European regulators have clarified that computing capacity is only subject to the Data Act if it is the primary purpose of the service rather than an incidental byproduct of a physical device or application. This pivotal distinction serves as the foundation for the 52-page draft guidance released by the Netherlands Authority for Consumers and Markets (ACM) in late 2026, aimed at dismantling the architectural and financial barriers that have long defined the cloud sector. By providing a technical and legal roadmap for Chapters 6, 7, and 8 of Regulation (EU) 2023/2854, the ACM is establishing a precedent for how businesses should handle data portability and vendor transitions. The move comes as a direct response to a market environment where a handful of global infrastructure providers control approximately 75 percent of the resources, a concentration that has historically led to systemic vendor lock-in. This regulatory intervention is designed to foster a competitive ecosystem where customers, from small enterprises to large conglomerates, can migrate their operations with the same fluidity expected in any mature, open market.
Defining the Scope: Technical Criteria for Inclusion
The ACM has moved away from colloquial terminology to embrace a rigorous, technical definition of what constitutes a “data processing service” under the new legal framework. To qualify for regulation, a service must demonstrate a cumulative set of four specific characteristics that define modern cloud computing. First, it must provide ubiquitous and on-demand network access, ensuring that the service is available regardless of geographical location. Second, the underlying hardware must be part of a shared pool of resources, where multiple users utilize the same physical infrastructure. Third, the service must be highly configurable and scalable, allowing for the adjustment of computing power to match varying demand levels. Finally, the system must exhibit elasticity, characterized by the ability to rapidly provision or release resources with minimal management intervention. This precise framework ensures that the Data Act applies to the core of the digital economy while excluding services where data processing is merely a secondary function of a specific physical product.
Determining whether a platform falls under these rules requires a careful evaluation of the primary intent behind the customer’s use of the service. The ACM guidance clarifies that if the primary goal is to access shared computing capacity, such as a virtual machine or a cloud-hosted database, the provider must comply with the full weight of the Data Act. Conversely, if the computing elements are incidental, the service remains outside this specific regulatory scope. For instance, an application used to control a smart robot vacuum or a specialized video-streaming platform may involve massive amounts of data processing, but because the user is paying for a specific physical outcome or content delivery rather than generic computing resources, these examples are generally exempt. This distinction is vital for developers who integrate cloud components into consumer electronics, as it prevents the over-regulation of specialized software that was never intended to function as a general-purpose cloud environment.
Territorial Reach: The Reach of European Oversight
The jurisdictional boundaries of the Data Act are intentionally expansive, ensuring that the protections afforded to European customers are not undermined by the physical location of a provider’s headquarters. Any entity offering data processing services to customers established within the European Union is subject to these rules, regardless of whether the provider is based in Seattle, Beijing, or Amsterdam. This extraterritorial reach is particularly significant for global cloud giants that operate through various international subsidiaries. The guidance confirms that a subsidiary operating within an EU member state brings the entire service delivery model under the scrutiny of European regulators. This prevents a scenario where providers could circumvent data portability requirements by routing contracts through jurisdictions with less stringent competition laws, thereby securing a level playing field for both domestic and international service providers.
Supervision of these mandates is governed by the “country-of-origin” principle, a mechanism designed to streamline enforcement and provide legal certainty for providers operating across multiple borders. Under this system, a cloud provider is primarily accountable to the regulatory body in the member state where its main European headquarters is located. However, the ACM serves as the central “data coordinator” for the Netherlands, acting as a gateway for Dutch businesses to seek redress. If a Dutch enterprise encounters resistance while attempting to switch from a provider headquartered in Ireland or Germany, it would initiate its complaint with the ACM. The Dutch regulator then collaborates with the lead authority in the relevant member state to ensure the provider fulfills its obligations. This collaborative approach ensures that while enforcement is centralized, the local market remains protected through a network of national regulators working in concert.
Operational Distinctions: Switching Versus Parallel Resource Usage
The ACM emphasizes a critical operational distinction between “switching” and “parallel use,” as each scenario triggers different legal obligations and cost structures. Switching refers to the process where a customer terminates a contract, either in whole or in part, to migrate their data and digital assets to a new provider or an on-premises infrastructure. A core component of this process is “unbundling,” which allows a customer to decouple specific services from a larger vendor suite. For example, a company might choose to move only its customer relationship management (CRM) tool to a competitor while keeping its email servers with the original provider. The guidance mandates that providers must facilitate this modular departure without creating artificial technical dependencies that would make such a partial migration impossible or prohibitively complex.
In contrast, parallel use describes a multi-cloud strategy where a customer maintains active, simultaneous contracts with multiple providers to complete integrated business tasks. In a typical scenario, a business might use one vendor for its front-end web hosting and another for its back-end data analytics, with information flowing constantly between the two environments. Because the customer is not terminating their relationship with either provider, the specific rules regarding exit and switching fees do not apply in the same way. However, the rules regarding data transfer costs and the provision of free Application Programming Interfaces (APIs) remain in effect to ensure that data can move freely between the services. This distinction is essential for modern enterprises that rely on a diverse ecosystem of specialized tools, as it prevents vendors from using high data-egress fees as a “tax” on multi-cloud interoperability.
Transition Timelines: Structuring the Migration Journey
To ensure that the process of moving data is not stalled by administrative delays, the ACM has codified a strict chronological structure for cloud transitions. This timeline begins with a notice period, which is the duration between the customer’s formal request to terminate the service and the actual commencement of data migration. According to the Data Act, this notice period is capped at a maximum of two months, preventing providers from locking customers into extended cycles of service through long-lead cancellation policies. Contracts must clearly outline these phases to provide transparency and predictability for IT departments planning a major infrastructure shift. By standardizing these windows, the regulator aims to reduce the organizational friction that often discourages companies from seeking better service or lower pricing elsewhere.
Once the migration begins, the transitional period is limited to 30 calendar days, during which the original provider must maintain full service availability to ensure the customer’s business continuity. This phase is the most technically intensive part of the process, requiring the original provider to cooperate in the transfer of data and application settings. If a 30-day window is technically unfeasible due to the sheer volume of data or the complexity of the systems involved, the provider is required to justify the delay within 14 days and propose an alternative schedule. This extension cannot exceed seven months, ensuring that even the most complex enterprise migrations have a definitive endpoint. Following the migration, a 30-day retrieval period provides a final safety net, allowing the customer to access their original data one last time to verify that the transfer was successful and that no corruption occurred during the move.
The Financial Paradigm: Phasing Out Exit Fees
The most significant economic impact of the ACM guidance is the staged elimination of switching fees, which have historically served as a major deterrent for customers looking to leave a provider. We are currently in a transition phase where providers are only permitted to charge “direct costs” associated with the switch. These costs are narrowly defined as expenses directly linked to the migration, such as the specific bandwidth used for data egress or the technical labor required for data transformation and testing. Crucially, if a provider outsources these tasks to a third party, they are prohibited from passing those overheads on to the customer with a markup. This interim period is designed to allow providers to adjust their business models while immediately providing relief to customers who have been trapped by high exit penalties.
The landscape will shift even more dramatically on January 12, 2027, when all switching fees will be legally prohibited across the European Union. From that date forward, the financial cost of moving from one cloud provider to another—in terms of administrative and egress penalties—will be zero. This total ban is intended to shift the competitive focus from contract-based retention to service-based excellence. Providers will no longer be able to rely on the high cost of departure to keep their clients; instead, they must compete on performance, security, and pricing. While early termination penalties for fixed-term contracts are still allowed, they must be proportionate and cannot exceed the total remaining value of the contract. This ensures that while providers have some protection for their long-term investments, they cannot use penalty clauses as a disguised form of switching fee.
Technical Interoperability: Standards for Seamless Integration
The technical obligations under the Data Act vary significantly depending on the service delivery model, with Software-as-a-Service (SaaS) and Platform-as-a-Service (PaaS) providers facing the most rigorous requirements. These entities are mandated to offer open interfaces, primarily through well-documented APIs, that allow for seamless data exchange and portability. These interfaces must be provided free of charge and must be non-discriminatory, meaning a provider cannot offer a degraded version of an interface to a customer who is moving to a direct competitor. Furthermore, the technical specifications for these interfaces must be listed in a public online register. This transparency ensures that third-party developers and competing providers can build the necessary bridges for data migration without needing to negotiate individual access for every customer.
For Infrastructure-as-a-Service (IaaS) providers, the requirement shifts from strict interoperability to a standard of “functional equivalence.” The ACM acknowledges that it is not reasonable to expect an infrastructure provider to rebuild its entire proprietary environment to match a competitor’s architecture. However, they must take every reasonable measure to ensure that a customer can achieve a materially comparable outcome at their new destination. This involves providing all necessary configuration settings, metadata, and file formats that would allow the destination service to function as intended. While a “cost-benefit escape” clause exists for highly specialized or niche functionalities where building a portable interface would be economically ruinous, the ACM intends to monitor these exemptions closely. This oversight prevents providers from labeling standard features as “niche” to avoid their interoperability obligations.
Global Data Sovereignty: Managing Foreign Access Requests
A major point of contention in the global cloud market is the potential for foreign governments to access non-personal European data, a concern highlighted by the reach of the U.S. CLOUD Act. The ACM guidance addresses this head-on by asserting that any request for data by a foreign government is considered unlawful if it conflicts with European or national laws, regardless of its legality in the requesting country. This creates a significant legal challenge for providers with global operations who may find themselves caught between a foreign warrant and European data sovereignty rules. To navigate this, the guidance mandates a three-step risk analysis flowchart that providers must follow before complying with any international data request. This process prioritizes existing international treaties and mutual legal assistance protocols as the only legitimate channels for such transfers.
In the absence of a formal treaty, providers must evaluate whether the foreign request is reasoned, specific, and proportionate, and they must determine if the customer has the legal standing to object in a court that protects EU interests. The guidance strongly encourages the use of advanced encryption and regular third-party audits as technical safeguards against unauthorized government access. If a provider remains in a state of legal uncertainty, they have the option to seek official advice from the Dutch Ministry of Economic Affairs. Should the Ministry fail to provide a definitive response within 30 days, the provider is legally empowered to refuse the foreign government’s request. This framework effectively places the burden of proof on the requesting government and provides a robust legal shield for European businesses concerned about the confidentiality of their industrial data.
Regulatory Intersection: Aligning with GDPR and Resilience Frameworks
The Data Act does not operate in isolation; it is part of a complex web of European regulations including the General Data Protection Regulation (GDPR), the Digital Operational Resilience Act (DORA), and the NIS2 Directive. The ACM clarifies that in any situation where personal and non-personal data are inextricably mixed, the privacy protections of the GDPR take precedence. This ensures that the push for data portability does not inadvertently lead to a compromise in individual privacy rights. For companies operating in the financial services or critical infrastructure sectors, the requirements of DORA and NIS2 may actually impose even stricter migration timelines than the Data Act itself. These sectors often require near-instantaneous failover and switching capabilities to maintain national security and economic stability, and the ACM will work in tandem with other regulators to manage these overlapping mandates.
The interplay with the Digital Markets Act (DMA) is particularly relevant for the largest cloud providers, often referred to as “gatekeepers.” These systemic entities face an additional layer of oversight regarding self-preferencing and the use of proprietary data to gain an unfair advantage over smaller competitors. The ACM’s guidance serves to harmonize these various rules, providing a unified enforcement strategy that simplifies compliance for smaller players while holding the giants of the industry to a higher standard of transparency. By aligning the Data Act with existing resilience and privacy frameworks, the regulator ensures that the drive for a more competitive market does not come at the expense of security or individual rights. This holistic approach is designed to create a digital environment that is both open and resilient, providing a stable foundation for the next decade of European innovation.
MarTech Evolution: Implications for Modern Marketing Stacks
The marketing and advertising industry, which heavily relies on complex multi-cloud ecosystems, stands to benefit significantly from the clarity provided by the ACM. Modern marketing technology, or MarTech, typically involves a highly fragmented stack where customer data moves between CRMs, analytics platforms, and automated delivery tools. The ACM’s purpose-based definition confirms that most SaaS marketing tools are squarely within the scope of the Data Act. This is a game-changer for Chief Marketing Officers who have previously struggled with the high costs and technical difficulty of moving large customer datasets between competing analytics vendors. The removal of “taxation fees” on data egress means that marketing teams can now adopt a more modular approach, choosing the best-in-class tool for each specific task without worrying about the financial penalties of data movement.
The parallel-use provisions are especially critical for the advertising sector, where real-time data exchange between different platforms is the norm. By ensuring that APIs remain free and accessible, the regulation prevents large, end-to-end marketing suites from using their dominant position to lock out specialized startups. This fosters a more innovative environment where niche marketing tools can compete on a level playing field with integrated platforms. Ultimately, the ACM’s guidance encourages a shift away from closed ecosystems toward a “best-of-breed” strategy for digital infrastructure. As the technical and financial barriers to movement are lowered, we can expect to see a surge in innovation within the MarTech space, as providers are forced to offer more value and better integration capabilities to retain their customer base in a truly open market.
Implementation Strategies: Preparing for the Future Landscape
As the January 2027 deadline for the total abolition of switching fees approaches, businesses must proactively audit their current cloud contracts and technical architectures. The ACM has made it clear that the “good faith” mandate requires more than just passive compliance; providers must actively work to identify and remove any obstacles that might hinder a customer’s ability to migrate. For enterprises, this means reviewing existing Service Level Agreements (SLAs) to ensure they reflect the new legal timelines for notice and transition. IT leaders should also begin documenting their data dependencies and investigating the interoperability of their current SaaS and PaaS tools. Preparing for this shift now will allow organizations to take full advantage of the competitive pricing and improved service quality that the Data Act is intended to stimulate.
The long-term impact of these rules will likely be a fundamental shift in how cloud services are sold and managed. We are moving toward a landscape where service providers must differentiate themselves through superior performance and customer support rather than restrictive contractual terms. This evolution will require global providers to standardize their offerings to meet European requirements, a process that often leads to these higher standards being adopted globally—a phenomenon known as the “Brussels Effect.” By establishing clear rules for data sovereignty and interoperability, the ACM and the EU are setting the stage for a more mature and resilient digital economy. Organizations that embrace these changes early by building flexible, multi-cloud architectures will be best positioned to thrive in an era where data portability is not just a regulatory requirement but a core competitive advantage.
