The EU Data Act (Regulation (EU) 2023/2854) has applied in full since 12 September 2025. This article focuses on Article 41 of the Regulation, which aims to regulate data access and use and cloud computing contracts by providing non-binding model contractual terms.
The body of the standard terms for data access and use and cloud computing contracts is divided into two main modules – Model Contractual Terms (MCTs) and Standard Contractual Clauses (SCCs) – each with detailed supporting rules. Different templates with different detailed rules are chosen for different use cases.
The structure of the MCTs is as follows (non-binding contract templates drawn up by the European Commission as required by Article 41 of the Act):
The structure of the Standard Contractual Clauses (SCCs) is as follows:
The SCCs govern cloud data processing services. They focus on the entire life cycle of cloud services and cover key stages such as switching, termination and security, ensuring service portability and business continuity.
The MCTs and SCCs are mainly drafted for business-to-business contractual relationships. However, they can also be used in business-to-consumer relationships.
In that case, however, additional clauses must be added so that the contract complies with mandatory consumer protection rules (for example, the consumer’s right of withdrawal for contracts concluded online/at a distance).
Due to space constraints, this article presents one example each of the MCT and SCC terms. If your company needs other templates, please contact EVERBIZ Certification Services.
Introduction to Annex II of the Model Contractual Terms (MCTs)
The model contractual terms in Annex II are intended to help parties draft and negotiate contracts on access to and use of data (personal and non-personal data). They cover data access and use contracts between data holders and users of connected products and related services.
Note: the more detailed templates for the sub-sections in the table below (e.g. 1.1 Parties to the contract) are too long to include here. Please contact EVERBIZ Certification Services if you need them.
Introduction to Annex VI of the Standard Contractual Clauses (SCCs)
The Standard Contractual Clauses are intended to help parties contractually implement the rights and obligations laid down in the EU Data Act. They are a set of modular clauses that complement one another but can also be used individually, and they are designed to be inserted into data processing service agreements.
These SCCs are intended to help all customers and providers of data processing services within the scope of the EU Data Act, whether public, private or otherwise, and whether small, medium-sized or large.
In line with the EU Data Act’s definition of data processing services, these Standard Contractual Clauses apply to all cloud service models, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS), provided they have the characteristics set out in Article 2(8) of the EU Data Act.
The Standard Contractual Clauses (SCCs) under the EU Data Act do not incorporate the requirements of the General Data Protection Regulation (GDPR). Agreements should include contractual clauses that ensure compliance with the GDPR.
One concept in the Annex VI document deserves explanation: to determine the order of operations for exporting exportable data, you need to understand the structure of the data and the relationships between data, as shown below:
Differences between the Model Contractual Terms (MCTs) and the Standard Contractual Clauses (SCCs)
When exporting devices to the EU, some companies receive non-conformity notices requiring them to explain the distinction between the EU Data Act and the GDPR. We will cover this topic in the next issue.
More articles:
Introduction to the ISO/IEC 27701 Standard
The Relationship Between ISO 27701 and Regulation (EU) 2016/679
Introduction to the GDPR (General Data Protection Regulation) for EU Medical Devices
How Can Manufacturers Hedge Risk Through Insurance Under the MDR?