Saya & Associates
EU Data Act for Indian SaaS: switching clauses and data export
Does the Data Act reach an Indian SaaS company?
It can. Article 1(3)(f) applies the Data Act to "providers of data processing services, irrespective of their place of establishment, providing such services to customers in the Union". It has applied since 12 September 2025.
A "data processing service" under Article 2(8) is a digital service giving on-demand network access to a shared pool of configurable, scalable and elastic computing resources.
Many SaaS products meet that description; an Indian address does not answer the question.
Start with the service, not the company label
Calling a company a SaaS startup does not settle whether each product meets the definition. Describing software as a "platform" does not take it outside either.
Review each distinct offering, especially where a standard product is sold alongside bespoke implementations.
Article 31 contains two different carve-outs, and neither is a general exemption for small companies:
| Provision | Which services | What does not apply |
|---|---|---|
| Article 31(1) | Services where most main features were custom-built for one customer, or all components were developed for that customer, and which are not offered at broad commercial scale through the provider's catalogue | Only Article 23(d), Article 29 (switching charges) and Article 30(1) and (3). The other switching duties still apply |
| Article 31(2) | Non-production versions provided for testing and evaluation, for a limited period | The whole switching chapter |
| Article 31(3) | Both of the above | The provider must tell the prospective customer, before signing, which obligations do not apply |
What the contract must contain
Article 25(1) requires the switching rights and obligations to be set out in a written contract, made available before signing in a form the customer can store and reproduce. Article 25(2) lists what it must include at a minimum:
| Article 25(2) | The clause must cover |
|---|---|
| Point (a) | Switching or porting on request, without undue delay, within a maximum transition of 30 calendar days, with reasonable assistance, business continuity, information on known risks and a high level of security |
| Point (b) | Support for the customer's exit strategy, including all relevant information |
| Point (c) | Termination on successful switching, or at the end of the notice period if the customer only wants its data erased |
| Point (d) | A maximum notice period of two months to start the switching process |
| Point (e) | An exhaustive list of the data and digital assets that can be ported, including at least all exportable data |
| Point (f) | An exhaustive list of internal-functioning data excluded because of a trade-secret risk, without delaying the switch |
| Point (g) | At least 30 calendar days to retrieve data after the transition ends |
| Point (h) | Full erasure of the customer's exportable data and digital assets after the retrieval period |
| Point (i) | Any switching charges permitted under Article 29 |
These are drafting points and operating points at once. The answers should be the same in the master agreement, the order form, the support documentation and the product itself.
Notice, transition and retrieval run in sequence
| Stage | Length | Source |
|---|---|---|
| Notice to start switching | No more than two months | Article 25(2)(d) |
| Transition | No more than 30 calendar days, during which the contract continues | Article 25(2)(a) |
| Transition, if technically unfeasible | An alternative period of up to seven months, notified with reasons within 14 working days of the request | Article 25(4) |
| Customer extension | The customer may extend the transition once | Article 25(5) |
| Data retrieval | At least 30 calendar days after the transition ends | Article 25(2)(g) |
| Erasure | After the retrieval period, once switching has succeeded | Article 25(2)(h) |
So a sales promise that "every transfer finishes within 30 days of any message" is wrong in both directions. Each stage has its own trigger.
Build those stages into the cancellation workflow. Finance closing the subscription must not cut off access the customer still needs for retrieval, and security should verify the request and the authorised recipient before any transfer.
An export button is only one part of the review
"Exportable data" in Article 2(38) means the input and output data, including metadata, generated or co-generated by the customer's use of the service.
It excludes assets and data protected by the intellectual property or trade secrets of the provider or third parties.
Consider a hypothetical approval platform. Its CSV export contains each purchase request, but attachments sit behind expired links and the approval history uses identifiers with no mapping.
The customer gets rows, but cannot tell who approved what, or on which document.
Field definitions, persistent identifiers, file associations and timestamp conventions decide whether a recipient can interpret the output.
Where no common standard has yet been published, Article 30(5) requires export in a structured, commonly used and machine-readable format.
Open interfaces and functional equivalence
Article 30(1) requires infrastructure-level providers (servers, networks, virtual resources) to take reasonable measures so the customer achieves "functional equivalence" at the new provider.
That duty is aimed at infrastructure, not at every software application.
For other services, including SaaS, Article 30(2) requires open interfaces, free of charge and equally available to all customers and destination providers.
The interfaces must carry enough information to build software that communicates with the service.
Article 30(6) sets the limits. A provider is not required to develop new technologies or services, disclose or transfer assets protected by intellectual property or trade secrets, or compromise security.
Do not promise source code or internal tooling just because a customer asks for "everything".
What changes on 12 January 2027
Under Article 29(1), from 12 January 2027 providers may not impose any switching charges for the switching process. Until then, Article 29(2) and (3) allow only reduced charges that do not exceed the costs directly linked to the switch.
"Switching charges" in Article 2(36) include data egress charges but exclude standard service fees and early termination penalties. The ban does not cancel unpaid invoices, refund prepaid fees or cover the customer's own migration costs.
Article 29(4) requires the provider to give clear information on standard fees, early termination penalties and any reduced switching charges before the contract is signed. Renaming a switching charge does not change what it is.
Custom-built services within Article 31(1) are outside Article 29. That is one more reason to classify each offering correctly.
Proposed changes are not yet law
In November 2025, the Commission proposed amendments to the Data Act as part of its Digital Omnibus package, including relief for some contracts concluded before 12 September 2025.
As at 2 October 2026 the proposal is still being negotiated.
This article applies the enacted text. Revisit the contract stack once any amendment is adopted.
The Commission's non-binding standard contractual clauses for cloud computing contracts, published on 19 November 2025, are useful drafting material on switching, termination and continuity.
They are voluntary and do not prove that a product can deliver what they promise.
Readiness check before an EU enterprise sale
- Map each offering. List every product and decide whether it is a data processing service, a custom-built service or a time-limited trial.
- Read the contract stack. Check the master agreement, order form and support documents against each point in Article 25(2).
- List the exportable data. Record the data, metadata and digital assets, and any trade-secret exclusions you rely on.
- Run a test export. Use a demonstration account with a file, a related record and an approval, and ask a colleague to interpret the result from the documentation alone.
- Separate the charges. Distinguish standard fees, early termination penalties and switching charges, and plan for 12 January 2027.
- Write the exit workflow. Set the notice, transition, retrieval and erasure steps, with one coordinator and security checks on each request.
If the same customer has also sent a data processing agreement, see our guide to reviewing an EU customer's DPA.
Frequently asked questions
Does being based in India exempt an EU SaaS contract from the Data Act?
No. Article 1(3)(f) covers providers of data processing services offering them to customers in the Union, irrespective of where the provider is established. The service must still meet the definition.
Is a CSV file an acceptable export format?
It may be. Where no common standard has been published, Article 30(5) requires a structured, commonly used and machine-readable format. What matters is whether the export is complete and can be interpreted, not the file extension.
Must a SaaS provider hand over its source code?
No. Exportable data excludes the provider's intellectual property and trade secrets, and Article 30(6) says a provider need not transfer protected digital assets or compromise security.
Does free switching mean no charges at all after January 2027?
No. From 12 January 2027 switching charges, including data egress charges, are banned. Standard service fees and early termination penalties are a separate category and are assessed under the contract.
Can a provider simply call its service custom-built?
No. Article 31(1) applies only where most main features were custom-built for one customer, or all components were developed for that customer, and the service is not offered at broad commercial scale through the catalogue.
The takeaway
The switching rules turn on what the product can actually hand over and on how the exit is run, not on the company's location. Test one export, align the contract with it, and be ready before 12 January 2027.
To scope a review of your service category, EU contracts and exit process, contact Saya & Associates. Share customer records only through an agreed secure process.
This article provides general information as at 2 October 2026 and applies the enacted text of the Data Act. Proposed amendments are not treated as law. Scope, exceptions, technical arrangements and the actual contract determine the position. It is not legal advice.