Recently, more and more companies exporting to the EU have encountered a new issue: European buyers require products to comply with the EU Data Act. Many companies’ first reaction is: we only make treadmills, watches, appliances and equipment – why would a “data act” concern us?
The reason is simple: many products today are no longer pure hardware but connected products. As long as a product can connect to the internet, link to an app, upload data, sync to the cloud, receive remote updates or record how users use it, European buyers may ask for EU Data Act documentation.
In the past, EU buyers usually focused on:
-
CE (Conformité Européenne);
-
RoHS(Restriction of Hazardous
Substances);
-
RED (Radio Equipment Directive);
-
EMC (Electromagnetic Compatibility);
-
LVD (Low Voltage Directive);
-
GPSR (General Product Safety
Regulation).
These requirements mainly address product safety, radio, electromagnetic compatibility, hazardous substances and consumer safety. But the EU Data Act is about something else:
whether data generated by users while using connected products can be known, accessed and exported by users, and shared with third parties under certain conditions. In other words, buyers no longer ask only “is this product safe?” but also:
What data does this product generate? Can users get it? Can the data be given to third-party repairers, service providers or other platforms? In what format is it exported? Is there a charge? Which data involve trade secrets?
2. Case 1: Why Is a Connected Treadmill Asked to Comply with the EU Data Act?
For example, a smart treadmill can connect to an app, and after each workout the system records:
-
Workout time;
-
Speed; distance;
-
Calories;
-
Incline;
-
Training programs;
-
Device operating status;
-
Fault logs;
-
Firmware version;
-
Device pairing records.
Some of this data comes from user behavior and some from the device’s own operation. If the product is sold in the EU, European buyers may ask:
-
What data does the treadmill actually generate?
-
Is data generated in real time or after each workout?
-
Where is data stored – on the device, in the mobile app, on cloud servers or on a third-party platform?
-
Can users export their own workout records?
-
What is the export format – CSV (Comma-Separated Values), JSON (JavaScript Object Notation) or something else?
-
Can users authorize third-party fitness platforms, after-sales service providers or repairers to access the data?
-
How is user authorization confirmed when third parties access data?
-
If device fault logs involve the manufacturer’s internal diagnostic logic, are they trade secrets?
-
If providing data involves extra technical cost, is there a charge, and how is it set?
So European buyers ask treadmill makers to prepare EU Data Act documentation not because treadmills have become “medical devices” or “internet platforms”, but because they now have internet connectivity, data recording, cloud sync and app services.
3. Case 2: Smartwatches Are Even More Likely to Face This
Smartwatches are an even more typical example.
A smartwatch may record:
-
Steps;
-
Distance;
-
Heart rate;
-
Sleep time;
-
Workout routes;
-
Blood oxygen;
-
Calories;
-
Battery level;
-
Firmware version;
-
Sensor status;
-
Error logs;
-
Sync records with the mobile app.
If a user buys the watch, EU regulatory logic holds that the user should not merely “passively contribute data” but should have the right to know what the data are, where they are, how to get them and whether they can be shared with third parties. For example:
-
The user wants to sync workout data to a third-party health management platform;
-
The user wants to give device logs to an independent repairer;
-
The user wants to migrate from an old watch brand to a new one;
-
A corporate customer wants to integrate employees’ fitness device data into its own health management system;
-
A European distributor wants the after-sales diagnostic data it needs.
In these scenarios, the manufacturer must explain: which data can be provided? How? To whom? With what restrictions?
Simply answering “we value user privacy” or “contact customer service” is usually not enough. Buyers need more specific Data Act Information and a Data Access Procedure.
4. Which Products Are Most Likely to Be Asked About the EU Data Act?
In practice, the following products are more likely to face this issue when exported to the EU:
1. Smart wearables
Such as smartwatches, fitness bands, children’s GPS watches and smart rings.
These products usually record steps, heart rate, sleep, location, workout data and device logs.
2. Smart fitness equipment
Such as treadmills, rowing machines, spin bikes, strength training equipment and rehabilitation training equipment.
These products record the workout process, training results, device status and fault information.
3. Smart home products
Such as robot vacuums, smart locks, smart cameras, smart air conditioners and smart refrigerators.
These products record usage habits, operating status, home environment data, fault logs, etc.
4. Consumer electronics with apps
Such as Bluetooth headphones, smart speakers, smart lights, smart projectors and portable power stations.
Any product that pairs, updates, is controlled or syncs data via an app may be affected.
5. Industrial equipment and laboratory instruments
Such as robots, sensors, testing instruments, laboratory equipment and remotely maintained equipment.
These products may generate operating parameters, alarm information, maintenance data, production data and fault diagnostic data.
6. Medical and health devices
Such as remote monitoring devices, rehabilitation training devices, home testing devices and health management devices.
These products usually involve user data, device data, health data and cloud platform services at the same time, so they attract particular attention from buyers.
5. What Do Buyers Usually Ask Manufacturers to Provide?
When European buyers raise EU Data Act requirements, manufacturers usually cannot just provide an ordinary privacy policy; they need to provide the following.
1. What data the product generates, for example:
-
User usage data;
-
Device operating data;
-
Fault logs;
-
Maintenance data;
-
Connection data;
-
Cloud sync data;
-
App interaction data.
2. How often data are generated, for example:
-
In real time;
-
After each use;
-
Daily sync;
-
When a fault occurs;
-
During firmware updates;
-
When the user takes an action.
3. Where data are stored, for example:
-
On the product;
-
In the mobile app;
-
On cloud servers;
-
On servers in Europe;
-
On third-party service providers’ servers.
4. How users access data, for example:
-
Export via the app;
-
Download via a web account;
-
Request by email;
-
Request via an after-sales platform;
-
Access via an API (Application Programming Interface).
5. Data formats – common formats include:
-
CSV (Comma-Separated Values);
-
JSON (JavaScript Object Notation);
-
XML (Extensible Markup Language);
-
PDF (Portable Document Format);
-
API response formats.
For buyers, the clearer the data format, the easier it is to judge whether the product offers accessibility and portability.
6. How third parties access data – an important part; manufacturers should explain:
-
Whether users can authorize third-party access;
-
How third parties submit requests;
-
How user authorization is verified;
-
How long authorization lasts;
-
How users revoke authorization;
-
That third parties may not use data for unauthorized purposes.
7. Whether there is a charge, for example:
-
Whether direct user access to basic data is free;
-
Whether third-party access may involve reasonable technical costs;
-
Whether fees for interface development, data processing or manual review apply;
-
Whether charging rules are transparent.
8. How trade secrets are protected – not all data must be opened unconditionally. For example:
-
Motor control algorithms;
-
Internal diagnostic logic;
-
Training recommendation models;
-
Anti-cheating mechanisms;
-
Internal debugging parameters;
-
Security protection strategies.
These may involve trade secrets. Companies can set reasonable restrictions, such as de-identification, minimal disclosure, confidentiality agreements and limited access scope.
6. How Should Chinese Exporters Respond?
We recommend that companies proceed as follows.
Step 1: Determine whether the product is a connected product
First check whether the product has the following functions:
-
Connects to the internet;
-
Connects to an app;
-
Uploads data;
-
Has a cloud platform;
-
Supports remote updates;
-
Records user behavior;
-
Records device operating logs.
If the answer is “yes”, you need to consider the EU Data Act.
Step 2: Build a data inventory
List all data generated by the product, including:
-
Data name;
-
Data source;
-
Purpose;
-
Frequency;
-
Storage location;
-
Whether exportable;
-
Whether it can be provided to third parties;
-
Whether it involves trade secrets.
This step is crucial. Without a data inventory, subsequent declarations easily become vague.
Step 3: Set up a user access mechanism
At a minimum, companies should explain:
-
How users request data;
-
Who handles requests;
-
Response time;
-
Format provided;
-
Which data can be provided;
-
Which data cannot be provided, and why.
Step 4: Set up rules for third-party access
If users authorize third parties to access data, companies need basic procedures and conditions to prevent misuse.
Step 5: Prepare an EU Data Act document package
We usually recommend preparing:
-
Data Mapping Table
-
EU Data Act Information
-
Data Access Procedure
-
Third-party Access Terms
-
Trade Secret Assessment
7. Conclusion
The EU Data Act shows that EU product compliance requirements are changing. In the past, companies exporting to the EU focused mainly on product safety, radio, EMC, environmental requirements and labeling. Now, for smart hardware and connected products, European buyers also look at:
-
What data does the product generate?
-
Can users get it?
-
Can third parties be authorized to access it?
-
In what format is it provided?
-
Is there a charge?
-
How are trade secrets protected?
For Chinese manufacturers, the EU Data Act cannot be solved by simply writing a privacy statement; it requires building a document system, based on product functions, apps, cloud platforms, data types and after-sales service models, that can be explained and delivered to European buyers.
EVERBIZ Service Recommendations
EVERBIZ can help companies making smart hardware, digital products, medical and health devices, industrial equipment and connected products build an EU Data Act compliance document system, including: product data inventories;
-
EU Data Act Information
-
Data Access Procedure
-
Third-party Access Terms
-
Trade Secret Assessment
-
Responses to European buyers’ data compliance questionnaires;
-
Data compliance training for suppliers.
If you have already received EU Data Act requirements from European customers, we recommend not just revising your privacy policy but starting as soon as possible with a product data inventory and access mechanism, to build more complete compliance documentation that buyers will more readily accept.