{"id":21189,"date":"2025-05-13T10:00:50","date_gmt":"2025-05-13T08:00:50","guid":{"rendered":"https:\/\/cyberinsights.iainfraser.net\/?p=21189"},"modified":"2026-06-15T15:07:22","modified_gmt":"2026-06-15T13:07:22","slug":"understanding-the-european-data-act","status":"publish","type":"post","link":"https:\/\/smecyberinsights.co.uk\/index.php\/2025\/05\/13\/understanding-the-european-data-act\/","title":{"rendered":"COMPLIANCE: Understanding the European Data Act and GDPR Compliance for UK SMEs"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"Partners1_NordVPN\"<\/figure><\/div>
\"Partners3_R3\"<\/figure><\/div>
\"Partners2_Zoho\"<\/figure><\/div>
\"Partners4_Plesk\"<\/figure><\/div>
\"Red_Button_Slider\"<\/figure><\/div>
\"ogo2\"<\/figure><\/div>
\"Detection.<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"GDPR\"\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Designed By Freepik.com<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Helping Keep Small Business CYBERSafe!
\n<\/strong>Gibraltar: Tuesday 13 May 2025 at 10:00 CET<\/p>\n

COMPLIANCE: Understanding the European Data Act and GDPR Compliance for UK SMEs
\n<\/strong>By:\u00a0Iain Fraser<\/a>\u00a0\u2013\u00a0Cybersecurity Journalist<\/a>
\nSMECYBERInsights<\/a> \u2013\u00a0The UK Small Business Cybersecurity Network
\n<\/a>Google Indexed on 130525 at 11:58 CET<\/a>
\n#SMECyberInsights #SMECyberSecurity #SMECyberAwareness #CyberSafe #SME #SmallBusiness #Compliance<\/em><\/span><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

For UK-based small and medium enterprises (SMEs<\/strong><\/a>), navigating the evolving landscape of data protection regulations continues to present significant challenges. With the European Data Act<\/strong> (EDA<\/strong><\/a>) now in effect alongside the established General Data Protection Regulation<\/strong> (GDPR<\/strong><\/a>), businesses must understand how these frameworks interact and what compliance measures they need to implement.<\/p>\n

The European Data Act: What UK SMEs Need to Know<\/strong><\/p>\n

The European Data Act<\/strong>, which came into full effect in 2024, aims to create a fairer data economy by ensuring more equitable access to and use of data generated across all economic sectors in the EU.<\/p>\n

“While the UK is no longer part of the EU, the European Data Act still has significant implications for British <\/em>SMEs<\/em><\/strong><\/a> that conduct business with European partners or customers,”<\/em><\/p>\n

“Many UK companies operate within a supply chain that crosses borders, meaning these regulations can’t be ignored simply because of Brexit.”<\/em><\/p>\n

The Data Act focuses on:<\/strong><\/p>\n

\u2022\u00a0 Facilitating access to and use of data by consumers and businesses<\/p>\n

\u2022\u00a0 Establishing rules for data sharing across sectors<\/p>\n

\u2022\u00a0 Removing obstacles to data mobility<\/p>\n

\u2022\u00a0 Setting up safeguards against unlawful data transfer<\/p>\n

GDPR Compliance: Still Essential for UK Businesses<\/strong><\/p>\n

Despite the UK’s departure from the EU, GDPR<\/strong><\/a> principles remain embedded in UK law through the UK GDPR<\/strong><\/a> and Data Protection Act 2018.<\/p>\n

How the Data Act and GDPR Work Together<\/strong><\/p>\n

The relationship between these two regulatory frameworks is complementary. While GDPR<\/strong><\/a> focuses primarily on personal data protection, the Data Act addresses broader issues of data accessibility, portability, and fair use across both personal and non-personal data.<\/p>\n

“understanding where these regulations overlap and diverge is crucial for compliance. The Data Act doesn’t replace <\/em>GDPR<\/em><\/strong><\/a> but rather builds upon it to create a more comprehensive framework for the digital economy.”<\/em><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"GDPR\"\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Designed By Freepik.com<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Practical Steps for UK SMEs<\/strong><\/p>\n

1. Conduct a data audit<\/strong>: “Before implementing any compliance measures, you need to understand what data you hold, where it comes from, how it’s processed, and where it goes,” advises Budden. “This foundational step reveals your compliance obligations under both frameworks.”<\/p>\n

2. Review cross-border data transfers<\/strong>: With the UK now considered a “third country” by the EU, additional safeguards may be required for data transfers. “International data transfer agreements have become essential components of compliance for many of our clients,” says Budden.<\/p>\n

3. Update privacy policies and consent mechanisms<\/strong>: Ensure your documentation reflects compliance with both UK GDPR and, where applicable, EU GDPR and the Data Act.<\/p>\n

4. Implement data portability solutions<\/strong>: “The Data Act strengthens requirements around data portability,” Budden points out. “SMEs should ensure they can provide customers with their data in structured, commonly used, and machine-readable formats when requested.”<\/p>\n

5. Review contracts with service providers<\/strong>: Cloud service providers and IoT manufacturers now have specific obligations under the Data Act. Budden recommends: “Review your contracts to ensure they address unfair terms and provide mechanisms for data sharing.”<\/p>\n

The Cost of Non-Compliance<\/strong><\/p>\n

The financial implications of failing to comply with data regulations can be severe. Under GDPR<\/strong><\/a>, fines can reach up to \u20ac20 million or 4% of annual global turnover, whichever is higher. The Data Act introduces its own penalties for non-compliance.<\/p>\n

Conclusion<\/strong><\/p>\n

For UK SMEs<\/strong><\/a>, staying informed about evolving data regulations is not just a legal necessity but a business imperative.<\/p>\n

Understanding how the European Data Act<\/strong> interacts with existing GDPR<\/strong><\/a> requirements allows UK SMEs to develop comprehensive data strategies that satisfy regulatory requirements while creating value from their data assets.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"CYBERInsights\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: IfOnlyCommunications<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

SMECYBER Insights \u2013 Helping Keep Small Business CYBERSafe!\u00a0<\/strong><\/p>\n

Launched in 2020 by\u00a0Cybersecurity Journalist<\/a>\u00a0Iain Fraser<\/strong>\u00a0and his team at\u00a0IfOnly…<\/strong><\/a> SMECYBERInsights<\/strong><\/a> was developed to be the go-to platform providing definitive, reliable & actionable Cybersecurity News, Intel,\u00a0 Awareness & Training specifically written and curated for Small Business<\/strong><\/a> & Enterprise Owners, Partners and Directors throughout the UK.\u00a0#SMECyberInsights #SMECyberSecurity #CyberAttack #CyberAwareness\u00a0 #Compliance #DDoS #Fraud #Ransomware #ScamAlert #SME #SmallBusiness #SmallBusinessOwner #ThreatIntel <\/span>\u00a0<\/em><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Image Credit: Designed By Freepik.com Image Credit: Designed By Freepik.com Image Credit: IfOnlyCommunications<\/p>\n","protected":false},"author":1,"featured_media":21190,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"yes","footnotes":"","_ppma_block_editor_authors":""},"categories":[560],"tags":[629],"ppma_author":[505],"class_list":["post-21189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance","tag-complainace"],"featured_image_urls":{"full":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR.jpg",1430,941,false],"thumbnail":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR-150x150.jpg",150,150,true],"medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR-300x197.jpg",300,197,true],"medium_large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR-768x505.jpg",640,421,true],"large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR-1024x674.jpg",640,421,true],"1536x1536":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR.jpg",1430,941,false],"2048x2048":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR.jpg",1430,941,false],"covernews-featured":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR-1024x674.jpg",1024,674,true],"covernews-medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/GDPR-540x340.jpg",540,340,true]},"author_info":{"display_name":"Cybersecurity Journalist Iain Fraser","author_link":false},"category_info":"COMPLIANCE<\/a>","tag_info":"COMPLIANCE","comment_count":"0","authors":[{"term_id":505,"user_id":1,"is_guest":0,"slug":"admin_yjdstq4n","display_name":"Cybersecurity Journalist Iain Fraser","avatar_url":{"url":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png","url2x":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png"},"author_category":"1","user_url":"http:\/\/smecyberinsights.co.uk","last_name":"Cybersecurity Journalist","first_name":"Iain Fraser","job_title":"","description":""}],"_links":{"self":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/21189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=21189"}],"version-history":[{"count":11,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/21189\/revisions"}],"predecessor-version":[{"id":29610,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/21189\/revisions\/29610"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media\/21190"}],"wp:attachment":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=21189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=21189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=21189"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/ppma_author?post=21189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}