# EU Data Act in Luxembourg: obligations, key dates and the ILR's planned role

> The EU Data Act applies in Luxembourg since 12 September 2025. Bill 8809 would make the ILR the main authority. Obligations, deadlines and who is affected.

Published: 2026-09-22 · Dataplaz editorial team · https://dataplaz.lu/en/eu-data-act-luxembourg/

## Key takeaways
- Regulation (EU) 2023/2854, the Data Act, has applied directly in Luxembourg since 12 September 2025.
- Since 12 September 2026, connected products and related services placed on the market must be designed so that their data is accessible to the user by default.
- From 12 January 2027, cloud and other data processing service providers may no longer charge customers any switching fees.
- Bill No. 8809, filed on 28 July 2026, would designate the Institut Luxembourgeois de Régulation (ILR) as main competent authority and data coordinator; as of 22 September 2026 it had not been adopted.
- Amendments to the Data Act proposed in the Commission's Digital Omnibus of 19 November 2025 were still under negotiation in September 2026.

The EU Data Act, [Regulation (EU) 2023/2854](https://eur-lex.europa.eu/eli/reg/2023/2854/oj), has applied directly in Luxembourg since 12 September 2025, and a second wave of obligations started on 12 September 2026 for newly marketed connected products. Luxembourg has not yet adopted its implementing law: [bill No. 8809](https://www.chd.lu/fr/dossier/8809), filed on 28 July 2026, would make the Institut Luxembourgeois de Régulation (ILR) the main enforcement authority.

## What the Data Act regulates

The Data Act sets rules on who may access and use data generated by connected products and related services, and on fair data sharing more generally. Its main building blocks are:

- **Access to connected-product data (Chapter II).** Users of connected products, such as machines, vehicles or smart appliances, and of related services have the right to access the data they generate (Article 4) and to have it shared with a third party of their choice (Article 5). Sellers and providers must inform users before the contract about which data is generated and how to access it (Article 3(2) and (3)). Companies designated as gatekeepers under the Digital Markets Act cannot be eligible third-party recipients (Article 5(3)).
- **Business-to-business sharing (Chapter III).** Where a data holder is legally obliged to make data available, it must do so on fair, reasonable and non-discriminatory terms, and the regulation sets rules on compensation and certified dispute settlement bodies.
- **Unfair contract terms (Chapter IV).** A term on data access, use or liability that one enterprise has unilaterally imposed on another is not binding if it is unfair (Article 13), for example a term excluding liability for intentional acts or gross negligence.
- **Public-sector access (Chapter V).** Public sector bodies, the Commission, the European Central Bank and Union bodies may request data where there is an "exceptional need", such as responding to a public emergency (Article 15).
- **Switching between cloud providers (Chapter VI).** Data processing services, including cloud services, must allow customers to switch provider or move to on-premises infrastructure. The contract must set a notice period of no more than two months and a transition period of no more than 30 calendar days (Article 25), and switching charges are being phased out (Article 29).
- **International access and interoperability (Chapters VII and VIII).** Data processing service providers must take measures against unlawful third-country governmental access to non-personal data held in the EU (Article 32), and participants in data spaces must meet interoperability requirements (Article 33).

## Key dates

| Date | What applies |
|---|---|
| 11 January 2024 | Data Act enters into force; providers may charge only reduced, cost-based switching fees from this date |
| 12 September 2025 | General date of application; Chapter IV applies to contracts concluded after this date |
| 28 July 2026 | Luxembourg bill No. 8809 filed with the Chambre des Députés |
| 12 September 2026 | Design obligation of Article 3(1) applies to connected products and related services placed on the market after this date |
| 12 January 2027 | Switching charges are no longer allowed |
| 12 September 2027 | Chapter IV also applies to contracts concluded on or before 12 September 2025 that are open-ended or expire at least ten years after 11 January 2024 |

The dates come from Articles 29 and 50 of the regulation.

## Who is affected

The Data Act applies to manufacturers of connected products placed on the EU market and providers of related services, wherever they are established; users of such products in the EU; data holders and data recipients; public sector bodies requesting data; and providers of data processing services offering them to customers in the EU (Article 1). In practice, this can include equipment manufacturers, businesses that operate connected vehicles or machines, cloud and hosting providers, and companies that agree data-related terms with other businesses.

Micro and small enterprises are exempt from the Chapter II obligations for the products they manufacture, provided they have no partner or linked enterprise that is larger (Article 7). Medium-sized enterprises benefit from a similar exemption for one year after qualifying as such. Micro and small enterprises are also outside the scope of public-sector requests under Article 15(1)(b), which covers needs other than public emergencies (Article 15(2)).

## The competent authority in Luxembourg

The regulation required Member States to designate competent authorities and set penalty rules. In Luxembourg, the government approved bill No. 8809 on 10 July 2026, and Elisabeth Margue, Minister Delegate for Media and Connectivity, filed it on 28 July 2026, according to the [deposit document](https://wdocs-pub.chd.lu/docs/Dossiers_parlementaires/8809/20260728_Depot.pdf). The bill provides that:

| Authority | Proposed role |
|---|---|
| Institut Luxembourgeois de Régulation (ILR) | Competent for Chapters II, III, VI and VII; data coordinator; certifies dispute settlement bodies |
| Commissariat du Gouvernement à la souveraineté des données | Competent for Chapter V (public-sector access) and Article 33 (interoperability); advises public bodies on data requests |
| Commission nationale pour la protection des données (CNPD) | Competent where personal data is concerned; the ILR and the Commissariat would be bound by its opinion on whether the GDPR applies |

The bill proposes warnings, reprimands and administrative fines in three bands: EUR 500 to 100,000, EUR 500 to 500,000, and EUR 500 to 1,000,000, depending on the infringement. Obstructing an investigation could cost up to EUR 50,000. Appeals would go to the Tribunal administratif.

As of 22 September 2026, the bill was with the Chamber's committee on media and communications, and no opinion of the Conseil d'État had been published on the [parliamentary file](https://www.chd.lu/fr/dossier/8809). The regulation's obligations nevertheless apply directly; what is missing is the national enforcement framework.

## Digital Omnibus: changes under negotiation

On 19 November 2025, the European Commission proposed a Digital Omnibus that would amend the Data Act. According to a [CMS overview](https://cms.law/en/int/publication/the-eu-digital-omnibus), the proposal would strengthen data holders' right to refuse disclosure of trade secrets, ease switching rules for custom-made services and for SME and small mid-cap providers, fold public-sector-information re-use rules into the Data Act and remove the smart-contract requirements. At the end of June 2026, Member States did not adopt a Council compromise text, as [EDRi reported](https://edri.org/our-work/the-digital-omnibus-is-going-on-summer-break-your-rights-are-not/) on 16 July 2026. On 10 September 2026, [McCann FitzGerald](https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/data-act-developments-2026-and-beyond) noted that the Irish Council Presidency aims for an agreement with the European Parliament by the end of 2026. Until an amending regulation is adopted, the current text applies, including the deadlines above.

## What to do now

1. Map which connected products, related services and data processing services the organisation makes, sells, uses or provides in the EU.
2. Manufacturers: check that products placed on the market since 12 September 2026 make data accessible by default, and that pre-contract information is in place.
3. Cloud and hosting providers: review contracts for the two-month notice and 30-day transition limits, and plan to remove switching charges by 12 January 2027.
4. Review standard B2B terms on data access, use and liability against Article 13, including long-running contracts that fall in scope on 12 September 2027.
5. Follow bill No. 8809 and the Digital Omnibus negotiations, as both may change enforcement and obligations.

## Questions & answers
**Who enforces the Data Act in Luxembourg?**
Bill No. 8809 would make the ILR competent for Chapters II, III, VI and VII and the data coordinator, the Commissariat du Gouvernement à la souveraineté des données competent for Chapter V and Article 33, and the CNPD competent for personal data. As of 22 September 2026, the bill had not been adopted.

**Does the Data Act apply to small companies?**
Micro and small enterprises are exempt from the Chapter II data-sharing obligations for the connected products they make, provided they are not linked to a larger enterprise. Other chapters, such as the cloud switching rules, have no such general exemption.

**When do cloud switching charges end?**
From 12 January 2027, providers may not charge any switching fees. Until then, reduced fees are allowed only up to the costs directly linked to the switch.

**What fines are planned in Luxembourg?**
Bill No. 8809 proposes administrative fines in three bands of EUR 500 to 100,000, EUR 500 to 500,000 and EUR 500 to 1,000,000, depending on the breach. These amounts are not final until the law is adopted.

## Sources
1. [Regulation (EU) 2023/2854 (Data Act)](https://eur-lex.europa.eu/eli/reg/2023/2854/oj) · EUR-Lex
2. [Projet de loi n° 8809 portant mise en œuvre de certaines dispositions du règlement (UE) 2023/2854](https://www.chd.lu/fr/dossier/8809) · Chambre des Députés
3. [Projet de loi n° 8809, document de dépôt (28 juillet 2026)](https://wdocs-pub.chd.lu/docs/Dossiers_parlementaires/8809/20260728_Depot.pdf) · Chambre des Députés
4. [Data Act](https://digital-strategy.ec.europa.eu/en/policies/data-act) · European Commission
5. [Data Act Developments: 2026 and Beyond](https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/data-act-developments-2026-and-beyond) · McCann FitzGerald
6. [The EU Digital Omnibus](https://cms.law/en/int/publication/the-eu-digital-omnibus) · CMS
7. [The Digital Omnibus is going on summer break. Your rights are not.](https://edri.org/our-work/the-digital-omnibus-is-going-on-summer-break-your-rights-are-not/) · EDRi