EU Data Act cloud-switching terms for a Cyprus SaaS provider

Decide whether the service is a Data Act data-processing service

Chapter VI targets providers of data-processing services that give customers on-demand network access to configurable computing resources. The Commission says the framework can include infrastructure, platform and software services, but an ordinary website or bespoke professional engagement is not automatically the same thing. Map the product's cloud architecture, customer control, scalability and service type against the Regulation's definition. For a Cyprus SaaS business, the relevant questions include whether customers use a hosted application with their own data, what can be exported, and whether they can move to a service of the same type or to on-premises infrastructure.

Article 23 requires removal of pre-commercial, commercial, technical, contractual and organisational obstacles that inhibit switching to another provider of the same service type, moving to on-premises infrastructure or, where relevant, using multiple providers. It also covers termination after the permitted notice and switching process. A cancellation button does not satisfy this if data export is incomplete or expensive. Conversely, the rule does not require a provider to recreate every unique function at a competitor. Identify precisely what the source provider controls and what the destination provider must supply.

This guide focuses on the provider's customer exit terms. It does not cover user requests for connected-product data under Articles 3–5, or an individual's GDPR portability request. A product may involve all three, but the data categories and rights differ. Keep separate owners and contract clauses so a device customer is not sent a SaaS termination form and a cloud customer is not told to make a GDPR request. The Data Act's Article 24 also limits certain duties to the source provider's own services, contracts and practices; do not promise control over a competitor's system.

For the distinct connected-device access route, see the Data Act product-data guide.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter; European Commission: Digital Package FAQ, proposed cloud-switching changes

Specify every exportable data and digital-asset category

Article 25(2)(e) requires an exhaustive specification in the contract of data and digital-asset categories that can be ported, including at least all exportable data. Start from the tenant data model, not a generic clause saying 'customer data may be downloaded'. List primary records, attachments, metadata, configuration where exportable, user-created workflows and application outputs as applicable. An ERP customer may need invoices, counterparties, ledger mappings and document references; a project tool customer may need tasks, comments, owners and dates. Show which fields the export contains and how identifiers remain consistent across files.

Article 25(2)(f) permits specified categories of internal-functioning data to be excluded where a provider trade-secret risk exists, but the exemptions must not impede or delay switching. Do not claim that all metadata or all configuration is proprietary without analysis. Make a field-level matrix: customer input, data generated through use, provider-internal data, third-party licensed content and any trade-secret concern. A customer may not need source code, yet may need enough metadata to reconstruct its business records. The legal and engineering reviewers should test whether the exclusion leaves an actually usable migration package.

The Commission explains that exportable switching data includes input and output data and metadata generated by the customer's use, excluding data protected by the provider's intellectual-property or trade-secret rights where the Regulation provides. Publish an up-to-date online register of data structures, formats and relevant standards or open interoperability specifications as Article 26 requires. Version it when schemas change. An export file generated today should map to documentation available today, not a PDF describing last year's API. Test an import into a neutral environment to find missing joins and undocumented codes.

For how the Data Act treats a different category of device data, read the connected-product request guide.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter

Write the notice, transition and retrieval timeline into the contract

Article 25 requires a written contract available to the customer before signing in a form it can store and reproduce. The contract must let a customer initiate switching with a notice period that does not exceed two months. The default mandatory maximum transitional period is 30 calendar days after that notice, during which the service contract remains applicable and the provider gives reasonable assistance and maintains continuity. The sequence matters: a contract that adds an unlimited 'technical approval' stage before the clock starts defeats the point. State how notice is given, when it takes effect and who coordinates the migration.

The Regulation recognises technical infeasibility: under Article 25(4), a provider that cannot meet the default 30-day transition must notify the customer within 14 working days of the switching request, justify the technical reason and identify an alternative transition not exceeding seven months, with continuity maintained. The customer also has a right to extend the transition once under Article 25(5). These are bounded mechanisms, not a blanket right to say every migration is complex. Keep an evidence log for any exceptional extension, including data volume, dependencies, proposed schedule and communication to the customer.

The contract must provide a data-retrieval period of at least 30 calendar days after the transition and then guarantee erasure of the relevant exportable data and digital assets after that period or a later agreed date, once switching succeeds. Define the authentication and export method during retrieval, the service state, backup handling and the written confirmation of erasure. A termination clause that deletes the tenant immediately when billing stops can conflict with this sequence. Conversely, a clause that silently keeps the data forever undermines the promised exit and may create separate privacy risk.

For a separate personal-data retention analysis, see the GDPR retention-schedule guide.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter

Make the export and interface usable before a customer leaves

Article 30 treats infrastructure services differently from other data-processing services. For SaaS and PaaS, the provider must make open interfaces available free of charge to customers and relevant destination providers to facilitate switching, with enough information for software to communicate for portability and interoperability. For infrastructure services, the emphasis includes measures to facilitate functional equivalence for shared features when moving to the same service type. A Cyprus SaaS vendor should not promise that its source application will somehow guarantee identical features in an unknown destination, but it should make its own export and interfaces workable.

Test the export with a representative tenant, not an empty account. Include large attachments, deleted-but-retained records, custom fields, roles, audit history where relevant, and multiple time zones. Verify encoding, stable identifiers, pagination, rate limits and checksums. Provide a data dictionary and error reporting that helps the destination provider reconstruct the customer's data without guessing. A CSV download can be a starting point, but it may be insufficient for a relational product if it omits links among entities or metadata needed to interpret values. Measure export duration against the statutory transition clock.

Security controls should enable switching safely. Provide scoped credentials, encryption in transit, signed archives or equivalent integrity checks, and a controlled handoff to the customer or its authorised destination. Log what was exported and who received it. Do not require a customer to email a password or let support manually query the production database without a repeatable process. The destination service may impose its own mapping work; record the source provider's obligation and reasonable assistance separately from optional consultancy. An exit rehearsal once a year can reveal a broken API before a high-value customer gives notice.

For related privacy controls during transfer, use the GDPR international-transfer guide.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter

Check switching charges against the 2027 statutory date

Article 29 phases out switching charges. The Commission explains that providers may, during the transition before 12 January 2027, charge reduced amounts tied to costs directly incurred for the switching process and data egress. From 12 January 2027, switching charges for the process are removed. Do not copy an old open-ended egress tariff into a 2027 exit clause. Identify every fee associated with export, API use, transfer, assistance and termination, then classify it under the current statutory rule rather than changing only the line labelled 'switching fee'.

The law distinguishes charges for switching from standard service fees and proportionate early-termination penalties for a fixed-term contract, subject to its conditions. An optional professional migration project can also be different from the mandatory operations needed to enable switching. Describe these items separately and transparently before contract signature. If the provider bundles required export work into a paid consultancy package, the label will not make it optional in practice. Finance should be able to explain the cost basis for any reduced switching charge during the transition and show how its price list changes on the statutory date.

Parallel use of two cloud services is a distinct scenario from a one-off exit; the Regulation's recitals discuss the possibility of cost-based data-egress charges for ongoing multi-cloud use after the transition. Avoid a broad marketing promise that no network traffic can ever be billed after January 2027. Draft the customer-facing tariff around the actual legal category, service and operation. Recheck Article 29 and Commission guidance before publishing new prices, particularly because the Digital Omnibus proposal includes cloud-switching clarifications that are not yet operative as of this review.

For separate company contract risk, see the Cyprus SaaS founder overview.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter; European Commission: Digital Package FAQ, proposed cloud-switching changes

Document genuine exceptions and complex migrations narrowly

The Data Act contains tailored treatment for some services whose main features are custom-built for one customer or whose components were developed for that customer. This is not a general exemption for a standard SaaS product that offers a few configurable workflows. Review the exact Article 31 conditions and inform prospective customers of non-applicable obligations where the Regulation requires it. A platform with a public catalogue should not reclassify the whole service as bespoke because one large customer bought implementation work. Record the service architecture, sales model and legal reason for any exception.

For technically complex migrations, use the Article 25 procedure rather than putting an indefinite exception in the standard contract. Calculate data volume, dependencies, encryption and change windows, and tell the customer within the required period if the ordinary transition cannot be met. Identify an alternative schedule and maintain continuity. A customer may also choose a longer transition once, so the operations team needs a process for that choice. Keep correspondence and test results: a provider should be able to show that the longer period follows genuine technical constraints, not account-retention strategy.

Check other obligations separately. If the tenant contains personal data, GDPR controller-processor terms, return and deletion duties remain relevant. If a financial firm is the customer, DORA may impose additional operational and contractual requirements on that relationship. A valid Data Act exit clause does not replace those regimes, and those regimes do not nullify the cloud-switching baseline. Maintain a contract matrix with Article 25, privacy, security and regulated-customer provisions and resolve contradictions before the template is offered for signature.

For an ICT contract with a regulated financial customer, see the DORA supplier-contract guide.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter; European Commission: Digital Package FAQ, proposed cloud-switching changes

Test three SaaS exit scenarios against the terms

A Cyprus practice-management SaaS lets customers download contacts and appointments but not attachments or custom fields. Its terms promise 'all customer data' and immediate deletion at cancellation. A customer asks to migrate. The company maps the missing categories, builds an export and schema register, revises the retrieval and erasure sequence and tests whether the destination can import the records. It aligns the contract with its actual technical capability rather than asking support to produce a one-off database dump at the last moment.

A second provider charges a large per-gigabyte egress fee during a 2027 exit. Its finance team checks Article 29 and finds that switching charges for the mandatory process have been removed from 12 January 2027. It separates ordinary subscription amounts, any lawful fixed-term termination consequence and charges for genuinely separate optional work. It removes the switching charge and corrects its pre-contract pricing disclosure. A rebranded 'data transfer administration' fee for the same mandatory export would leave the underlying issue unresolved.

A third provider hosts a complex multi-region tenant and cannot complete a safe migration within the default 30-day transition. Within 14 working days of the request it gives a documented technical explanation and an alternative plan within the statutory cap, keeps the service running and provides the export interface and assistance. The customer chooses whether to use its one extension right. Both sides record testing, cutover and retrieval. This is a managed exception supported by evidence, not a clause saying the provider may delay exit whenever convenient.

For related security and continuity terms in financial-sector contracts, consult the DORA contract guide.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter

Keep a contract-to-product evidence file

A useful file contains the scope assessment, current customer terms, exportable-data list, excluded categories and rationale, API or download specifications, online schema register, notice and transition process, retrieval and erasure controls, price list, and test migration results. Each item should have an owner and version. Contract wording that promises a 30-day export is not credible if the engineering team has never tested a full tenant. Conversely, a good export button does not cure a contract requiring a six-month notice before a customer can start switching. Review both sides together.

Assign a migration lead for each exit and create a timeline from notice to final deletion. Record the customer instruction, chosen destination, identity and security checks, data scope, known limitations, assistance, successful transfer evidence, retrieval window and erasure confirmation. If a third-party destination receives access, scope credentials and log use. A quarterly internal rehearsal can uncover undocumented fields or broken exports as features change. Keep the customer informed in plain language so it can plan cutover rather than discovering a limitation after service termination.

The current Data Act text applies as of this guide's October 2026 review. The Commission's Digital Omnibus remains a proposal and may alter some details later; do not rewrite current contracts as though the proposed text were already law. Monitor the legislative status and retest the template against any final amendment. This guide addresses provider switching, not connected-device data requests or a guarantee that another cloud will reproduce unique software functionality. A documented, tested exit route is a service quality measure as well as a legal one.

Basis and guidance: Regulation (EU) 2023/2854, Data Act, Articles 23–31; European Commission: Data Act explained, cloud-switching chapter; European Commission: Digital Package FAQ, proposed cloud-switching changes

Primary sources and scope

Sources checked: October 8, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Regulation (EU) 2023/2854, Data Act, Articles 23–31
• European Commission: Data Act explained, cloud-switching chapter
• European Commission: Digital Package FAQ, proposed cloud-switching changes

Practical guides for this topic

• B2B SaaS liability caps in Cyprus: drafting a usable clause

  Practical Cyprus-law review of B2B SaaS liability caps, loss exclusions, data claims, indemnities and the contract record needed before signing.