Cloud services are a central component of the IT infrastructure of many organizations. However, switching to another cloud provider, or migrating back to an in-house IT environment, may involve significant contractual, economic, and technical challenges. Chapter VI of Regulation (EU) 2023/2854 (Data Act) aims to reduce such lock-in effects and facilitate switching between data processing services. The requirements apply in particular to providers of Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS), although it must be assessed on a case-by-case basis whether a specific service qualifies as a “data processing service” within the meaning of the Data Act.
Scope and Process of Provider Switching
Providers of data processing services must remove pre-contractual, commercial, technical, contractual, and organizational obstacles that hinder switching to another provider or migrating to an in-house IT infrastructure. Under the Data Act, cloud switching is not limited to a mere export of data. Rather, it covers the entire migration process, including the extraction and transfer of data and digital assets, as well as the necessary cooperation between the incumbent provider, the customer, and the destination provider.
New Requirements for Cloud Contracts
The new requirements for cloud contracts are particularly significant. Such contracts must transparently define the customer’s rights and the procedures for switching providers. This includes, in particular, the provider’s support services, the applicable switching timelines, the categories of exportable data and digital assets, the available export formats, known technical limitations, and provisions governing data availability and subsequent deletion. In addition, providers must supply information on switching procedures, portability methods, data structures, interfaces, and relevant interoperability standards.
Limitations on Switching Charges
The costs associated with switching providers will also be progressively restricted. Until 12 January 2027, providers may generally charge only reduced switching fees that do not exceed the costs directly incurred in connection with the switching process. From that date onward, switching charges will generally be prohibited. This must be distinguished from the customer’s actual internal or external migration costs, such as expenses for technical consulting, system modifications, testing, training, or temporary parallel operations. Consequently, the Data Act does not necessarily make cloud switching cost-free, but it does remove significant economic barriers imposed by the incumbent provider.
Technical Requirements and Practical Limitations
The technical obligations depend on the type of cloud service concerned. For IaaS services, the incumbent provider must take all reasonable measures within its control to facilitate functional equivalence with the destination provider for the customer. For PaaS and SaaS services, the Data Act places particular emphasis on open interfaces and, where published by the EU, open interoperability specifications and harmonized standards. Nevertheless, a completely seamless migration cannot be guaranteed. Proprietary architectures, complex system integrations, the absence of mature standards, and dependencies on multiple services within a cloud ecosystem may still result in substantial migration efforts.
Action Required for Providers and Customers
Providers of cloud services should first assess which of their offerings qualify as data processing services under Chapter VI of the Data Act. They should then review their contracts, pre-contractual information, and internal switching procedures to ensure that timelines, support services, export options, data deletion processes, and cost arrangements are fully and transparently documented. Providers should also define responsibilities for handling switching requests, prepare technical documentation covering available interfaces and export formats, and establish robust processes for cooperating with customers and destination providers.
Customers, too, should not wait until a planned migration to address cloud switching considerations. Already at the stage of selecting and implementing a cloud service, they should assess which data and digital assets can be exported, which formats and interfaces are available, which custom developments or configurations can be transferred, and what dependencies arise from integrated services. Existing exit and migration strategies should be reviewed against contractual provisions and, particularly for business-critical cloud services, tested in practice.
Conclusion
The Data Act significantly improves the legal framework for switching between cloud providers. However, it cannot eliminate all technical and organizational dependencies within complex cloud environments. It is therefore crucial to combine the new legal requirements with proactive cloud and exit governance. We would be pleased to assist you in assessing the applicability of the Data Act, updating your cloud contracts, and developing legally compliant and practically implementable switching and exit processes.
