Data Act cloud switching: what changes for banks

According to the summary by the Irish law firm Matheson, the customer gives notice of at most two months. The switch then takes place within 30 days, extendable to at most seven months where it is technically not feasible. After termination the customer can retrieve its data for at least 30 days, and the provider then erases the exportable data in full. Exportable data is the input and output data of the service, including metadata, and excludes assets protected by intellectual property rights or trade secrets.

Charges come down in two steps. Until January 12, 2027 a provider may charge reduced switching fees that do not exceed its direct costs of the switch, as McCann FitzGerald explains, and after that date none. Fees for data transfer during normal operation are outside the rule. Dr. Datenschutz (in German) points out that lock-in costs can move into that part of the price list.

Notice periods, transition support and data return are now statutory minimums, so the exit plan can cite the law where the contract is thin. The rights and obligations still have to be set out in a written contract, with the notice period, the transition period, the list of exportable data and the switching charges.

The technical work stays with the bank. For infrastructure services the provider must remove obstacles to functional equivalence at the new provider, but it does not have to rebuild the customer's services there. A workload built on proprietary managed services, or an AI application tied to one provider's model API, still needs the migration that the exit plan describes. Providers must also publish where their ICT infrastructure is located and what they do against access by foreign governments. The bank can use that disclosure when it assesses the CLOUD Act question.

The Data Act has applied since September 12, 2025, including its switching chapter. Until January 12, 2027 providers may charge reduced switching fees capped at their direct costs, and from that date switching is free of charge.

It covers data processing services, in practice infrastructure, platform and software as a service, and it applies to providers outside the EU that serve customers in the EU. Services built for one customer and not offered on a broad commercial scale, and services in a test or beta version, are partly exempt.

No. The Data Act gives every customer the right to switch. DORA requires a financial entity to plan and test its exit for critical or important functions, with named alternatives and transition plans. A bank puts the Data Act's minimum terms into its contracts and still writes and tests the plan.