The Data Act Is Here – What Will Happen to Trade Secrets?

This is the first in a series of articles from Bird & Bird’s International Trade Secrets Group addressing current and emerging issues in global trade secrets protection.

Trade secret regulation in data act

The Data Act (Regulation (EU) 2023/2854) entered into force on 12 September 2025 and has now been applicable for three months. After a long period of anticipation, the data governance landscape has changed significantly. Users of connected products, such as IoT devices, now have control over of the product data, related service data, and metadata generated through their usage. Under the Data Act, data holders (e.g. manufacturers or service providers) may only access such data if they have entered into a data sharing agreement with the user. Where readily available data and its metadata are not directly accessible to the user, they must be made available upon request.

This data often contains trade secrets, and their protection became a key concern during the final stages of the legislative process. However, the provisions concerning trade secrets are scattered and complex, creating significant uncertainty for businesses. 

The general principle is that trade secrets must be disclosed to the user if the parties agree on appropriate confidentiality safeguards. The data must also be disclosed to a third party designated by the user, if strictly necessary. Such third parties may include, for example, competing service providers.

The holder of the trade secret must identify the trade secrets in question. If they refuse to disclose them, they must notify the competent authority in the relevant country, and both the user and the third party may lodge a complaint with that authority. 

The situation is highly exceptional. Companies may be obliged to disclose trade secrets against their will. For the first time in many countries, a public authority will be assigned a supervisory role concerning trade secrets, and companies’ trade secrets will be subject to administrative procedures.

The requesting party, whether a user or a third party, may be a company or a private individual. The product could be anything from an aircraft to a coffee machine and its associated user data. The situations and variations are countless. Access to such data, and consequently to trade secrets, may therefore lie with a single party or with thousands of individuals.

Will trade secrets actually be protected?

The Data Act aims to protect trade secrets, but what is the reality? The Data Act is based on several critical assumptions:

1. data holders and users / third parties will enter into agreements
2. these agreements will be respected
3. breaches will be detected
4. evidence of breaches will be obtainable; and
5. effective enforcement will follow.

How likely is it that all these conditions will be met and trade secrets remain protected?

It is therefore reasonable to ask whether any trade secrets remain in the readily available data of an IoT product? How many private individuals actually read the terms of use that bind them, let alone comply with them?

In practice, companies may find it impossible to monitor the use of trade secrets embedded in product data, and such secrets may be lost, either in individual cases or more broadly, if the information becomes publicly known.

It is worth noting that the EU has recently unveiled an ambitious Digital Omnibus package aimed at simplifying the EU’s complex rulebook. The package proposes minor modifications to the Data Act’s trade secrets regulations but does not alter the overall risk landscape for trade secret holders.

Tom Vapaavuori is the co-head of Bird & Bird’s International Trade Secrets Group, which is active in all Bird & Bird’s offices. Tom has written a book on trade secret protection in Finland, participating in drafting Finland’s first trade secrets law and handled numerous litigations regarding trade secret protection.