EU Data Act and Cloud Switching: How the Rules Change SaaS Exit Costs

The EU Data Act (Regulation (EU) 2023/2854) obliges providers of cloud and software-as-a-service (SaaS) "data processing services" to let customers switch to another provider or to on-premise infrastructure: up to two months' notice, a transition period of at most 30 days, at least 30 days to retrieve data, and no switching charges from 12 January 2027. For a customer data platform (CDP) or email service provider (ESP), that makes exit rights enforceable terms.

Who this is for: CTOs, procurement leads and DPOs renegotiating or exiting SaaS customer-data contracts. Part of the regulation hub.

What the Data Act requires: Chapter VI, Articles 23 to 31

Chapter VI, "Switching between data processing services", runs from Article 23 to Article 31 1. It has applied since 12 September 2025 (Art. 50) and covers providers "irrespective of their place of establishment" when they serve customers in the Union (Art. 1(3)(f)) 1. Member State authorities enforce it, set the penalties (Art. 40(1)) and handle complaints (Art. 38) 1.

Notice, transition and retrieval periods

1. Notice. You start the switching process; the contract may require notice of at most two months (Art. 25(2)(d)). At the end of that period you confirm whether you will move to another provider, move to on-premise infrastructure or erase your data (Art. 25(3)).
2. Transition. The provider must complete the switch within 30 calendar days of the notice period ending, giving reasonable assistance, keeping the service running and keeping security high (Art. 25(2)(a)). You may extend the transition once (Art. 25(5)).
3. Infeasibility. If 30 days is technically unfeasible, the provider must say so within 14 working days of your request, justify it and propose an alternative of at most seven months (Art. 25(4)).
4. Retrieval and erasure. You get at least 30 calendar days to retrieve data after the transition, then guaranteed full erasure of exportable data and digital assets (Art. 25(2)(g), (h)).

Does the Data Act apply to SaaS such as a CDP or ESP?

Yes. A "data processing service" is a digital service giving on-demand network access to a shared pool of configurable, scalable and elastic computing resources (Art. 2(8)) 1. The Commission's FAQ states that this covers infrastructure (IaaS), platform (PaaS) and software (SaaS) services, and that Chapter VI does not distinguish between types of SaaS 2. The test is whether you are a "customer" contracting for the service (Art. 2(30)).

Not every duty applies to every model:

• Functional equivalence (rebuilding comparable functionality at the destination) is an infrastructure-service duty only (Art. 30(1)) 12.
• SaaS and PaaS providers must offer open interfaces free of charge, be compatible with standards once published in the Union repository, and export data in a structured, commonly used, machine-readable format (Art. 30(2) to (5)) 125.
• No rebuild duty. The source provider's obligations are limited to its own services (Art. 24); it need not rebuild your configuration in the destination's environment 2.
• Switching targets include on-premise infrastructure (Art. 2(34), Art. 25(2)(a)) 1. Moving from a SaaS CDP to a customer-owned deployment is within scope.

Custom-built services are not fully excluded: Article 31(1) lifts only specified duties (Articles 23(d), 29, 30(1) and 30(3)), so open interfaces and data export still apply 12. A SaaS product that meets the "custom-built" test may get the lighter regime 2.

Switching charges, egress fees and 12 January 2027

From 11 January 2024 to 12 January 2027 providers may charge only reduced switching charges, capped at the costs directly linked to the switch. From 12 January 2027 they may charge none (Art. 29) 1. "Switching charges" exclude standard service fees and early termination penalties (Art. 2(36)); data egress charges for extracting data are inside the definition (Art. 2(35)) 1.

That does not mean every data-movement fee disappears; do not read the Data Act as "egress becomes free".

The Commission's reasoning is that a parallel deployment implies constant egress rather than a one-off 2. If your architecture is multi-cloud, negotiate egress rates now.

Digital Omnibus: what is proposed, not law

The Commission's Digital Omnibus package of November 2025 proposes changes to the Data Act. According to a July 2026 law-firm analysis of the Council's consolidated compromise text, which can still change, the proposal would 3:

• add an exemption for "adapted standard services" (most features adapted to one customer) in contracts concluded on or before 12 September 2025, alongside the existing custom-built carve-out;
• exempt small and medium-sized enterprise (SME) and small mid-cap providers of non-infrastructure services from switching duties for those older contracts; infrastructure providers and the Article 29 charge regime stay in scope;
• let all providers include proportionate early termination penalties in fixed-term contracts;
• spare providers from renegotiating pre-12 September 2025 contracts before expiry, leaving unclear whether Article 29(4) to (6) apply and which charges survive after 12 January 2027.

What it means for CDP and ESP contracts

What counts as exportable data and digital assets?

"Exportable data" is input and output data, including metadata, directly or indirectly generated or co-generated by your use of the service, excluding the provider's or third parties' trade secrets and protected assets (Art. 2(38)). "Digital assets" are elements you have the right to use independent of the contract, including applications and, per the FAQ, configuration, security and access settings (Art. 2(32)) 12.

For a CDP or ESP, our reading is that this should include event history, unified profiles and identity-resolution outputs, computed traits, segment membership, consent and suppression records, send logs, and the configuration behind them: schemas, segment definitions, journeys, connectors and templates. The vendor's matching algorithms and model weights are protected. This is an interpretation, not settled law, so list each category in the contract. Article 25(2)(f) allows only an exhaustive list of exempt provider-internal categories, and exemptions may not delay switching.

Exit-readiness checklist

• Inventory every SaaS contract holding customer data: renewal date, notice terms, signing date (before or after 12 September 2025).
• Confirm each vendor is a data processing service and note any Article 31 exemption in the order form.
• Map the data you would need in a new environment: events, profiles, identity links, consent and suppression state, configuration.
• Obtain the vendor's switching documentation and format register (Art. 26).
• Run a test export and import into a scratch environment; record row counts, checksums and gaps.
• Verify consent state, suppression lists and opt-out timestamps survive export intact.
• Price the exit: standard fees through notice, any early termination penalty, agreed services, in-parallel egress.
• Prepare a switching-request template and keep the dated notice and the vendor's reply.
• Define the runbook (dual-run, cut-over, rollback, owner) and capture erasure certificates after retrieval.
• For financial entities, align with exit strategies under the Digital Operational Resilience Act (DORA); see DORA and your marketing stack.

For a longer sequence, see the 90-day plan for migrating off a SaaS CDP and the cloud exit template.

Clause list for CDP, ESP and martech agreements

When SaaS is still right, and when ownership changes the math

SaaS remains sensible for many teams: less to operate, faster to start. The Data Act lowers the cost of leaving but does not give you a working replacement; the source vendor owes export, not a rebuilt setup 2. Sender reputation and tuned models may not travel with the data, so budget for warm-up and retraining.

Customer-owned deployments change the exit equation. With PrivyCDP, Meiro or another self-hosted or private-cloud option, data and configuration already sit in your environment, so exit becomes a license and migration decision rather than an export request, while you take on operations. The self-hosted CDP guide and lock-in clauses guide compare the options, and the RFP template includes switching requirements.

If you are weighing a move from SaaS to a customer-owned deployment before your next renewal, an exit-readiness review scopes the export, the target environment and the license. More playbooks are in the regulation hub.