Europe’s New Data Price Tag Is Also a Security Test

When the Data Act began applying on 12 September 2025, it turned a legal question into an operational one: how do you charge for mandated data sharing without making the process opaque, discriminatory, or impossible to audit? That is the real pressure point behind the European Commission’s guidance on reasonable compensation.

Fast Facts

• The Data Act creates mandatory B2B data-sharing rules in specified cases.
• Data holders may request reasonable compensation, but the terms must remain FRAND.
• Recoverable costs can include the costs of making data available, including dissemination and storage costs.
• Micro companies, SMEs, and non-profit research organisations face special limits on what can be charged.
• Transparency and antitrust risk sit close to the center of the framework.

Why the pricing model matters

The Data Act does not treat data access as a free-for-all. In the Chapter III framework, certain data holders can ask for compensation when they are legally required to make data available to a business requester. The core constraint is FRAND: fair, reasonable and non-discriminatory terms. In practice, that means pricing cannot be arbitrary, hidden, or structured to favor one counterparty over another.

The European Commission’s guidance focuses attention on recoverable costs, with the public framing emphasizing the costs of making data available, including dissemination and storage. That matters because the economic model has to be defensible: firms need a clear basis for what is billed, why it is billed, and how the number was reached. For smaller enterprises and non-profit research organisations, the regime is tighter still, with special protections that limit how much can be charged.

The cybersecurity angle

This is not a classic breach story, but it is a security-adjacent governance problem. Any company that has to share regulated data will need better inventorying, access controls, and cost documentation. If a data-sharing pipeline is poorly classified, the firm may struggle to separate chargeable handling from ordinary overhead, or to show that its terms are consistent across similar requests.

The Data Act also includes trade-secret and security-related exceptions that can limit disclosure in fact-specific cases. That creates a compliance burden: organizations need workflows for exception handling, notice, and review, not just pricing tables. At the same time, competition-law sensitivity is real. If pricing methods are coordinated too closely across competitors, they can draw antitrust scrutiny, especially where fee schedules start to look like market-wide standardization.

At the time of writing, the public materials do not fully settle the final formula or every operational edge case. The available information supports a risk analysis, not a definitive reading of how every contract will be priced in practice.

Conclusion

The practical lesson is simple: under the Data Act, compensation is not just a finance issue. It is a test of whether an organization can document access, justify costs, apply FRAND terms, and keep the process defensible under regulatory scrutiny. In the new EU data market, the companies that manage that control plane well will be the ones least likely to turn compliance into friction.

WIKICROOK

• Data Act: An EU regulation that sets rules for data access, sharing, interoperability, and related obligations across the bloc.
• Data holder: The party that holds the relevant data under the Data Act and, in the Chapter III context, may request reasonable compensation when sharing is legally required.
• FRAND: “Fair, reasonable and non-discriminatory” terms used by the Data Act to constrain compensation and sharing conditions.
• Recoverable costs: Costs that can be justified in connection with making data available, including dissemination and storage costs.
• Antitrust: Competition-law rules that can be triggered when pricing or coordination starts to restrict fair market behavior.