EU Data Act and Cloud Switching for Data Room Users

The EU Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. For virtual data room users, the key obligation is straightforward: your cloud provider must let you switch. Articles 25 and 34 give you a right to retrieve your data, move it to a new provider, and receive switching assistance for up to 30 days.

The Act covers all data processing services, which includes SaaS virtual data rooms. It complements GDPR by extending portability rights to non-personal data, closing a gap that left organisations with no enforceable right to exit proprietary data formats.

This guide explains what the EU Data Act requires of VDR providers, how it changes contract negotiations, what charges apply (and when they must be reduced to zero), and how to use it as a procurement filter when comparing data room vendors.

Published: May 2026. Updated: 26 July 2026.

What the EU Data Act Covers for Data Room Users

Regulation (EU) 2023/2854, known as the EU Data Act, entered into force on 11 January 2024 and became applicable on 12 September 2025. It establishes harmonised rules on fair access to and use of data across the EU single market.

For virtual data room procurement, Chapter VI of the Act is the operative section. It applies to "data processing services", defined broadly to include cloud computing services such as infrastructure as a service, platform as a service, and software as a service. A SaaS virtual data room falls squarely within that definition.

The Act applies regardless of where the provider is headquartered, provided the service is offered to customers located in the EU. This means US-based VDR providers serving European deal teams are subject to the same switching-assistance obligations as European providers.

Regulation (EU) 2023/2854: the formal citation.
Applicable from: 12 September 2025.
Covers: all data processing services offered to EU customers, including SaaS VDRs.
Scope of data: personal and non-personal data, covering the full contents of a data room.
Territorial scope: applies to providers established outside the EU when they serve EU customers.

Procurement note: Check that your VDR provider's terms of service have been updated to reflect the EU Data Act obligations in force from September 2025. Providers that have not updated their contracts are technically non-compliant.

Cloud Switching Rights Under Article 25

Article 25 grants customers of data processing services the right to switch to a different provider or to self-host. The provider must facilitate the switch, including by making available all data held on the customer's behalf, in a format that is technically usable and structurally complete.

Article 34 specifies the switching assistance obligations: the outgoing provider must cooperate with the incoming provider or the customer's own infrastructure for up to 30 days (Article 35), providing continuity of the service while the data migration completes. This 30-day maximum transition period prevents providers from using the complexity of migration as a lock-in tool.

Article 36 addresses switching charges. Providers may charge for switching assistance up to a cap, but those charges must be reduced to zero by 12 September 2027. This two-year wind-down period means that data room contracts signed before September 2027 should include a clause confirming that exit charges will be eliminated by the regulatory deadline.

Article 25: right to switch; portability of data in a usable format.
Article 34: switching assistance obligations on the outgoing provider.
Article 35: maximum 30-day transition period for switching assistance.
Article 36: switching charges to be reduced to zero by 12 September 2027.
Format: data must be provided in a commonly used, machine-readable, open format where possible.
Non-personal data: portability rights apply to all data in the room, not only personal data covered by GDPR Article 20.

What This Means for Your VDR Contract

The EU Data Act gives buyers negotiating leverage they did not previously have. Before September 2025, a VDR provider could refuse to support migration, charge high exit fees, or deliver data in proprietary formats that made switching impractical. The Act removes those options for EU contracts.

When reviewing or renewing a VDR contract, buyers should verify the following points:

Exit data format: confirm the provider exports all documents, audit logs, Q&A records, and metadata in a standard format (PDF, JSON, CSV) that does not require the provider's own tool to read.
Portability clause: confirm the contract references Article 25 compliance and does not contain terms that contradict it, such as prohibitions on data extraction or minimum notice periods exceeding 30 days.
Switching assistance period: confirm the provider commits to 30-day continuity of service during a switch, as required by Article 35.
Exit charges: if the provider currently charges for data export or migration support, confirm a contractual commitment to reduce those charges to zero by 12 September 2027.
Sub-processor data: confirm that data held by sub-processors is included in the scope of the portability obligation, not just data held directly by the provider.
Self-hosting option: note whether the provider offers a self-hosted deployment path, which represents the ultimate expression of the portability right and eliminates lock-in structurally.

Buyer tip: Request the provider's EU Data Act compliance statement before signing. A provider that cannot produce one has not completed the required contractual updates.

A Worked Example: Meridian Capital Advisory

Meridian Capital Advisory is a mid-market M&A advisory firm based in Brussels, advising on transactions in the EUR 50 million to EUR 250 million range across the Benelux and German markets. It runs an average of six data rooms per year, using a SaaS VDR provider contracted on an annual subscription.

In October 2025, Meridian completes a sell-side mandate for a Belgian industrial components manufacturer. The data room held approximately 4,200 documents, 18 months of Q&A records, and audit logs covering 47 bidder contacts. The deal closes, and Meridian wants to migrate to a different VDR provider that offers better pricing transparency and EU Frankfurt hosting for future deals.

Before the EU Data Act, Meridian's options were limited. The incumbent provider's terms required 60 days' notice to terminate, charged a migration fee equivalent to one month's subscription, and delivered documents in a proprietary archive format that required the provider's own extraction tool to open reliably.

Under the EU Data Act, the position is materially different. Meridian invokes its Article 25 switching rights, requests its full data set in an open format (PDF documents, JSON audit log, CSV Q&A export), and requests 30-day switching assistance under Article 34. The provider is legally required to comply. The migration charge, while still applicable in October 2025, is on a regulatory glide path to zero by September 2027, which Meridian notes in its contract renewal with the incoming provider.

The practical outcome: Meridian migrates cleanly in three weeks, with its full deal history intact, without paying a punitive exit fee, and with confidence that the same rights will apply in future switches. The EU Data Act does not make switching free or frictionless, but it makes it enforceable.

Papermark: Best for EU Data Act-Ready Data Rooms

Papermark is best for teams that want a data room with EU Data Act-ready portability, published pricing, no vendor lock-in, and self-hosting as a deployment option.

Papermark is headquartered in Munich and defaults to EU hosting in ISO 27001-certified data centres in Frankfurt. It is SOC 2 Type II certified and GDPR compliant. Critically for EU Data Act compliance, Papermark publishes all pricing on its website without requiring a sales call, and its open-source codebase is publicly available for inspection.

The self-hosting option on the Enterprise tier represents the most complete answer to the EU Data Act portability obligation. When a buyer self-hosts Papermark on their own EU infrastructure, there is no third-party cloud provider to switch from: the data is already under the buyer's direct control, and migration between environments requires no external cooperation.

For teams that prefer managed SaaS, Papermark's standard contracts are built around open data formats and a clean exit process. Documents are stored and exportable as standard PDFs, audit logs as JSON, and Q&A records as CSV. There is no proprietary archive format that traps data inside the platform.

Papermark pricing (verified July 2026): Free at EUR 0, Pro at EUR 24/month, Business at EUR 59/month, Data Rooms at EUR 99/month (unlimited data rooms, 3 team members), Enterprise on request.

Visit Papermark for current pricing and the self-hosting deployment guide.

Common Mistakes When Evaluating a VDR Under the EU Data Act

The most common mistake is not checking exit terms before signing. Buyers focus on onboarding experience, feature lists, and price, but rarely read the termination and data-return clauses before committing to a multi-year contract. Under the EU Data Act, the provider is required to support switching, but the contract may still contain notice periods, minimum terms, and format restrictions that create friction. Reading the exit clause before signing is now a procurement standard, not an optional due-diligence step.

A second mistake is assuming that GDPR Article 20 data portability rights cover all data in a virtual data room. GDPR Article 20 applies only to personal data processed on the basis of consent or contract, and only when the data was provided by the data subject. The EU Data Act extends portability to all data held by the service, including non-personal data such as financial models, legal drafts, and commercial documentation. Buyers who relied on GDPR portability as their exit protection had incomplete coverage before September 2025.

A third mistake is not requesting data format specifications before contract signature. Many VDR providers offer export functionality but deliver data in proprietary archive formats, compressed bundles, or formats that require paid tooling to open. The EU Data Act requires that data be provided in a commonly used, machine-readable, open format where one is available. Buyers should ask, in writing, what format the export will take, before signing.

A fourth mistake is overlooking sub-processor data scope. The main provider's obligation extends to data it processes directly, but data held by sub-processors, including document storage, backup, and search-index services, may require separate retrieval steps. Buyers should confirm that the portability obligation covers the full data set, including sub-processor-held copies.

A fifth mistake is ignoring the switching charge timeline. Charges for switching assistance are permitted until 12 September 2027. Buyers who sign long-term VDR contracts without a clause confirming charge elimination by that date may find themselves negotiating the point again at contract renewal, without contractual leverage.

Frequently Asked Questions

When does the EU Data Act apply to virtual data rooms?

The EU Data Act (Regulation (EU) 2023/2854) became applicable on 12 September 2025. It applies to SaaS virtual data rooms offered to customers located in the EU, regardless of where the provider is headquartered. Providers that had not updated their contracts by that date are technically non-compliant with the switching-assistance obligations.

What is 'cloud switching' under Article 25?

Cloud switching under Article 25 is the right of a customer of a data processing service to switch to a different provider or to self-host, with the outgoing provider required to make available all data in a usable, open format and to provide switching assistance for up to 30 days. The right applies to all data held by the service, not only personal data.

Does the EU Data Act give me the right to export all my VDR data?

Yes. The EU Data Act requires data processing services, including SaaS VDRs, to make available all data held on the customer's behalf in a commonly used, machine-readable, open format. This covers documents, audit logs, Q&A records, metadata, and any other data held by the service or its sub-processors on behalf of the customer.

How does the EU Data Act differ from GDPR data portability?

GDPR Article 20 data portability applies only to personal data processed on the basis of consent or contract, and only when provided by the data subject. The EU Data Act extends portability to all data held by the service, including non-personal data such as financial models, board materials, and commercial documentation. The two rights are complementary: GDPR covers the personal-data layer; the EU Data Act covers everything else.

What should I check in a VDR contract for EU Data Act compliance?

Check five things: the export format (must be open and machine-readable, not proprietary), the exit notice period (must not create switching barriers beyond 30 days of transition assistance), the switching charge timeline (must be reduced to zero by 12 September 2027), the scope of sub-processor data included in the portability obligation, and whether a self-hosting option is available as an alternative to switching.

Does the EU Data Act apply to US-based VDR providers?

Yes. The EU Data Act applies to any data processing service offered to customers located in the EU, regardless of where the provider is established. A US-headquartered VDR provider serving EU deal teams is subject to the same Article 25 switching-assistance obligations as a European provider. Providers that have not updated their EU customer contracts are non-compliant.