Since 2010, the Global Law Experts annual awards have been celebrating excellence, innovation and performance across the legal communities from around the world.
posted 3 hours ago
The EU Data Act introduced a mandatory EU Data Act termination for convenience regime that fundamentally reshapes how cloud and SaaS contracts are negotiated, performed and exited across every Member State, including Ireland. Regulation (EU) 2023/2854, commonly known as the Data Act 2025, became applicable on 12 September 2025, and its Chapter VI provisions now require every in-scope data processing service contract to include enforceable switching rights, capped notice periods, data retrieval windows and limits on egress fees. For Irish in-house counsel, founders and procurement leads, the practical question is no longer whether the rules apply but how existing SaaS agreements must be rewritten to comply.
This guide translates the statutory text, particularly Article 25 and the broader Chapter VI framework, into a contracting playbook with model clauses, checklists and an Irish enforcement outlook for 2026.
Before diving into the switching mechanics, it is essential to understand which services fall within the Data Act’s reach and how the regulation interacts with Irish national law.
Chapter VI of the EU Data Act applies to providers of data processing services, a term defined broadly enough to capture Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) offerings. The decisive criterion is whether the service enables on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned. In practice, this means that a Dublin-based fintech purchasing a SaaS analytics platform, a logistics company running containers on a PaaS environment, or a multinational hosting workloads on IaaS infrastructure in an Irish data centre are all covered.
Certain narrowly defined services, bespoke software developed to order, on-premises licensed software not delivered “as a service,” and services where no customer data is stored or processed, may fall outside the scope. However, the boundary cases are few, and the safer compliance posture is to assume in-scope status for any cloud-delivered service unless a formal legal assessment concludes otherwise.
The EU Data Act entered into force on 11 January 2024 and became applicable across all Member States on 12 September 2025. As a directly applicable EU Regulation, it does not require transposition into Irish statute in the way that an EU Directive would. Irish customers and vendors are therefore already bound by its terms.
However, several implementation steps remain Ireland-specific. The Data Act requires each Member State to designate one or more competent authorities to monitor and enforce compliance, and to lay down rules on penalties for infringement. As of mid-2026, the Irish Government has signalled its intention to designate relevant authorities through secondary legislation, but final confirmation and detailed enforcement guidance are still expected. Industry observers expect the Department of Enterprise, Trade and Employment or a specialist body within Ireland’s existing regulatory architecture to assume this role.
For contracting purposes, the takeaway is unambiguous: the substantive obligations, switching rights, notice periods, data portability, egress fee limits, are already law. Irish parties that have not yet updated their SaaS and cloud contracts face compliance risk today, regardless of when the Irish enforcement mechanism is formally stood up.
Chapter VI of the EU Data Act, and Article 25 in particular, creates a statutory floor of switching and termination rights that contract terms cannot undercut. The following sub-sections translate the key provisions into actionable contracting guidance.
Article 25 mandates that contracts for data processing services include specific clauses addressing the customer’s right to switch provider or to port data back in-house. The core requirements can be summarised as follows:
The table below maps the principal statutory requirements to their practical contract effects:
| Provision | Statutory reference | Practical contract requirement |
|---|---|---|
| Mandatory switching right / termination for convenience | EU Data Act, Article 25 & Chapter VI | Contract must allow the customer to initiate switching with a maximum of two months’ notice; vendor must cooperate with migration. |
| Data retrieval window minimum | Article 25, transitional period provisions | Minimum 30 calendar days for data retrieval after the transitional period begins, unless a longer period is agreed. |
| Proportionate early termination penalties | Chapter VI, penalty and fee provisions | Proportionate penalties for data processing services are permitted but punitive lock-in fees are prohibited; any charge must be objectively justifiable. |
| Machine-readable export format | Article 25, data format requirements | Vendor must export data in a structured, commonly used and machine-readable format enabling functional equivalence. |
The Data Act does not prohibit all charges on exit. It permits providers to levy proportionate penalties, a concept that requires the fee to reflect genuine, demonstrable costs incurred by the provider rather than serving as a deterrent to switching. The likely practical effect is that vendors can recover costs directly attributable to bespoke migration work, early wind-down of dedicated infrastructure, or pre-paid capacity that cannot be re-allocated. What vendors cannot do is impose flat-rate exit fees, clawbacks of cumulative discounts simply because the contract ends early, or penalty schedules designed to make switching economically irrational.
Proportionality is assessed on a case-by-case basis. Early indications suggest that regulators and courts will look at:
For Irish SaaS buyers, the commercial implication is clear: insist on cost-audit rights and require the vendor to certify that any exit charge complies with the Data Act proportionality standard. For vendors, the safest posture is to pre-calculate a reasonable cost-recovery schedule, disclose it in the contract and be prepared to substantiate every line item if challenged.
Understanding the statutory deadlines is essential for both procurement teams planning migrations and vendors designing their offboarding workflows.
Under the Data Act, a customer may give notice to switch at any time, and the maximum permissible notice period is two calendar months. This means that even where a SaaS contract runs for a fixed term of, say, 36 months, the customer retains the right to initiate switching on two months’ notice. The contract may set a shorter notice window, and many enterprise buyers will negotiate for 30 days, but it cannot set a longer one.
During the notice period, the vendor must begin preparing the switching process: identifying the data to be ported, confirming export formats, provisioning API access or bulk-download credentials, and assigning a migration-support contact. The two-month clock starts on receipt of written notice from the customer, not on any approval or acknowledgement by the vendor.
While the statute sets a maximum notice period, the total migration timeline, from notice to full cut-over, will vary by workload complexity. A recommended contracting approach is to distinguish between:
In both scenarios, the 30-calendar-day minimum retrieval window after the transitional period begins is non-negotiable. Contracts that compress this period below the statutory floor are unenforceable to that extent.
The Data Act’s portability and fee provisions complement the termination for convenience right. Together they ensure that the right to switch is not rendered hollow by prohibitive costs or incompatible data formats.
General counsel in Ireland are already familiar with GDPR Article 20 data portability. The EU Data Act portability obligation is different in several important respects:
Where personal data is involved, both regimes apply in parallel. A well-drafted Irish SaaS contract should therefore include distinct clauses for GDPR data-subject portability and Data Act customer-switching portability, each with its own scope, timeline and format specification.
The EU Data Act does not ban egress fees outright. It prohibits fees that are disproportionate or that have the practical effect of locking customers in. The following table provides a negotiation framework for Irish buyers and vendors:
| Fee type | Permitted under Data Act? | Negotiation guidance (sample cap) |
|---|---|---|
| One-off export cost recovery (actual costs) | Permitted if proportionate | Cap at documented cost plus a 10 % administrative margin; require itemised invoicing and cost-audit rights. |
| Ongoing monthly transfer fees | Generally disfavoured | Disallow except where high incremental bandwidth costs can be demonstrated; prefer a one-off reasonable cost recovery model. |
| Early termination penalty | May be permitted if proportionate and not a lock-in mechanism | Limit to demonstrable cost of bespoke transition work; cap as a percentage of the remaining contract term (e.g. 15–25 %) with a maximum absolute cap. |
| Data-format conversion charges | Permitted where conversion is genuinely additional work | Require the vendor to offer at least one export format at no charge; conversion to non-standard formats may carry a reasonable fee. |
Industry observers expect that, as enforcement bodies across the EU begin issuing guidance, quantitative benchmarks will emerge. Until then, Irish procurement teams should treat the proportionality standard as a negotiation tool: any fee the vendor cannot justify with documented costs is vulnerable to challenge.
The following model clauses are designed for use in Irish SaaS agreements. They reflect the minimum requirements of the EU Data Act and can be adapted to specific commercial contexts. Each clause is presented first in a buyer-friendly version, then in a balanced vendor-compromise version, and finally as a data-format and handover specification.
Copyable clause, Buyer redline:
Clause [X], Termination for Convenience and Switching. The Customer may terminate this Agreement for convenience, or initiate a switch to an alternative data processing service or to an on-premises environment, by giving the Provider not less than [30/60] calendar days’ prior written notice (the “Switching Notice”).
Upon receipt of the Switching Notice, the Provider shall: (a) continue to provide the Services without degradation during the notice period and for a minimum of 30 calendar days thereafter (the “Retrieval Window”); (b) make available for export all Customer Data, including non-personal data, metadata, configurations and application-level data, in [JSON / CSV / Parquet / other agreed format], via secure API or bulk download; (c) provide reasonable migration assistance, including a dedicated migration contact and a written handover plan within 10 business days of the Switching Notice; and (d) not charge any egress, switching or early termination fee that exceeds the Provider’s documented, proportionate costs of facilitating the switch.
Any such fee shall be itemised and subject to the Customer’s audit rights under Clause [Y].
Annotation: This clause gives the buyer a unilateral exit right on notice shorter than the statutory maximum. It anchors the data retrieval window to the 30-day minimum, specifies export formats up front and ties any fee to the proportionality standard. Buyers should insert the specific file formats relevant to their workload and cross-reference their audit-rights clause.
Copyable clause, Vendor compromise:
Clause [X], Switching and Migration Assistance. Either party may terminate this Agreement for convenience on not less than 60 calendar days’ prior written notice. Where the Customer initiates a switch pursuant to this Clause, the Provider shall: (a) maintain the Services at the agreed service levels during the notice period and for a Retrieval Window of 30 calendar days following expiry of the notice period; (b) export Customer Data in a structured, machine-readable format as described in Schedule [Z]; (c) assign a migration coordinator within 5 business days of the Switching Notice and deliver a draft migration plan within 15 business days; (d) co-operate with the Customer’s replacement provider, subject to the replacement provider entering into a reasonable non-disclosure agreement.
The Provider may charge a Switching Fee not exceeding [€X,000 / the amount specified in Schedule Z], provided that such fee is proportionate to the Provider’s documented costs and does not serve as a barrier to switching. The Provider shall supply an itemised invoice for any Switching Fee within 10 business days of the end of the Retrieval Window. For the avoidance of doubt, no Switching Fee shall be payable in respect of data export in the standard format(s) described in Schedule [Z].
Annotation: This version protects the vendor’s legitimate cost-recovery interest while complying with the Data Act ceiling. The absolute cap (€X,000 or a schedule reference) should be negotiated at deal stage and benchmarked against the contract’s annual value.
Copyable clause, Handover spec:
Schedule [Z], Data Export and Handover Specification. (1) Export formats: The Provider shall make Customer Data available in the following formats: [e. g. JSON Lines for transactional data; CSV for reporting data; PostgreSQL-compatible SQL dump for relational databases; Parquet for analytical datasets]. (2) Transfer method: Data shall be downloadable via authenticated REST API endpoints and/or a secure bulk-download facility (SFTP or equivalent) with AES-256 encryption in transit and at rest. (3) Integrity verification: Each export file shall be accompanied by a SHA-256 checksum file. The Customer shall have 10 business days from receipt to verify data integrity and notify the Provider of any discrepancies.
(4) Access credentials: The Provider shall transfer or revoke IAM roles, service-account keys and API tokens as directed by the Customer, within 5 business days of the end of the Retrieval Window. (5) Escrow: Where the Agreement includes software escrow arrangements, the Provider shall instruct the escrow agent to release materials to the Customer concurrently with the data export.
Annotation: This schedule removes ambiguity about how data will be delivered. Specifying formats, transfer methods and integrity checks at contract stage prevents disputes during a migration that is often time-pressured. Irish buyers should map their data categories to the appropriate export format before signing.
The following checklists distil the legal and commercial requirements into quick-reference tools for procurement and legal teams.
As a directly applicable EU Regulation, the Data Act does not depend on Irish transposition for its substantive obligations to bind parties. However, effective enforcement requires each Member State to designate competent authorities and set out a penalties regime.
As of mid-2026, Ireland has not yet published a final statutory instrument designating its competent authority for Data Act enforcement. Industry observers expect the designation to follow a model similar to other EU digital regulations, potentially situating the function within an existing body such as the Competition and Consumer Protection Commission or a specialist division of the Department of Enterprise, Trade and Employment. The penalties framework, once enacted, is likely to align with the Data Act’s requirement for penalties that are “effective, proportionate and dissuasive.”
For Irish businesses, the practical implication is straightforward: compliance is already mandatory, and the absence of a fully operational Irish enforcement body does not create a compliance holiday. Contracts executed or renewed since 12 September 2025 that lack the required switching, portability and fee provisions are exposed to challenge, whether by a customer invoking the regulation directly in Irish courts, by a competitor filing a complaint once the competent authority is operational, or by a regulator acting on its own initiative. Companies operating in the Ireland information technology sector should monitor Irish Government publications for the designating statutory instrument and any accompanying guidance.
The EU Data Act termination for convenience regime is not a future obligation, it is current law, and every SaaS, PaaS and IaaS contract touching Irish customers or vendors must comply. The two-month notice cap, 30-day minimum data retrieval window, proportionate fee limits and machine-readable export requirements are non-negotiable statutory floors. Irish businesses that have not yet audited and updated their cloud contracts should treat this as an urgent compliance priority. A structured contract review, using the model clauses and checklists set out above, is the most efficient route to closing the gap before Irish enforcement arrangements are finalised.
Specialist information technology lawyers in Ireland can assist with bespoke clause drafting and vendor negotiations tailored to your specific workloads and commercial context.
This article was produced by Global Law Experts. For specialist advice on this topic, contact Dean Cunningham at Cunningham Solicitors, a member of the Global Law Experts network.
Member
Find the right Legal Expert for your business
Sign up for the latest advisor briefings and news within Global Advisory Experts’ community, as well as a whole host of features, editorial and conference updates direct to your email inbox.
Naturally you can unsubscribe at any time.
Global Advisory Experts is dedicated to providing exceptional advisory services to clients around the world. With a vast network of highly skilled and experienced advisors, we are committed to delivering innovative and tailored solutions to meet the diverse needs of our clients in various jurisdictions.
