The framing you will see everywhere is procurement-shaped. Revenue Wizards ran a piece titled “The EU Data Act Just Killed Long SaaS Contracts,” and in one sense they’re right… if your customer can walk out on two months’ notice regardless of what the multi-year agreement says, then the multi-year discount has stopped being a leash that keeps your customers tied to your product.

But, let’s be honest, leashes aren’t cool. And really, Article 25 isn’t about a leash.

It gives customers a maximum notice period of two months, under Article 25(2)(d). Then a mandatory maximum transitional period of thirty calendar days to complete the switch, under Article 25(2)(a). That can stretch to seven months only if the provider can demonstrate that the thirty-day period is technically unfeasible, justify it in writing, and notify the customer within fourteen working days, as required by Article 25(4).

After that, the customer gets at least thirty more calendar days to retrieve their exportable data, under Article 25(2)(g). Once the retrieval period ends, the provider must guarantee full erasure of the exportable data and digital assets covered by the provision, under Article 25(2)(h).

Throughout the switch, business continuity and a high level of security are the provider’s obligations, not yours. Article 25(2)(a) makes that explicit.

Okay so why is this scale to zero? Read that legal stuff again with an architect’s eye instead of a lawyer’s. The regulation doesn’t give you portability, it gives you permission to be portable, and then it starts a timer.

Yeah, the money part is kind of important, the money shows up on a spreadsheet and we’re talking money when we say Egress fees will be gone by January 2027… And I’m in no way going to try to argue egress fees are real, it never cost the provider anything like what they bill you for. And it sort of became a way to tax a customer for wanting to leave.

But let’s talk about that architecture problem. Article 25 gives you thirty calendar days, not thirty days to plan the migration. You start that clock and you have thirty days to complete it, supporting continuity, starting from the end of the notice period.

Getting back to scale to zero… if your data lives inside a proprietary engine in a proprietary format, if half your business logic is stored procedures nobody has read since that guy none of us really remember but wrote them and left… if your data model is an oral tradition maintained by three people in a Slack channel… well you’re probably not getting this done in thirty days.

So while the law can make the invoice drop to zero, it doesn’t magically make your architecture portable.

This is why Rule 2 is so important: Keep your center of gravity low. Open formats, on storage you control means you understand your data, the new guy understands your data, and it’s not a forensic exercise to reverse engineer some proprietary mess.

It’s not that Brussels is trying to force better architecture, but if they want to make portability a real thing, then the architecture needs to honor that rule… and that same portability needs Rule 9: Document your schemas. “Exportable data” is a legal term now. It is also a factual claim about your system, and the Data Act is going to check.

Article 25 obliges the provider to hand your exportable data back. It says nothing whatsoever about whether you will know what to do with it when . A you get it. A vendor can comply perfectly and dump every byte you are entitled to, on schedule, at no charge.. And there you stand, holding forty terabytes of cryptic mess.

Compliance is their problem, actually being able to DO anything with that data is your proble… Article 25(2)(e) says:

An exhaustive specification of all categories of data and digital assets that can be ported during the switching process, including, at a minimum, all exportable data.

But keep in mind… it does NOT explicitly say:

  • Every CSV must have a data dictionary.
  • Every field must be documented.
  • The export must preserve the original database schema.
  • The provider must supply foreign-key relationships.
  • The export must be immediately usable in a replacement system.
  • The export must be delivered in a particular format such as Parquet, JSON, or SQL dump.

“What would it cost us to leave?” was an unanswerable question, and being unanswerable was the entire point. The number was large, nobody had measured it, and so nobody proposed leaving. Lock-in worked not because exit was expensive but because exit was unquantified.

We still don’t know what it’s going to cost. Sure, you don’t have to pay that network fee, but you don’t know what that migration is going to cost in terms of understanding and migrating that data into something useful.

Remember Rule 5: Every dependency is a decision. Your SaaS data that you don’t control is still a dependency decision, all that changed is that it’s a decision with a statutory deadline attached.

So here’s the homework, and it’s not a big lift.

Pick the three vendors you’d actually bleed from if they vanished tomorrow. Go find their export documentation, and I don't mean the marketing page that says “your data is yours,” look for the actual spec. Is there a list of what comes out? Are the fields named and defined somewhere a new hire could read them? Does it preserve relationships, or does it hand you flat files and a shrug? Can you point at a schema doc today, right now, without emailing your account rep?

If you can’t answer that in an afternoon, congratulations, you’ve found your migration cost. It was never the egress fee. It’s this, and it’s been sitting quietly behind the egress fee the whole time, not showing up on a single invoice.

Then run the same test on yourself, because this cuts both ways. Somebody’s going to run it on you in 2027, and “we document our schemas” is about to stop being housekeeping and start being something you can say out loud while your competitor can’t.

I’m not a lawyer and this isn’t legal advice, but you  should read the data act with the critical eye of an architect. A lawyer reads Article 25 and sees obligations discharged on schedule. An architect reads those same paragraphs and sees a thirty day clock, an “exhaustive specification” with no format attached to it, and about six things the law never got around to asking for. Both readings are correct. Only one of them tells you whether you can actually leave.