Key takeaway
The right to request product readings does not automatically include a manufacturer’s derived score or authorize every commercial reuse.
Name the user, holder and proposed recipient
A company leasing connected equipment may be a user with an access question even when the manufacturer stores the readings. Identify the product, related service, relevant user and data holder before calling the resulting package company-owned. An administrator’s ability to download a file is a different fact from the legal route for access or reuse.
The Commission explains that the EU Data Act applies from 12 September 2025. Its connected-product provisions distinguish readily available product and related-service data from highly enriched inferred or derived information. The statutory scope and exceptions still need review for the actual product and parties. The Act is not a promise of licensing income or a blanket right to a supplier’s entire database.
Map a leased compressor without merging the layers
This hypothetical EU company leases a connected compressor and wants a third party to assess energy performance. The example separates sensor readings, vendor analysis and the company’s own records. No actual equipment, receiving program or legal entitlement has been verified. The map is a completed brief for the responsible reviewer, with holds where the intended access or reuse is unresolved.
Request the metadata needed to interpret a candidate reading: units, measurement time, quality flags and device identifiers. Do not assume that access to a raw value establishes the validity of the measurement or includes every related model output. Preserve the distinction between a statutory access request and a voluntarily negotiated license.
| Illustrative record | Access/authority question | Proposed next step |
|---|---|---|
| Pressure and energy readings held by vendor | Readily available product data within actual scope? | Identify user, holder and needed metadata |
| Preprocessed sensor value | Processing level and covered scope? | Ask for transformation description |
| Vendor’s proprietary health score | Highly enriched inferred/derived output? | Do not assume access duty includes it |
| Company engineer’s repair narrative | Company/employee/customer rights separately? | Review source authority outside product-access shortcut |
| Shift worker identifier | Personal data; user may not be the person concerned | Hold sharing until the lawful basis and scope are established |
Describe the third party’s operation before requesting delivery
For a user-directed third-party route, Articles 5 and 6 contain conditions on access and subsequent processing. Article 6 ties use to the purposes agreed with the user and includes specific restrictions. Those provisions need to be checked against the proposed operation; a request for energy analysis should not quietly become permission for a new competing connected product, profiling or unrestricted onward distribution.
In the example, the evaluator first asks to compute efficiency under different loads, then adds a request to pool the records across equipment manufacturers for another product. Record that change and hold the expanded operation for review. The user’s approval should identify the recipient, purpose, fields and handling arrangements. A general statement that the third party does analytics is too broad to decide the route.
Access does not replace privacy or trade-secret review
A user who is not the person concerned cannot treat product access as an independent permission to process that person’s information. The Commission’s explanation and Article 5 address the need for the relevant personal-data basis. Review whether worker or customer fields can be excluded while preserving the legitimate evaluation question.
Trade-secret safeguards also matter. Identify which fields are claimed to contain protected information and the handling measures under consideration. The legal access framework and any safeguards must be evaluated together; neither the owner nor recipient should announce that a download removes confidentiality restrictions. Escalate a dispute to the responsible adviser using an exact field and purpose description.
Keep statutory access and a commercial bargain apart
A statutory user access route is not evidence that a third party wants to pay for the records. The vendor’s voluntary offer to supply a derived score is also a separate commercial decision. Put each route in its own row: access right being assessed, additional negotiated output, and company-created content reviewed under its own source agreements.
For the compressor, the completed decision is to clarify pressure/energy scope and metadata while holding the health score, worker identifiers and expanded product purpose. The buyer cannot fill those gaps with an unrestricted license drafted by the user. Record any fees or handling obligations only after the actual route and responsible parties are known. This article supplies no price, observed demand or forecast receipt.
Prepare an access-and-use brief
The brief should identify the product and service, user status, data holder, requested period, raw/preprocessed fields, excluded derived material, proposed third party and exact operation. Add the privacy and trade-secret questions, applicable scope exceptions and the person who must resolve each one. This is more useful than an assertion that all telemetry belongs to the equipment owner.
Inventory can describe the layers, and Rights & privacy review can retain the unresolved authority questions. The EU database-rights guide considers a different protection in a compiled collection. VOID’s named-recipient introduction can use approved metadata; actual access requests, samples and licenses remain separate decisions by the parties with authority. Neither a referral nor this worksheet establishes statutory entitlement or clears the use.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.