The EU Data Act: What It Means Now for the Fintech Industry

The EU Data Act is now in effect. Although it was published at the end of 2023 and formally entered into force in January 2024, the real impact began on 12 September 2025, when most of its obligations started to apply.

The Act is a key part of the EU’s broader data strategy. Its goals are to increase access to industrial and service-generated data, prevent unfair lock-ins, and create a fairer balance between large providers and smaller businesses.

For retail brokers, CFD/FX platforms, fintech firms, and their vendors, the changes are already shaping the way data, contracts, and cloud services are managed.

Like the AI Act earlier this year, the Data Act signals a shift from preparation to enforcement.

Since September 2025, the EU Data Act has been reshaping how trading and fintech firms manage the data they produce and depend on. Brokers and platforms now have to make client, trading, and onboarding data accessible and shareable when requested. Fintechs and payment providers gain broader rights to use third-party data, but they also need to be ready to open up their own. Technology vendors must design systems that support portability and interoperability, ending the era of “closed box” platforms. Cloud providers, in turn, are required to remove contractual and technical barriers so firms can switch services more easily.

If you handle, process, or rely on client or trading data in the EU, the Act applies to you.

From mid-September, several rules became directly enforceable:

• Data access rights: Users, including brokers, can now access and share the data they co-generate. Vendors must provide it in structured, machine-readable formats.
• Contract fairness: Unilateral “take-it-or-leave-it” clauses are prohibited. Smaller brokers and fintechs can challenge terms imposed by large infrastructure or liquidity providers.
• Cloud switching: Providers must remove barriers that stop customers moving their services. This applies to SaaS, PaaS, and infrastructure systems.
• Public authority requests: In exceptional cases such as crises, regulators or governments may request access to privately held data, including financial flow information.
• Trade secrets & security: Sensitive data can be shared only if confidentiality is safeguarded. Data holders may refuse requests if they risk serious harm.

• loud migration: A broker wants to move its CRM from a US-based SaaS to an EU provider. The provider must now enable this at reasonable cost and within a set timeframe.
• Regulatory request: During a stress event, authorities ask for aggregated trading data. Brokers must comply if the request is proportionate.
• Unfair terms: A payments fintech faces liability-heavy contract terms. Post-September 2025, such clauses can be struck down.

Autumn 2025 marks a turning point. Firms are no longer preparing for the Data Act, they are already operating under it. Brokers and fintechs now hold stronger rights in their relationships with infrastructure and SaaS providers, while technology vendors face new requirements on transparency and interoperability.

The shift brings fresh compliance risks. Ignoring data access requests, holding on to outdated contracts, or depending on vendor lock-ins is no longer an option. At the same time, firms that adapt stand to gain: stronger negotiating positions, lower costs, and greater client trust by showing themselves as transparent and forward-looking.

It’s live now: Since September 2025, brokers, fintechs, and vendors are already subject to obligations.

• Stronger rights: Smaller firms can challenge unfair contract terms and switch cloud providers more easily.
• New risks: Mishandling data access requests or ignoring regulator demands could trigger disputes or penalties.
• Vendors under pressure: Trading tech and SaaS providers must enable interoperability and machine-readable data exports.
• Strategic upside: Early adopters can cut costs, negotiate better terms, and use transparency as a client trust tool.