EU Data Act and SaaS Contracts: What Changes for Vendors

Since 12 September 2025, the EU Data Act has required cloud and SaaS providers to let customers switch to another provider, move to their own infrastructure or exit, with no more than two months' notice, including under fixed-term contracts signed before that date. Vendors can still agree fixed terms and charge proportionate early termination penalties, but switching charges disappear on 12 January 2027, and a long contract no longer guarantees the revenue it used to.

Big brands are no exception. Salesforce, Miro, ServiceNow and Atlassian face the same switching rules as a ten-person European start-up when they serve customers in the EU.

Not legal advice. This article is general information for commercial and RevOps teams. The switching rules are new, official guidance is limited and national contract law fills important gaps, for example on refunds. Review your contracts with qualified counsel before you change them.

What the law says

The Data Act, Regulation (EU) 2023/2854, was adopted on 13 December 2023, entered into force on 11 January 2024 and has applied since 12 September 2025 (EUR-Lex, Article 50). Chapter VI, which regulates switching between data processing services, is the part with the most visible impact on SaaS.

The intention behind the law is clear. It aims to reduce vendor lock-in and make it easier for customers to move between cloud providers, so the digital economy becomes more competitive.

Law firms describe the effect on contracts in slightly different ways. DLA Piper puts it bluntly, saying the Data Act "grants any in-scope customer a right to terminate, regardless of the terms of the contract", and this also applies to contracts concluded before 12 September 2025 (DLA Piper, 2025). Bird & Bird is more careful and treats the two-month notice as a switching mechanism rather than a general termination right, but once the switch is complete the contract ends, usually about three months after notice (Bird & Bird, 2025). For a vendor's revenue, the outcome is much the same.

In practice, that has three consequences.

• Customers can ask to switch to another provider or to their own infrastructure with a notice period of no more than two months. The switch must then be completed within a transitional period of 30 calendar days, which the provider can extend to a maximum of seven months only where 30 days is technically unfeasible (Article 25).
• The contract is considered terminated once the switch is complete, or at the end of the notice period if the customer chooses to have its data erased instead of moving it.
• The rules apply to new and existing contracts. Article 50 sets no transition period for the switching chapter, so legacy agreements do not protect vendors.
• Providers must support data export and make switching technically feasible, including a data retrieval period of at least 30 days.
• Fixed terms and early termination penalties remain permitted. Recital 89 says nothing in the regulation prevents contracts of a fixed duration, "including proportionate early termination penalties". Latham & Watkins notes the Act "does not prohibit providers from charging early termination fees or using fixed contract terms" (Latham & Watkins, 2025). Providers must disclose those penalties before the contract is signed (Article 29(4)).
• Switching charges may only pass on direct costs until 12 January 2027 and are banned from that date (Article 29). Standard service fees and early termination penalties are not switching charges. Data egress charges for using several providers in parallel may still pass on actual costs (Article 34).

The scope is broad. Recital 81 names infrastructure, platform and software as a service, so SaaS is covered. Customers can be businesses or individuals, and providers based outside the EU are covered when they serve customers in the Union (Article 1). A US SaaS company selling into Europe must comply. The exceptions are narrow. Services whose main features were custom-built for one customer and are not offered at broad commercial scale are exempt from some obligations, including the switching-charge rules, and time-limited test versions are exempt from the chapter entirely (Article 31).

Why this matters

For years, SaaS economics have relied on long-term contracts. Annual and multi-year deals gave companies predictable revenue, secured cash flow and often justified discounts. Vendor lock-in was part of the business model.

The Data Act weakens that model. A two-year contract with quarterly billing gives far less certainty if the customer can switch after twelve months with two months' notice. A customer can also leave after six months, and the provider cannot hold it to the remaining eighteen. It can only recover a proportionate early termination penalty, and only if the contract provides for one.

This is a significant change. It shifts leverage toward customers and forces SaaS providers to rethink pricing, packaging and customer retention.

The winners are customers

The obvious beneficiaries are customers. The law gives them something close to a universal exit button.

B2B customers, who previously had to negotiate termination rights case by case, now have statutory switching rights. A customer that has lost confidence in a vendor no longer needs to argue or litigate its way out of a fixed term. It can give notice and move.

This is likely to increase churn. Customers can test competitors without being tied down, they can be more demanding knowing they are not locked in, and they have more leverage when they negotiate renewals.

Contractual lock-in loses most of its force in Europe. The switching costs that come from data, integrations and habits remain, but the contract is no longer the wall it used to be.

The losers are SaaS vendors relying on long contracts

The businesses that will feel the most pain are SaaS providers that depend on annual or multi-year contracts.

For these vendors, several things change.

• Annual contracts lose much of their protective value. Customers can leave mid-term, undermining the predictability of revenue streams.
• Discounted multi-year deals need a rethink. Why offer 20 percent off for a three-year commitment if the customer can leave after one year and keep the discount?
• Revenue forecasting becomes more volatile. Churn risk rises, and finance teams have to adjust their models.

Customer success and retention become even more important. SaaS providers cannot rely on legal contracts to hold on to customers; they must deliver continuous value.

If you want to see how much of your forecast rests on contracts that customers can now leave early, our CRM and GTM Health Check checks the data behind it and fixes the first gap.

What SaaS companies should do

This is not legal advice, and every provider should consult its own counsel. Based on the regulation and commentary from law firms, several practical steps stand out.

• Keep prepayment as a cash tool, not a retention guarantee. Annual or multi-year prepayment still improves cash flow. But Bird & Bird expects that providers will likely have to refund the unused part of a prepaid term when a customer switches early, and warns that clauses declaring prepaid fees for ongoing services non-refundable could be treated as an obstacle to switching under Article 23. Do not build your forecast on keeping prepaid amounts.
• Make early termination penalties proportionate and explainable. Recital 89 allows proportionate penalties in fixed-term contracts but does not define proportionate. The conservative reading is that a penalty should reflect your actual net loss. Tie it to documented costs, such as an upfront discount clawed back if the customer leaves early, waived setup fees, or onboarding and training you invested in. A penalty equal to the full remaining contract value is the most likely to be challenged.
• Price multi-year deals with the exit in mind. If you still offer 24- or 36-month contracts, state what happens on early exit, including which discount is clawed back, which fees remain payable and how refunds are calculated. This keeps the commercial logic of a long commitment without relying on lock-in.
• Strengthen contract language. Contracts must clearly state what happens when a customer switches or terminates; how data export works, including the notice, transitional and retrieval periods; and which early termination penalties and remaining switching charges apply. Vague or ambiguous terms will work against the provider in any dispute about refunds or penalties.
• Invest in portability and interoperability. The law obliges providers to make data export and switching smooth. This means building APIs, offering machine-readable formats and ensuring customers can migrate without losing functionality. Providers who do this well will turn a regulatory burden into a trust signal.
• Rethink customer success. Retention cannot rely on lock-in. SaaS companies must double down on value delivery, product stickiness and proactive customer success.

Watch the Digital Omnibus. In November 2025 the European Commission proposed targeted changes to these rules. Contracts signed before the Data Act applied would be exempt from most switching obligations where the service is custom-made or provided by a small or medium-sized enterprise or a small mid-cap (European Commission). The negotiating text would also state explicitly that proportionate early termination penalties are allowed in fixed-term contracts, while infrastructure services would not benefit from the small-company exemption. As of July 2026 the amendments were still being negotiated and were not final (Greenberg Traurig, 2026). Until they are adopted, plan on the current rules.

What it means for ARR, renewals and forecasting

For revenue teams, the Data Act turns contract length from a retention guarantee into one signal among several. Four changes help.

• Capture contract terms as data, not PDFs. Record the notice period, prepayment and refund terms, any early termination penalty, and whether the contract was signed before or after 12 September 2025 on the CRM or billing record. In our client work, renewal terms such as notice windows and price-increase clauses often live only in signed PDFs. Capturing them on the order form and the deal record is what makes renewals auditable.
• Report ARR by contract year. When the full value of a multi-year contract is counted as ARR, the forecast is inflated, and early exits make that error more expensive. Year-by-year ARR shows what is really at risk in each period.
• Score renewal risk all year, not only before renewal. Our Five Dots renewal risk model weights product usage trend at 30%, executive sponsor status and value realisation at 20% each, and support history, commercial signals and relationship breadth at 10% each. It treats a departed sponsor, usage below the level the contract needs or a competitive evaluation as high risk, whatever the score. The model scores the whole book monthly and accounts within 120 days of renewal weekly. Under the Data Act a customer can give notice in any month, so the weekly list should include every at-risk EU account, not only upcoming renewals.
• Revisit discount and pricing logic. Multi-year discounts, ramp deals and seat commitments were all priced on the assumption of a full term. Our guides to AI pricing models and to the pressure on seat-based pricing cover the alternatives.

The bigger picture

The EU is sending a clear message that in the digital economy, customer choice comes first. Just as the General Data Protection Regulation reshaped how companies handle personal data, the Data Act reshapes how they handle contractual power.

For SaaS vendors, this is frustrating. It undermines a proven business model and creates financial uncertainty. But it is also an opportunity. Providers that embrace transparency, fair pricing and customer-centric design may gain a competitive edge.

It also raises a few strategic questions.

• Will SaaS companies outside the EU adjust their global terms to match, creating de facto global standards?
• Will enterprise procurement teams use the EU rules as leverage, even outside Europe?
• Will investors revise their assumptions about SaaS revenue predictability in European markets?

These questions belong on the board agenda of any SaaS company with EU customers.

Final thought

I spent several hours researching this topic, and while I am not a legal expert, the direction is clear. The EU Data Act is a major regulatory shift, and SaaS companies cannot ignore it.

If you are a provider, coordinate with your legal and commercial teams now. Review your contracts, update your pricing models and prepare for higher churn. If you are a customer, understand your new rights and how to use them.

From 12 January 2027, switching charges are banned outright. Early termination penalties are not, as long as they are proportionate and disclosed, so switching will become cheaper and faster but not always free. Those who prepare early will adapt. Those who do not may find themselves losing customers they assumed were locked in.

If you want your contract and renewal data in shape before more customers use these rights, our CRM and GTM Health Check is a fixed-scope place to start.

FAQ

Can customers cancel a SaaS contract at any time under the EU Data Act?

Almost. Customers can ask to switch to another provider or to their own infrastructure, or to have their data erased, with no more than two months' notice, and the contract ends when that process is complete. The provider can still charge proportionate early termination penalties that were disclosed and agreed in the contract.

Does the EU Data Act apply to existing SaaS contracts?

Yes. The switching rules have applied since 12 September 2025, including to contracts that were already running, because the regulation sets no transition period for that chapter. A Commission proposal from November 2025 would exempt some older contracts, but it was not final as of July 2026.

Are early termination fees allowed under the EU Data Act?

Yes, if they are proportionate and disclosed before signing. Recital 89 confirms that fixed-term contracts with proportionate early termination penalties remain possible, and Article 29(4) requires providers to inform customers about them in advance. A penalty equal to the full remaining contract value risks being treated as a barrier to switching.

Are multi-year SaaS contracts still allowed in the EU?

Yes. Fixed terms of any length remain legal, but customers can still switch with two months' notice during the term. Protect multi-year deals with proportionate exit terms, for example clawing back an upfront discount, rather than relying on the term itself.

What changes on 12 January 2027?

From 12 January 2027, providers may not impose any switching charges, including data egress charges, for the switching process. Until then, reduced switching charges are allowed if they do not exceed the provider's direct costs. Standard service fees and early termination penalties are not switching charges, so they are not affected.

What happens with the EU Data Act in September 2026?

On 12 September 2026, the obligation to design connected products so that users can access their data began to apply to products placed on the market after that date (Article 50). It does not change the SaaS switching rules, which have applied since 12 September 2025.