In brief
A decade after the adoption of the Trade Secrets Directive, confidential business information increasingly sits within a broader EU framework promoting access to and reuse of data. Alongside the European Health Data Space Regulation (see our related article here), the Data Act introduces access and sharing rights for data generated by connected products and related services, including data that qualify as trade secrets.
To mitigate legal and compliance risks, businesses must identify protected information within their datasets, implement proportionate safeguards and substantiate any decision to withhold, suspend or, in exceptional circumstances, refuse disclosure.
In more detail
What is the Data Act?
Objectives. The Data Act is an EU Regulation adopted in 2023 to harmonize rules on access to and use of data generated by connected products in order to "respond to the needs of the digital economy and to remove barriers to a well-functioning internal market for data" as explained under Recital 4. It enables users in the EU to access data generated through their use of a connected product or related service and to share those data with third parties.
Connected products and related services may notably include:
- Connected vehicles and software remotely controlling their functions
- Industrial and agricultural machinery and associated operational software
- Medical and health devices and applications allowing users to adjust their functions, such as an insulin-pump application
- Home equipment and applications controlling functions such as temperature or energy consumption.
Scope of application. The Data Act:
- Covers personal and non-personal product data and related-service data, including raw and pre-processed data and relevant metadata. Inferred or derived insights produced through additional investment, potentially protected by intellectual property rights, are generally excluded
- Applies primarily to manufacturers of connected products placed on the EU market, related-service providers, users, data holders and third-party recipients. For instance, for a connected insulin pump, these may include the pump manufacturer, the control-app provider, the patient, the platform operator holding the data, and a healthcare or maintenance provider selected by the patient to receive the data
- Has applied generally since 12 September 2025. Article 3(1)'s access-by-design requirement applies to connected products and related services placed on the market after 12 September 2026.
How does the Data Act interact with trade secrets?
Data access rights. Under Articles 4 and 5, where users cannot access data directly, data holders must provide them, upon request and without undue delay, with readily available data and metadata, free of charge and, where feasible, continuously and in real time. At the user's request, the same data must be made available to a third party under comparable accessibility and quality conditions.
These obligations may cover data qualifying as trade secrets under the Trade Secrets Directive (i.e., trade secrets are protected where information is secret, has commercial value because it is secret, and has been subject to reasonable steps to keep it secret).
Trade-secrets coverage. Trade-secret status does not automatically exclude data from the access regime. Instead, the Data Act provides two main safeguards:
- Pre-disclosure safeguards. Before disclosure, the data holder, or the trade secret holder if different, must identify the protected data and agree with the user or third party on proportionate technical and organisational measures to preserve confidentiality. Articles 4(6) and 5(9) refer to measures such as contractual terms, confidentiality agreements, access protocols, technical standards and codes of conduct. Operating this mechanism at scale may be burdensome where data flows are continuous or involve many recipients.
- The "trade secrets handbrake". Under Articles 4(7) and 5(10), the data holder may withhold or suspend sharing where no agreement is reached on necessary measures, the agreed measures are not implemented, or confidentiality is undermined. In exceptional circumstances, Articles 4(8) and 5(11) also permit refusal to share specific data where objective evidence demonstrates that disclosure is highly likely to cause serious economic damage. Recital 31 refers to serious and irreparable economic loss. One could argue that the disclosure of a trade secret to various parties could in itself constitute serious harm, since the protection of such information rests precisely on its confidential nature. However, the legislative process indicates a high threshold, such as losses threatening the data holder's viability or creating a serious bankruptcy risk.
A decision to withhold, suspend or refuse access must be notified to the competent authority, and its reasoning communicated to the user or third party without undue delay. A mechanism for filing a complaint with the competent authority is also provided if the user or third party disagrees with the data/trade secret holder's decision.
Practical difficulties
Identification of trade secrets. Only particular data points or combinations may satisfy the Trade Secrets Directive criteria. Raw data do not automatically qualify, but may do so depending on their nature, aggregation and context, and the assessment may evolve over time.
Proof of serious economic damage. To our knowledge, there is not yet an established body of EU or national case law interpreting the refusal mechanism. Data holders should preserve contemporaneous evidence of the causal link between disclosure and anticipated harm, addressing the data's competitive significance, the investment made in developing and protecting the data, whether core know-how could be reconstructed, the recipient's ability to exploit the data, and the limitations of proposed safeguards.
Competent authorities. Several Member States have yet to designate the competent authority required under Article 37 of the Data Act. In France, draft legislation would assign this role to ARCEP (the French telecommunications and postal services regulator), but the bill has not been enacted and ARCEP has not been formally appointed. Spain has likewise not formally designated a competent authority. This creates uncertainty as to which bodies will receive notifications of decisions to withhold, suspend or refuse data access and handle related complaints. Furthermore, it remains to be seen how the competent authorities will process technically complex notifications and potential disputes in practice. Pending designation, data holders that restrict access should compile and date their notification file and submit it promptly once the relevant authority is appointed.
Model clauses. The Commission's non-binding model contractual terms translate Data Act safeguards into clauses covering identification, technical and organisational measures, audits, subsequent recipients and evolving datasets. However, sensitive elements remain for party-drafted appendices. Data holders must still conduct granular assessments and tailor and update safeguards for dynamic datasets and multiple recipients.
Call to Action – What trade secret holders should do now?
Trade secret holders should consider the following practical steps to prepare for and manage Data Act access requests:
- Map in-scope data, separating readily available product and related-service data from derived analytics, models and proprietary outputs.
- Identify trade secrets at field, metadata and combination level, and document reasonable steps, including classification, access controls, contracts, security and governance.
- Monitor disclosures and retain records of recipients, data, purposes, incidents, termination and deletion.
- Prepare evidence for any serious-economic-damage assessment and procedures for written decisions, notifications and disputes.
Final thoughts
The Data Act marks a fundamental shift, as trade secrets no longer justify non-disclosure as a matter of principle but may qualify the obligation to share data. Protection therefore depends on the data holder's operational ability to identify the trade secrets concerned and comply with the available safeguards.
Our Trade Secrets Team can assist with trade-secret mapping, reasonable-steps assessments, contract design, and the implementation of the trade secrets safeguards, including regulatory notifications and disputes concerning the scope or conditions of access.