When manufacturers are required to share data, a key question arises: on what terms? The Data Act provides the answer in five letters: FRAND – Fair, Reasonable and Non-Discriminatory. What does this mean in practice?
The triangle: Who is involved?
The Data Act has been in force since 12 September 2025. Among other things, it regulates what happens when connected products – from wind turbines to fridges – generate data during operation. This data is typically held by the manufacturer. But the user (e.g. the wind farm operator) has a right to request it – not only for themselves, but also for third parties.
This creates a triangular relationship involving three parties:
- The data owner (typically the manufacturer, e.g. a turbine manufacturer) – they hold the data and must make it available.
- The user (e.g. the wind farm operator) – they are entitled to receive the data and can determine to whom the data should be sent.
- The data recipient (e.g. an analytics start-up) – they receive the data and must enter into a contract with the data owner in accordance with Article 8(1) of the Data Act.
The user requires the data owner to disclose the data to the data recipient. The data owner then concludes a contract directly with the data recipient regarding the provision of the data. And this is where it gets interesting: on what terms?
FRAND – Fair, Reasonable and Non-Discriminatory
The Data Act stipulates that the contractual terms between the data owner and the data recipient must be FRAND. This stands for fair, reasonable and non-discriminatory.
The FRAND principle originally stems from patent law, where it has been applied for decades in the licensing of standard-essential patents (SEPs). However, the European Commission expressly points out that its transferability is limited: in data sharing, the data owner must actively cooperate, whereas in the case of patents, the relevant information is already publicly known. The latter does not exactly make things any easier.
What do the three elements mean in concrete terms?
Fair – No blocking, no disproportionate obligations
Fair means that the data owner must not block access or effectively prevent it through disproportionate requirements. The data owner has a legal duty to cooperate – a ‘hold-out’ or ‘hold-up’ is not permitted.
Reasonable – Appropriate conditions, not economically prohibitive
The remuneration must not be so high as to deter potential data recipients. What is ‘reasonable’ is assessed on a case-by-case basis. Importantly, the data owner is not required to demand remuneration and may also make the data available free of charge. Conversely, remuneration may in principle include a margin – but does not have to.
Non-Discriminatory – Equal terms for comparable recipients
Comparable data recipients must be treated equally. Differentiation is only permissible where objectively justified, for example in the case of:
- different security requirements,
- the protection of sensitive data such as trade secrets or personal data, or
- objective technical differences such as format, volume or real-time versus delayed access.
It is, however, clearly impermissible to penalise competitors, favour affiliated group companies, apply criteria selectively or in a non-transparent manner, or impose a disproportionately greater burden on early data recipients than on later ones.
How much can data cost? The three remuneration components
The European Commission’s draft guidelines on calculating fair remuneration under Article 9 of the Data Act break remuneration down into three components:
Component 1: Provision costs (Article 9(2)(a) DA)
These are the costs directly incurred by the specific data request. The Commission cites the following as typical items:
- Data formatting – though only if the recipient requests a format that deviates from the standard; provision in a common machine-readable format is already a legal obligation.
- API access and transmission – i.e. the costs of operating the access tool, including security measures and staff costs.
- Recipient onboarding – account creation, identity verification, SME verification.
- Storage – but only to the extent that a dedicated storage environment is used for provision; if no additional storage costs are incurred, nothing may be charged.
- Anonymisation – where personal data is involved and there is no legal basis under the GDPR.
All costs must meet four criteria: they must be incremental, objective, measurable and proportionate. Overhead costs, sunk costs, speculative risks or general operating expenses are not eligible for reimbursement as provision costs.
Module 2: Investments (Art. 9(2)(b) DA)
This includes investments that made data collection and generation possible in the first place – such as sensor technology, IT systems or digital twins. However, these investments do not have to be taken into account in every case: if they have already been amortised via the purchase price of the product, recalculating them would be inappropriate. Similarly, operating costs borne by the user themselves (e.g. electricity costs for a wind turbine) should not be regarded as ‘investments’ by the data owner.
Component 3: Margin
The data owner may add a margin to the provision costs and investments. The profit margin may be higher if the data collection required significant investment, and must be lower if the costs are low or the data was co-generated by the user. It may even be waived entirely if the recipient’s use does not impair the data owner’s business activities.
Special case for SMEs: Provision costs only, no margin
A special rule applies to small and medium-sized enterprises (SMEs) and non-profit research organisations: they may only be charged the pure provision costs. Investment costs and a margin are therefore expressly excluded, particularly for start-ups. According to the Commission’s draft guidelines, SME recipients are only liable for costs directly attributable to the individual request – i.e. no proportionate set-up or overhead costs for the data infrastructure.
As a result, the remuneration for an SME start-up could, in the best-case scenario, drop to zero – namely if the data is already available in a standard format, API access is fully automated, no additional storage costs are incurred and no anonymisation is required.
What pricing models are possible?
The Data Act does not prescribe any specific payment model. It is therefore left to the contracting parties (specifically data owners and data recipients) to agree on the terms. The Commission’s draft guidelines list three common variants:
Non-monetary compensation is also permitted – such as mutual data exchange or access to analysis results.
Transparency: What must the data controller disclose?
Upon request, every data recipient has the right to demand a comprehensible breakdown of the remuneration calculation from the data owner (Art. 9(7) DA). This is not a general transparency requirement, but ultimately a tool to prevent abusive pricing.
The Commission recommends that data owners document their cost structure and disclose it at least at an abstract level – for example, through cost categories, standard templates or sample calculations. Confidential details (e.g. supplier contracts, salaries) do not need to be disclosed. In the event of a dispute, independent third parties, dispute resolution bodies or NDA-protected audits can help.
Dispute? Three options are available
If data owners and data recipients cannot agree on the terms, three options are available:
- Civil courts: Access claims may need to be asserted in court if an out-of-court settlement fails.
- Certified dispute resolution bodies under Article 10 DA: However, there are currently no such bodies in place.
- Competent national authority under Article 37 DA: In principle, there is a right of appeal to the Federal Network Agency, but this does not necessarily lead to a resolution of the dispute.
Conclusion: FRAND as a guideline, not a price list
FRAND does not prescribe fixed prices – it is a framework for fair negotiations. The European Commission’s Draft Guidelines fill this framework with reasonably concrete criteria: What are recoverable costs? When is a margin permissible? What constitutes discrimination?
In practice, this means:
- Data owners should document their cost structure, establish a pricing model and prepare an NDA template.
- Data recipients should articulate their data requirements, identify use cases and demand transparency.
- Users should recognise the importance of their right of disposal and make active use of it.
The most important step? Talking to one another. Please feel free to get in touch if you need support.