The Netherlands Authority for Consumers and Markets (ACM) today published a 52-page draft guidance document on the cloud chapters of the EU Data Act, setting out how providers must handle customers who leave, customers who run several clouds side by side, and foreign government requests for European data - and confirming that switching fees disappear on January 12, 2027.

In Short

The Dutch competition and consumer regulator wrote a long explainer on the EU rules that make it easier to leave a cloud provider or use two providers at once. From January 12, 2027, a cloud company cannot charge you for moving your data elsewhere, though it can still bill the real data transfer cost when two clouds keep exchanging data. Providers based in the Netherlands now have until November 6 to tell the ACM where the draft is wrong or unclear, and every contract, including old ones, has to meet the rules.

What the ACM published

The document is titled "Leidraad Cloud - Dataverordening: overstappen, interoperabiliteit en internationale doorgifte van data" (Cloud Guidance - Data Act: switching, interoperability and international transfer of data). It carries case number ACM/26/202057 and document number ACM/INT/1076611, and is marked public. The PDF itself carries no publication date. Two pages on the ACM website, both dated October 19, 2026, describe it: one presents the guidance as published, the other opens a consultation on it, with written responses accepted until November 6. The PDF settles the status in paragraph 19: "Deze leidraad betreft een voorlopige versie" - this guidance is a provisional version.

It is the ACM's second Data Act guide. The first, the Leidraad Data Delen, covered the regulation's rules on data from connected products. This one covers Chapters 6, 7 and 8 of Regulation (EU) 2023/2854: switching between data processing services, parallel use of those services, interoperability, and the handling of international access to non-personal data. Articles 33 and 36, on data spaces and smart contracts, are explicitly left out.

The audience is providers. According to the ACM, the guidance is "primarily aimed at providers of data processing services," though customers can use it to understand their rights, and consultants, lawyers and trade associations are named as secondary readers. The ACM's own announcement page frames the stakes in market terms: the three largest cloud providers serve about 75 percent of the market, and high switching costs, closed systems and complex contracts discourage customers from moving, according to the ACM.

The Data Act became applicable on September 12, 2025. The Dutch implementing law, the Uitvoeringswet dataverordening, dated October 29, 2025, designated the ACM as supervisor for a large part of the regulation and as data coordinator for the Netherlands.

Three caveats sit in the opening chapter. The guidance is not a policy rule; compliance remains each provider's own responsibility. The examples are fictional and "not based on signals the ACM receives from the market," nor do they indicate enforcement priorities (all translations from the Dutch are PPC Land's). And the ACM says it will update the text periodically as supervision, case law and coordination with other regulators develop.

Who counts as a cloud provider

The Data Act does not use the word cloud. It regulates "data processing services," and the ACM spends several pages on why that distinction matters. A data processing service, under Article 2 of the regulation, is a digital service that provides ubiquitous, on-demand network access to a shared pool of configurable, scalable and elastic computing resources, which can be rapidly provisioned and released with minimal management effort. The ACM breaks this into separate elements and states that they are cumulative: every element must be met.

The guidance leans heavily on a June 2026 study by the German institute WIK on classifying data processing services, and on the 2011 NIST definition of cloud computing, which it describes as the industry standard. Where a service meets every element but one is in doubt, the ACM says that element "should be interpreted broadly" in the spirit of the regulation.

The most consequential interpretation concerns purpose. The ACM reads the definition of "customer" to require that the customer uses the service precisely for its access to shared computing capacity. Where access to shared computing is merely a by-product of some other function, the service falls outside the definition. Four fictional examples make the line concrete:

  • A consultancy, Consul B.V., signs a contract with a provider, In de Wolken B.V. The consultancy is the customer. Its employees are users, not customers, and have no rights under these chapters.
  • A CRM provider, Klanthulp B.V., sells to a call centre while itself buying infrastructure from In de Wolken B.V. Klanthulp is both a provider and a customer, and benefits from the regulation's rights in the second role.
  • A video-sharing platform streams stored videos using computing capacity. The ACM says this is not a data processing service, because the capacity serves a different purpose than data processing.
  • A robot vacuum app stores floor plans on shared infrastructure. Again, not a data processing service: the capacity serves the purpose of controlling a vacuum.

Software sold as a service rather than as a product can qualify, according to the ACM. A product installed and run locally, but requiring a subscription to operate, does not. The guidance names the three classic delivery models - Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service - plus variants such as Database-as-a-Service, Function-as-a-Service and Container-as-a-Service, and says that a service outside every listed model still has to comply if it fits the definition.

Territorial reach

The regulation applies to providers outside the EU when they offer data processing services to customers in the EU. A two-column table in the guidance sets out who must comply. A non-EU provider serving EU customers is in scope. A subsidiary serving EU customers is in scope even if its parent is not. A provider that buys computing resources from a non-EU company that does not itself serve the EU must still ensure its own service complies, whatever the upstream supplier does.

Two narrow exceptions exist. Custom-built services, where most main features are tailored to a single customer, and test versions offered for a limited period outside production, can be excluded from certain obligations. Configurable services are not custom-built, according to the ACM, and providers relying on an exception must say so before a contract is signed.

Who supervises whom

Supervision follows the country-of-origin principle in Article 37(10) of the Data Act. A provider falls primarily under the authority of the member state where it has its European headquarters. Complaints, however, go to the authority where the complainant is established. A Dutch business with a grievance against a provider headquartered elsewhere files with the ACM, which assesses and forwards it. The ACM can also ask another authority to take enforcement measures, and that authority must respond.

Dispute settlement bodies are a second route under Article 10. The ACM is responsible for certifying them in the Netherlands. At the time of publication, the guidance states, none has been certified.

Switching and parallel use

The guidance draws a firm line between two customer behaviours. Switching means ending all or part of a contract to move to another provider, to several providers, or to on-premises infrastructure. Parallel use means running services from different providers at the same time, with data flowing between them, without ending either contract.

A figure in the guidance sets out three switching types: a full move to one provider, a move to on-premises infrastructure, and the unbundling of one service from a provider's wider package so it can be moved elsewhere. The ACM calls the third type "one of the core interventions of the Data Act," because it allows a customer to avoid "a larger-than-necessary package." Switching obligations apply only to a move to a service "of the same type," meaning the same primary objective, delivery model and main functionalities. Parallel use obligations apply regardless of service type.

The ACM's example of parallel use is mundane by design. A customer runs a CRM with one provider and a project management tool with another. When a sale closes in the CRM, the project tool automatically creates an invoicing task for finance. If the two systems need to exchange data to do that, the customer is in parallel use and the rules apply. Two services that run side by side with no data exchange are not parallel use.

Behind the specific duties sit two general ones. Under Article 23, providers must remove commercial, technical, contractual and organisational obstacles to switching and parallel use. Under Article 27, all parties must cooperate in good faith. The ACM's reading is that meeting every specific obligation is not enough on its own. If a contract contains an obstacle not listed in Article 25, "the provider must still remove these obstacles on the basis of the general obligation" in Article 23.

The ACM fills one gap itself. The regulation does not say who is responsible when data must be transformed to fit the destination's environment. The ACM's answer is that transformation is a proportionately shared responsibility of the customer, the original provider and the destination provider. The original provider is responsible for extracting data in a usable format; the customer and destination provider are jointly responsible for uploading it.

The contract clock

Every contract must be in writing and made available before signing in a form the customer can store. The obligations apply to all agreements regardless of when they were signed or how long they run. "Providers who do not amend their contracts to comply with the Data Act are in breach of the regulation," the guidance states.

The switching timeline has three fixed boundaries:

  • Notice period: a maximum of two months between the customer's switching request and the start of the transition.
  • Transitional period: a maximum of 30 calendar days during which the switch takes place and the service agreement remains in force.
  • Retrieval period: a minimum of 30 calendar days after the transition, during which the customer can still access its data.

If a 30-day transition is technically unfeasible, the provider must notify the customer within 14 working days of the request, justify the unfeasibility and propose an alternative transitional period of no more than seven months. The customer can extend the transitional period once, at its own discretion, before or during it.

The ACM adds one practical expectation that goes beyond the legal minimum. Legally, a customer only has to state at the end of the notice period whether it is moving to another provider, moving on-premises or simply having its data erased. Because waiting causes delay, a footnote says the ACM "expects" customers to make that choice when they file the request.

Contracts must also contain an exhaustive specification of the data categories and digital assets that can be transferred, including all exportable data, and a separate list of data that is internal to the service and excluded. That exclusion is allowed only where including the data would risk a breach of trade secrets, and only if the exclusion does not hinder or delay the switch. Every switching charge must be listed in the contract; costs not described there cannot be charged, according to the ACM.

The guidance points to the European Commission's non-binding Standard Contractual Clauses for cloud computing contracts, with an Annex VI on switching and exit dated November 19, 2025. The clauses are currently only in English, and the ACM notes they are a draft still awaiting adoption.

Annex II turns all of this into a self-assessment. The checklist runs to 28 yes-or-no questions in nine sections, each tied to an article of the regulation, from "Does your service fall under the DA?" through notice periods, retrieval periods, the one-time extension right, online registers and international access transparency, to the fee phase-out. The ACM adds that it "explicitly does not replace legal advice."

Fees: what ends in 2027 and what does not

From January 12, 2027, providers may no longer charge any switching fees. Until then, under Article 29, they may charge only costs directly linked to the switch. The ACM sorts those into two kinds:

  • Data transfer costs, the egress fees charged for network traffic when data leaves the original provider. The ACM notes these depend on volume and physical location, citing its own 2021 cloud market study: transfers from North America to another continent can carry a different rate than transfers from South America.
  • Technical support costs, such as data transformation, customer-specific documentation, validation and testing after extraction, temporary backups on request and additional security measures.

Costs a provider incurs by hiring a third party for such tasks cannot be passed on, according to the ACM.

Parallel use is treated differently, and the difference survives the 2027 deadline. Because parallel use involves continuous rather than one-off data exchange, providers may keep charging for it after January 12, 2027 - but only data transfer costs, both for egress and ingress, and never more than the costs actually incurred. Charges for technical support in parallel use are not allowed at all. The application programming interfaces used for that exchange must themselves be offered free of charge, with no discrimination between customers or competing providers.

Early termination penalties for fixed-term contracts remain lawful if proportionate. The ACM interprets that to mean the penalty "may not be higher than the amount the customer would have owed if the agreement had continued until the end date," and providers must disclose it before signing.

Providers also have to publish, in a dedicated and easy-to-find part of their website, which of their services are very complex or costly to switch, or impossible to switch without significant interference in data or architecture.

Technical duties

The technical obligations split by delivery model. Providers of services other than Infrastructure-as-a-Service must offer open interfaces free of charge and on equal terms to customers and to competing providers serving the same customer. "Free" covers both development and maintenance. The interfaces must contain enough information to build software that exchanges data with the service, and that information belongs in the provider's online register.

There is a cost-benefit escape. If building an interface for a given functionality would cost far more than its use is worth - for instance, when an extremely low number of customers use that feature - the provider may decline, and the ACM says it will weigh costs and benefits in its supervision. Providers are also not required to develop new services, compromise security or disclose assets protected by trade secrets.

Where no automated process for interface access exists, the ACM "advises" setting up a transparent, good-faith process in which the provider engages with the requesting party and offers sufficient consultation and support. That passage is one of the few in which the guidance reads as a recommendation rather than an explanation of the law.

On standards, the regulation provides two routes to interoperability for these services. The Commission prefers market-led open interoperability specifications that can be adopted as common specifications through implementing acts; if that fails, it can ask standardisation bodies such as CEN, CENELEC or ETSI to draft harmonised standards. Both end up in a central Union repository, and providers must comply within 12 months of publication. Compliance covers service interoperability, data portability without loss of meaning, and portability of application information such as instructions, metadata, behaviour and policies.

"At the time of publication of this guidance, the central Union repository is not yet accessible," the ACM states. Until standards appear there, providers must make data available in a commonly used, machine-readable format.

Infrastructure providers

Infrastructure-as-a-Service providers are exempt from the interface and standards duties. Instead, they must take all reasonable and feasible measures so the customer reaches functional equivalence at the destination, meaning a "materially comparable outcome" from the same input. The ACM lists capacity, including staff support, documentation, file formats, user settings and testing tools. The duty covers only features both the original and destination services offer, and it does not mean the original provider must rebuild the service inside the destination's infrastructure.

Infrastructure providers must also, as far as technically feasible, remove obstacles to unbundling infrastructure services from their other services. The ACM's example is a customer that buys virtual desktops from In de Wolken B.V. but wants to manage access through its own identity and access management system. The provider offers an API that lets it do so.

Foreign government access

Chapter 7 of the regulation applies to all non-personal data held in the EU by data processing providers, regardless of where the customer or provider is established. Providers must take technical, organisational and legal measures to prevent unlawful access or transfer by third-country public authorities. Access is unlawful when it conflicts with EU or member state law, "even if access is justified on the basis of the law of a third country, such as the CLOUD Act," according to the guidance. Encryption, regular audits, verified certification compliance and changes to corporate policy are named as examples of measures. Providers must publish them on their website and refer to that page in every contract.

The guidance sets out a decision procedure in a flowchart. First, the provider checks whether an international agreement or mutual legal assistance treaty between the EU, or the member state, and the third country is in force. If one is, the request may be treated as recognisable and enforceable. If none is, the provider must run a prior risk analysis of the third country's legal system against three cumulative criteria: the decision must be reasoned, specific and proportionate; the customer must be able to file a reasoned objection reviewed by a competent court, with purely administrative appeal not counting; and the court must be able to take account of the data provider's legal interests protected under EU or national law.

Where the request passes, only the minimum necessary data may be provided. The ACM extends data minimisation to non-personal data: unrelated information in a dataset must be separated out. The customer must be informed before the provider complies, unless that would undermine law enforcement. If national security or defence could be affected, the provider must seek advice from national authorities. If a provider seeks advice and hears nothing after a month, it may refuse the foreign request. In the Netherlands, the guidance says, there is no single competent authority; providers can write to the Ministry of Economic Affairs and Climate Policy at a dedicated mailbox, and the ACM is available for advice on the regulation itself.

The guidance is careful to separate this from data localisation. The Data Act "explicitly does not limit" international transfers, citing the 2018 regulation on the free flow of non-personal data. And where personal and non-personal data are mixed and cannot be separated, the GDPR prevails.

Overlaps with other law

The ACM asked other Dutch regulators to describe where their rules touch the Data Act. De Nederlandsche Bank and the AFM point to NIS2, implemented in the Netherlands as the Cyberbeveiligingswet, and to DORA, under which the most critical ICT providers to the financial sector come under direct European oversight from 2026. The Autoriteit Persoonsgegevens points to the GDPR right to data portability in Article 20, and to Article 32 security duties, which for vital processes dependent on an external provider can mean having a plan to switch quickly in an emergency.

A footnote records that market investigations into designating Amazon Web Services and Microsoft Azure as gatekeepers under the Digital Markets Act were running at the time of publication, and that any designation would bring obligations overlapping with the Data Act. The guidance also notes that the Commission's Digital Omnibus proposal contains "some minor adjustments" to Chapter 6, and that the ACM will revise the guidance if those become law and the Dutch implementing act changes.

Small inconsistencies in the draft

A few cross-references do not match. The information-duties section points to "paragraph 37" for interoperability requirements, which are in section 5.3. The text introduces the international-access flowchart as Figure 5 while the caption labels it Figure 4. The advice paragraph refers back to "the three criteria from paragraph 156," which are set out in paragraph 157. None changes the substance, and the consultation is the stage at which such errors are normally corrected.

Why this matters for marketing technology

Most advertisers and publishers are cloud customers several times over: a CRM, an analytics suite, a data warehouse, a customer data platform, an ad server, each possibly with a different vendor and most running on one of a handful of hyperscaler infrastructures. The ACM's purpose-based reading of "customer" and its CRM, ERP and project management examples place many of those SaaS tools inside the regulation. The parallel-use provisions describe how marketing stacks are typically assembled: separate systems passing data to each other through APIs.

The question of whether the rules will change behaviour remains open. Spain's CNMC found that only 2.3 percent of sampled business cloud customers switched their main provider between 2022 and 2024, and flagged the multi-cloud exception to the fee ban as potentially ambiguous. The ACM's draft answers part of that ambiguity: parallel-use charges are limited to actual egress and ingress costs, support costs are excluded entirely, and interfaces must be free. What "actually incurred" costs look like for a large provider's network is not something the guidance attempts to quantify.

The ACM has been involved in the cloud question for some time. When the European Commission opened three Digital Markets Act market investigations into cloud computing on November 18, 2025, two of them assessing whether Amazon Web Services and Microsoft Azure should be designated as gatekeepers, the Dutch authority supported the work through a joint investigative team. In December 2025, the Dutch government raised concerns that exceptions to the cloud switching provisions in the Digital Omnibus would create uncertainty, warning that the custom-services exception risked "perpetuating the current vendor lock-in situation."

PPC Land has tracked the regulation's other half closely. The Data Act's switching framework and the January 12, 2027 fee phase-out were part of the rules that took effect on September 12, 2025. Germany's Bundesnetzagentur took up its role as national Data Act enforcer in 2026. And a Max Planck study argued this month that the Data Act's connected-device rules leave third parties without their own access claim.

The foreign access chapter has its own commercial context. AWS built its European Sovereign Cloud around a governance model meant to address exposure to US extraterritorial data demands under the CLOUD Act, with general availability in Germany in January 2026. The ACM's guidance names the CLOUD Act directly as an example of third-country law that does not make access lawful in the EU.

For providers headquartered in the Netherlands, the immediate deadlines are concrete: contracts must already comply, comments on the draft close on November 6, and switching fees end on January 12, 2027. Whether the final text changes after consultation, and whether the Digital Omnibus alters Chapter 6 before then, are the two open variables.

Timeline

Summary

Who: The Netherlands Authority for Consumers and Markets (ACM), the Dutch supervisor and data coordinator for the EU Data Act, addressing providers of data processing services, including cloud and SaaS vendors headquartered in the Netherlands, and their business and consumer customers.

What: A 52-page provisional guidance document, the Leidraad Cloud, explaining Chapters 6 to 8 of the Data Act: no obstacles to switching or parallel use, a two-month maximum notice period, a 30-day transition, a minimum 30-day retrieval period, free and non-discriminatory interfaces, functional equivalence for infrastructure services, a ban on switching fees from January 12, 2027, at-cost data transfer charges for parallel use, and a three-step test for foreign government data requests. A 28-question contract checklist is annexed.

When: Published today, October 19, 2026; consultation responses are accepted until November 6, 2026. The Data Act has applied since September 12, 2025, and switching fees end on January 12, 2027.

Where: The Netherlands, with effect across the EU through the country-of-origin principle, and for non-EU providers serving EU customers.

Why: The ACM says it publishes guidance because translating the law into practice is sometimes difficult for companies. The broader aim of the regulation, as the guidance puts it, is that customers can switch "fast, fluid and free" between services and combine several providers, in a market where, according to the ACM, three providers serve about 75 percent of customers.