The EU Data Act is also of great significance to the real estate industry, as modern commercial properties have become data spaces. Heating and air conditioning systems, elevators, access control systems, and metering technology—as connected systems—can continuously generate data about their use or environment. The Data Act may grant users of such a networked system the right to access collected product data and related service data and to demand that this data be provided to third parties. As a result, data rights also become relevant to the drafting of lease agreements.
The Data Act has been directly applicable in all member states since September 12, 2025, and governs access to and use of data.
Landlords should first clarify their role
Landlords should give particular consideration to the following questions:
- What information must they make available to their tenants?
- What can they use the data for themselves?
- How should the disclosure of information to third parties be handled?
Landlords should determine for each connected system whether they themselves are the data controller or whether that role falls to, for example, the manufacturer, operator, maintenance service provider, or platform provider. For connected systems, the allocation of rights and obligations does not depend solely on who owns the building or system. Rather, the legal classification depends on the roles that landlords and tenants play with respect to the data generated. To determine this classification, the Data Act distinguishes between users and data owners. Users have rights to the data generated, while the data owner is responsible for providing it in accordance with the legal requirements.
If, as part of the lease agreement, a connected system is made available to the tenant for use, the tenant may be considered a user with respect to the data from that system covered by the Data Act. In that case, the tenant may request access to such data or its disclosure to third parties. If the landlord is classified as the data controller with respect to the same data, these rights may be asserted against the landlord. Whether this is the case must be determined separately for each connected device.
Landlord’s Obligations and Tenant’s Rights
The Data Act imposes a number of obligations on landlords.
Pre-Contractual Information and Liability
Even before a lease agreement is signed, the landlord may have certain disclosure obligations if, along with the rental property, he also provides a connected product for the tenant’s use. In particular, he must provide clear and understandable information regarding,
- what product data is generated,
- in what format and to what extent they occur,
- how long they are stored,
- how users can access them, and
- who is the data owner.
The landlord should therefore ensure that the necessary information regarding the facility is provided to him in a timely manner.
This obligation extends further than it might initially appear. Inaccurate information can have consequences for the landlord under tenancy law. If the pre-contractual information is incorporated into the lease agreement or is clearly made the basis for the agreed-upon use, it may help determine the required condition of the leased property. If the actual data availability deviates from this, claims under tenancy law regarding defects—as well as claims arising from inaccurate pre-contractual information—may apply, subject to the respective statutory or contractual requirements. What initially appears to be merely technical information can thus become a matter of liability under tenancy law.
Use of Our Own Data Only on a Contractual Basis
If the landlord, as the data controller, wishes to use readily available non-personal data generated from the use of the facility for its own purposes—such as to optimize building operations or to meet sustainability goals—it generally requires a contractual basis with the user to do so. The lease agreement should therefore clearly specify the purposes for which the data may be used. Any subsequent use for additional purposes not covered by the agreement requires a corresponding contractual agreement.
Disclosure of the Tenant’s Information to Third Parties
Conversely, the tenant, as the user, may request that the data generated during the use of a connected product be made available to a third party, such as an energy service provider or franchisor. If the landlord is classified as the data controller with respect to this data, this request may be directed to the landlord. The lease agreement should therefore also address such requests for data disclosure. In principle, the product data and associated service data that are readily available—including the metadata necessary for their interpretation and use—must be provided; however, analyses or derived insights obtained through additional investments need not be disclosed. If the data contains trade secrets of the landlord as the data controller, appropriate measures to protect their confidentiality must be agreed upon between the data controller and the third party before the data is provided. Under strict legal conditions, the provision of data may be suspended or refused.
Limitations on Contract Drafting
Users’ statutory rights of access and disclosure may be specified in a contract, but may not be excluded, restricted, or modified to their detriment. In commercial transactions, unilaterally imposed contractual terms regarding data access and data use are also not binding if they constitute an abuse of rights under Article 13 of the Data Act. When drafting such clauses, care must therefore be taken to ensure a balanced distribution of rights and obligations.
The limitations on contract drafting also apply to the subsequent use of the data. The landlord may not use non-personal building data to gain insight into the tenant’s financial situation, assets, production methods, or use of the premises if doing so could adversely affect the tenant’s business position. Particularly in commercial leases, consumption and usage data can provide insight into when and to what extent the tenant uses the space for business purposes.
If the collection, use, disclosure, or transfer of personal data is involved, a legal basis is required under the General Data Protection Regulation. The Data Act does not change this. Therefore, particularly with regard to access control systems, the requirements of the General Data Protection Regulation must also be observed and reviewed separately.
Recommendations for Drafting Contracts
Landlords should now apply the provisions of the Data Act to existing and new lease agreements. For existing lease agreements, landlords should review which connected devices are made available to the tenant for use, what roles the landlord and tenant assume as users or data controllers, and whether the handling of the generated data is already adequately regulated. For new leases, it is advisable to carefully document the pre-contractual information and to include the necessary data provisions in the contract from the outset.
The non-binding model contract terms published by the European Commission in a draft recommendation can serve as an initial starting point for this. However, they are not tailored to the specific characteristics of lease agreements. Therefore, each individual lease agreement requires provisions that are tailored to the building’s interconnected systems and the division of responsibilities between the landlord and the tenant.
