From 12 September 2025, contracts covering access to and use of data in B2B contexts will be subject to a new fairness regime under the EU Data Act. This marks an important shift in the background contract law rules for data licensing, introducing restrictions on how and when certain terms can be imposed.
Article 13 sets out a general rule: if a data access or use term is unilaterally imposed by one business on another and is unfair, it is not legally binding. This applies regardless of sector and includes both personal and non-personal data.
Unfairness is assessed against what seems to be a high bar: the term must “grossly deviate from good commercial practice in data access and use, contrary to good faith and fair dealing.” This reflects the Act’s aim to curb exploitative terms without undermining freedom to contract.
The Act distinguishes between:
- Blacklisted terms (Art. 13(4)) – which are automatically unfair, such as excluding liability for gross negligence or giving one party exclusive rights to interpret the contract.
- Greylisted terms (Art. 13(5)) – which carry a rebuttable presumption of unfairness. These include:
- Inappropriate limitations or extensions of liability;
- Use of data in ways “significantly detrimental” to the other party;
- Inadequate rights that prevent the recipient from exploiting the data effectively.
These categories are broad, which raises practical questions. For example, market standard limitations on liability or narrow licences common in B2B data deals may now face scrutiny.
To support compliance, the Commission has released voluntary Standard Contractual Clauses (SCCs) and Model Contract Terms (MCTs) (here). Published in April 2025, these offer a structured – if complex – template for implementing the Act’s rules. While helpful, they are lengthy and may diverge significantly from current commercial norms.
The challenge for legal teams will be navigating these new fairness requirements while maintaining viable commercial risk allocations in their data agreements.
___
We covered this topic in detail in our recent webinar, “Enter the EU Data Act: The New Rulebook for B2B Data Sharing”. If you’re interested in viewing the recording of this webinar please do get in touch (info@kempitlaw.com), and look out for the next article in our series on this topic.
