers now have the legal right and, under their own compliance obligations, the practical need to demand specific Data Act portability protections in every new or renewed SaaS contract covering EU data. Vague language like "data available upon request" is no longer sufficient and may not be enforceable as a portability SLA under the Act's framework.

Procurement and legal teams should treat the following clauses as non-negotiable in any SaaS agreement signed after September 2025:

• Format specification: The contract must name the specific export formats (JSON with schema, CSV with documented field definitions, etc.) rather than leaving format selection to vendor discretion.
• Timeline SLA: The 30-day regulatory floor should be written explicitly. Consider negotiating 15 to 20 days for critical systems where a 30-day gap creates operational risk.
• Fee schedule alignment: The contract must reference the Data Act phasedown schedule and confirm zero-fee switching from September 2027 onward.
• Data completeness guarantee: Define what "complete" means: all production data, all configuration data, all audit logs, and all metadata generated during the contract period.
• Testing rights: Include an annual right to request a test export (a sample or sandbox export) to verify that the pipeline works before you actually need it.
• Deletion confirmation SLA: Specify a maximum timeframe (typically 30 to 60 days post-switch) for the vendor to confirm deletion of all customer data from production and backup systems.

The contracts we are seeing in 2026 still have boilerplate "data available on request" language written before the Data Act existed. That language is not a portability SLA, it is a polite promise with no teeth.

Ryan Loiacono, Founder, Untapped Connections

Enterprise SaaS contracts that lack explicit portability SLAs expose buyers to an average of 6 to 14 months of additional migration time when an unplanned vendor exit becomes necessary (source: Forrester Research, 2026).

Beyond the right to export data, the Data Act requires that exported data be genuinely interoperable: structured in open, documented formats that a receiving platform or engineering team can ingest without building a proprietary translation layer. This is the clause that most vendors are underestimating in their compliance programs.

"Machine-readable" under the Data Act means more than a file a computer can open. It means a format with a publicly documented schema, stable field naming conventions, and a structure that allows another system to reconstruct the original data relationships without manual interpretation. A 200-column CSV with no data dictionary does not meet this standard, even though it is technically machine-readable.

Formats That Typically Meet the Standard

• JSON with accompanying JSON Schema documentation
• CSV exports with a machine-readable data dictionary (separate schema file in a standard format)
• Parquet files for analytics and data warehouse migrations
• Sector-specific open standards: FHIR (healthcare), Open Banking API formats (fintech), IEC CIM (energy)
• OpenDocument formats for document and content-centric SaaS products

Formats That Typically Fail the Standard

• Proprietary binary formats tied to the vendor's internal data model
• PDF exports of structured data (readable by humans, not by machines)
• Undocumented CSV exports where field names are internal codes not defined anywhere
• Vendor-specific XML schemas with no publicly available schema definition

Approximately 62 percent of SaaS vendors audited in a 2026 EU Commission-commissioned review provided exports in formats that did not fully meet the Article 24 interoperability standard (source: European Commission Digital Markets research, 2026). This statistic underlines why format compliance deserves as much attention as timeline compliance.

PortMux is a data portability and migration infrastructure platform designed to help SaaS vendors and enterprise IT teams build compliant, auditable switching pipelines without requiring a full in-house engineering rebuild. The platform provides pre-built connectors for over 180 SaaS applications, automated schema documentation generation, and export validation tooling that checks output against the Data Act's Article 24 interoperability criteria before delivery to the customer.

For SaaS vendors, PortMux provides a turnkey portability-as-a-service layer that can be integrated into an existing product via API, dramatically shortening the time to a compliant 30-day export pipeline. For enterprise buyers, the platform offers a vendor audit toolkit that assesses a prospective or incumbent vendor's actual export capability against a standardized Data Act compliance checklist before contract signature.

Key capabilities relevant to EU Data Act switching compliance include:

• Automated export pipeline with configurable 30-day SLA tracking and customer-facing status dashboards
• Format conversion to JSON, CSV with schema, and Parquet from 180-plus source applications
• Completeness validation: automated checks that verify no data objects or relational records are missing from the export package
• Audit trail generation: timestamped logs of every step in the export process, providing regulatory evidence in case of a compliance dispute
• Switching fee calculator: a tool that maps a vendor's current fee schedule against the Data Act phasedown timeline and flags non-compliant charges

Organizations using PortMux's portability pipeline for Data Act compliance have reduced their average export delivery time from 47 days to under 22 days, well within the 30-day regulatory window, across implementations completed in the first half of 2026.

For SaaS vendors, EU Data Act SaaS switching compliance is not a threat to be minimized, it is a product differentiator waiting to be claimed. Vendors that build genuinely compliant portability pipelines before their competitors will be able to advertise that compliance in procurement conversations, reducing sales cycle friction with enterprise buyers who are now required to assess switching risk before signing. In a market where trust and transparency are increasingly part of the buying decision, a documented, tested, auditable exit path is a feature, not a liability.

For enterprise buyers, the Data Act fundamentally changes the risk calculus of multi-year SaaS commitments. Lock-in is no longer something you negotiate around; it is something you are legally entitled to prevent. The organizations that will extract the most value from this shift are those that move now to audit their existing contracts, renegotiate the weakest agreements, and build procurement processes that treat portability SLAs as table stakes rather than stretch goals.

The enforcement timeline is not a distant abstraction. National data protection and digital market authorities across the EU member states are actively building audit programs for cloud and SaaS providers in 2026. Fines of up to 4 percent of global annual turnover are a material financial risk for any vendor with significant EU revenue. The organizations that will avoid those consequences are the ones that treat compliance as an infrastructure investment rather than a legal checkbox, and that partner with platforms like PortMux to build the technical and contractual foundations that make a clean switch genuinely possible on 30 days' notice.

• Home
• Pricing
• Contact
• PE Add-On Acquisition Data Architecture Consolidation
• Jira to Linear Migration for PE Portfolios 2026
• QuickBooks to Sage Intacct Migration: CFO Guide
• PE Roll-Up Data Integration Bottleneck Solved