Request an intervention

Operational notes Regulation

Data Act: how long does switching to another cloud provider take?

7 min read

Close-up in black and white of two metal gears from a clockwork mechanism
Three time windows meshing into one another, like the teeth of a gear: the Regulation puts them in writing, the specification has to measure them.

Leaving a cloud service provider is not a decision you make on the day you need to: it is a project with a clock, and that clock only starts once the clauses governing it are already written into the contract — with the right to read them before signing. This is not a future deadline: Regulation (EU) 2023/2854, the Data Act, has applied since 12 September 2025, and Article 25, “Contractual terms concerning switching”, sits in Chapter VI. Article 50 lists three exceptions to general application — Article 3(1), Chapter III and Chapter IV — and Chapter VI is not among them. Yesterday we checked the same Regulation on Article 28, the jurisdiction of the infrastructure that processes your data. Here the angle is different: not where the infrastructure sits, but what happens — under the contract — when you decide to leave it.

Three windows, added together

Add together the three windows that Article 25 puts in writing and you get the real timetable of a provider switch, not the one imagined in a business-continuity plan. Point (d) sets “a maximum notice period for initiation of the switching process, which shall not exceed two months”. After that notice period, point (a) begins: “the mandatory maximum transitional period of 30 calendar days”, during which “the service contract remains applicable” and the provider keeps supplying the service, with assistance to the customer, business continuity, clear information on known risks and a high level of security throughout, data included. Then point (g): “a minimum period for data retrieval of at least 30 calendar days”, running from the end of the transitional period. Two months plus thirty days plus thirty days: up to four months — and paragraph 4 allows, where the transitional period is technically unfeasible, an alternative period of up to seven months, with the customer notified within 14 working days. Anyone planning a migration by adding up only the technical time needed to transfer data is planning against the wrong duration.

Before signing: the right to read the contract

Article 25(1) does not simply require the clauses to exist. It states that the rights of the customer and the obligations of the provider “shall be clearly set out in a written contract”, and that the provider makes that contract available to the customer “prior to signing the contract”, in a way that allows the customer to “store and reproduce the contract”. That is the moment for negotiation, not the moment of discovery. A specification that asks for the draft contract at tender stage, before award, is simply exercising a right the Regulation already grants.

A specific list, not a formula

Point (e) allows no vagueness: it requires “an exhaustive specification of all categories of data and digital assets that can be ported during the switching process, including, at a minimum, all exportable data”. An attachment that reads “the customer’s data” does not satisfy point (e): the rule requires listed categories, not a label — the difference between a contract checkable on acceptance and one discovered incomplete on migration day, when Article 25’s clock leaves no time to renegotiate.

The exemption that must be named, not invoked

The counterweight sits in point (f), and it is the clause the whole game turns on. The provider may exclude from exportable data the categories tied to its own internal functioning — not the customer’s data, the internal logic of the service — “where a risk of breach of trade secrets of the provider exists”. But the condition that follows is strict: those categories must be set out with “an exhaustive specification”, and the text requires that “such exemptions do not impede or delay the switching process”. An exemption not listed at signing is not a valid exemption; an exemption that slows the migration is even less so. Protecting the provider’s trade secrets is legitimate, and the Regulation says so explicitly: the point is not to deny it, it is to insist that it be named when the contract is signed, not invoked on the way out.

The rest of the clause, briefly

Article 25 adds three further elements worth checking. Point (c) provides that the contract is considered terminated — with the customer notified — once switching is successfully completed, or at the end of the notice period if the customer chooses to erase its data rather than migrate. Point (h) requires full erasure of the exportable data and digital assets generated by the customer, or relating to the customer directly, once the point (g) retrieval period has expired. Point (i) points to the switching charges in Article 29, on their own timetable, quantified before signing — not discovered on the way out.

The other side: who it applies to

These obligations apply to “data processing services” as Article 2(8) defines them: “a digital service that is provided to a customer and that enables ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature”, delivered “with minimal management effort”. It is a functional definition, not a list of brand names: it covers cloud proper and distributed set-ups. It does not automatically cover everything a data centre invoices for. A pure colocation contract — space, power, cooling, without the pool of configurable resources the definition requires — or a plain fibre-connectivity supply do not necessarily fall under Article 25: they have to be read for what they describe, not for the commercial label they carry. Anyone writing a specification should check this service by service, not infer it from the provider’s name.

What to put in the specification

  1. The three windows — notice of up to two months (point d), a mandatory transitional period of up to 30 days (point a), data retrieval of at least 30 days (point g) — declared in writing and added together, not left implicit.
  2. The specific list of portable data categories and digital assets, as a contractual attachment under point (e), not a generic formula.
  3. The point (f) exemptions named one by one at signing, with the clause barring any effect of impeding or delaying — not discovered on the way out.
  4. Switching costs quantified before signing, as Article 29(4) requires: standard fees, early-termination penalties, reduced switching charges.
  5. The functional equivalence of Article 30, with a list of what the source provider must hand over on switching: capabilities, information, documentation, technical support, tools.

How to check it

The exit test is requested at tender or renewal stage, not at notice of termination: ask the provider for a documented simulation of the three windows for the specific service you are buying, and the list of categories exempted under point (f), with the reasoning for the trade-secret risk. If the provider cannot answer these two questions, the Article 25 clause is not in the contract: it is a gap that surfaces once it is too late to negotiate it.

The point.

The three windows, the list of categories and the point (f) exemptions do not remain a matter of opinion: they become clauses written into the specification and an exit test carried out on acceptance, with the documented simulation produced as evidence — the same work we bring to compliance specifications. And for a data centre, the logic does not stop at a single cloud provider’s contract: the inventory of what runs on which contract, with what exit window, together with traces, measurements and as-built records of the network connecting them, stops being a scattered file and becomes a single map of the site, on which an AI flags when a critical service rests on a contract whose exit window exceeds the time the organisation can afford — together with CSIDIA, the group’s other company. The set-up is multi-model: on autonomous on-premise machines that require no deep integration into the network, or on dedicated cloud with a data centre in Italy, with shared management, our own teams, no subcontracting. The value lies in the map of the network, not in the model that reads it.

Does your cloud provider’s contract declare the three Article 25 windows, or do you need to write them into your next specification? Talk to an engineer: the site visit is free, and the switching simulation should be requested today, not at the moment you actually need it.

Sources