The renewal letter changed last September: since 12 September 2025, Reg (EU) 2023/2854 Chapter VI obliges providers of data processing services — SaaS included, per Art. 2(8) and recital 81 — to put the exit in the written contract, export your data in a machine-readable format on request, and cap switching charges until they go to zero on 12 January 2027. Read as a buyer, lock-in turns into a set of clause numbers you can put in a renewal email.
The renewal quote lands the way it always does: a PDF, a new number, a signature deadline. The price moved. You have two realistic options: sign, or leave. Leaving means a data export that nobody on your side has scoped, priced, or rehearsed. So you sign.
Since 12 September 2025, the contract attached to that quote is regulated territory. Regulation (EU) 2023/2854, the Data Act, entered into force on 11 January 2024 and applies since 12 September 2025 (Art. 50 in the text, confirmed on the Commission's policy page). Its Chapter VI is titled "Switching between data processing services", and it writes your exit into the provider's obligations, clause by clause. I think most buyers still don't know these clause numbers exist. Let's read them.
Your SaaS subscription is a "data processing service"
Chapter VI attaches to "data processing services", and Art. 2(8) defines the term in full:
"'data processing service' means a digital service that is provided to a customer and that enables ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature that can be rapidly provisioned and released with minimal management effort or service provider interaction;"
That reads like a description of cloud infrastructure, and a fair question is whether your compliance tool, your CRM, or your ticketing system meets it. The regulation answers the delivery-model question itself, in recital 81: "data processing services fall into one or more of the following three data processing service delivery models, namely Infrastructure as a Service (IaaS), Platform as a service (PaaS) and Software as a Service (SaaS)." SaaS is named. The recital settles the category; whether one specific product meets the Art. 2(8) definition is a facts-of-the-service question, and if the answer matters to your renewal, it's one for counsel.
Art. 1(3)(f) applies the regulation to "providers of data processing services, irrespective of their place of establishment, providing such services to customers in the Union". Where the provider sits doesn't matter; where the customer sits does. Hold that thought for the honest edges below.
Four defined terms the chapter keeps using, pinned down before we quote it:
- Switching (Art. 2(34)): the process of changing from one data processing service to another of the same service type, or to an on-premises ICT infrastructure, "including through extracting, transforming and uploading the data".
- Exportable data (Art. 2(38)): "the input and output data, including metadata, directly or indirectly generated, or cogenerated, by the customer's use of the data processing service", excluding assets or data protected by intellectual property rights or constituting a trade secret of the provider or third parties. That exclusion gets its own section below.
- Digital assets (Art. 2(32)): elements in digital form, including applications, which the customer has the right to use independently of the contract it intends to switch away from.
- Switching charges (Art. 2(36)): charges "other than standard service fees or early termination penalties" imposed for the switching actions the regulation mandates, "including data egress charges".
What you can ask for at renewal, by clause number
Art. 23 sets the tone: providers "shall not impose and shall remove pre-commercial, commercial, technical, contractual and organisational obstacles" that inhibit customers from switching to another provider of the same service type, porting to on-premises infrastructure, or using several providers at once. Point (c) covers porting exportable data and digital assets "including after having benefited from a free-tier offering".
Then the contract itself. Art. 25(1) requires that the switching rights and obligations "be clearly set out in a written contract", made available "prior to signing the contract in a way that allows the customer to store and reproduce the contract". Before you sign anything, you can ask to see the switching terms as a document. And Art. 25(2) lists what that contract must contain at a minimum:
- A notice cap. "a maximum notice period for initiation of the switching process, which shall not exceed two months" (25(2)(d)). A full-text search of the regulation finds no other occurrence of "two months": this cap is the only one.
- A transition deadline. The switch happens "without undue delay and in any event not after the mandatory maximum transitional period of 30 calendar days" following that notice period (25(2)(a)). There is a valve: where 30 days is technically unfeasible, Art. 25(4) lets the provider notify you within 14 working days, justify the unfeasibility, and set an alternative period of up to seven months, with service continuity ensured throughout. The honest reading is "30 days by default, up to seven months with written justification", never "30 days, period".
- A data inventory. "an exhaustive specification of all categories of data and digital assets that can be ported during the switching process, including, at a minimum, all exportable data" (25(2)(e)). This is the clause that tells you, in writing and in advance, what an exit actually yields.
- A retrieval window. "a minimum period for data retrieval of at least 30 calendar days" after the transitional period ends (25(2)(g)).
Outside the contract, Art. 26(b) obliges the provider to point you to "an up-to-date online register … with details of all the data structures and data formats as well as the relevant standards and open interoperability specifications" in which the exportable data are available. You can ask for that register's URL today, mid-term, without announcing any intention to leave.
On the technical side, Art. 30(2) requires providers to make open interfaces "available to an equal extent to all their customers and the concerned destination providers … free of charge to facilitate the switching process". And Art. 30(5) carries the export obligation: where common specifications or harmonized standards for interoperability have not been published in the central Union standards repository for the service type, the provider "shall, at the request of the customer, export all exportable data in a structured, commonly used and machine-readable format". Keep both qualifiers in view: the duty is the fallback where no published standards exist for the service type, and it triggers at your request. You have to ask.
What switching may cost you — until January 2027, then nothing
The charge regime has a countdown printed in the text. Art. 29(2): "From 11 January 2024 to 12 January 2027, providers of data processing services may impose reduced switching charges on the customer for the switching process." Art. 29(3) caps them: the reduced charges "shall not exceed the costs incurred by the provider of data processing services that are directly linked to the switching process concerned". And Art. 29(1): "From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process."
Read 29(1) together with the Art. 2(36) definition, because the zero is narrower than it sounds. Switching charges are, by definition, charges "other than standard service fees or early termination penalties". What dies in January 2027 is the switching-specific line item, data egress charges included. Early termination penalties and ordinary service fees are untouched by it; if your contract carries a termination penalty, that penalty survives the date. What the provider does owe you on that front is disclosure: Art. 29(4) requires "clear information on the standard service fees and early termination penalties that might be imposed, as well as on the reduced switching charges" before you enter the contract, and Art. 29(6) requires that information to be publicly available.
One date worth disambiguating, since Art. 50 carries two: 12 September 2026 is the deferred application date for connected-product obligations under Art. 3(1). It has nothing to do with Chapter VI. The switching regime has applied since 12 September 2025.
The Commission's own explainer says the Data Act "will make switching free, fast and fluid". The article text is narrower and dated, which is what makes it useful at renewal: a quoted switching fee is now a number you can interrogate against 29(3)'s directly-linked-costs cap, and a number with a printed expiration date.
Honest edges: what the Act does not give you
Territory. Art. 1(3)(f) hangs on "customers in the Union". If your contracting entity is established in the Union, the chapter reaches your provider wherever it sits. A Swiss-only customer of a Swiss-only vendor sits outside that sentence, without an enforceable right. What remains is the norm-setting effect: a provider serving EU customers builds the switching terms, register, and export anyway, and a separate, worse contract for non-EU customers is its own cost to maintain. That mechanism is observable, and it is weaker than law.
The trade-secret carve-out. This is the paragraph I'd spend the most time on as a buyer. Exportable data excludes, by definition, "any assets or data protected by intellectual property rights, or constituting a trade secret, of providers of data processing services or third parties" (Art. 2(38)). Art. 25(2)(f) lets the contract exempt data categories "specific to the internal functioning of the provider's data processing service" where a trade-secret breach risk exists, "provided that such exemptions do not impede or delay the switching process", and Art. 30(6) confirms providers need not "disclose or transfer digital assets that are protected by intellectual property rights or that constitute a trade secret". For a GRC-tool buyer: your evidence history (input and output data, metadata included) sits inside exportable data and should travel. The vendor's proprietary control library, mappings, and templates are exactly what Art. 2(38) leaves behind. So the question to scope at renewal is which of the two your audit history depends on. If your evidence is stored as references into the vendor's proprietary control structure, the export may hand you the references without the structure they point at.
Custom-built services. Art. 31(1) disapplies "Article 23, point (d), Article 29 and Article 30(1) and (3)" for services where "the majority of main features has been custom-built to accommodate the specific needs of an individual customer" and the service is "not offered at broad commercial scale". Art. 29 is on that list: a genuinely custom-built service escapes the charge regime, 2027 zero included. Arts. 25, 26 and 30(2) and (5) are not, so even a custom-built service owes you the written switching terms, the register, and the export. And Art. 31(3) obliges the provider to tell you, before the contract is concluded, which obligations of the chapter don't apply.
Functional equivalence is for infrastructure. Art. 30(1) imposes the duty to facilitate functional equivalence only on providers of services "limited to infrastructural elements such as servers, networks and the virtual resources necessary for operating the infrastructure" that "do not provide access to the operating services, software and applications". The acronym "IaaS" appears in none of the articles (its two occurrences in the text are in recitals 81 and 86), and recital 86's final sentence carries the label: "This Regulation does not constitute an obligation to facilitate functional equivalence for providers of data processing services other than those offering services of the IaaS delivery model." As a SaaS buyer, your rights are the interfaces and the export; a working replica of the service on the destination side is nowhere in the text.
Enforcement. Each Member State designates one or more competent authorities (Art. 37(1)), and Art. 38(1) gives natural and legal persons "the right to lodge a complaint, individually or, where relevant, collectively" with the relevant authority. Penalties are for Member States to lay down under Art. 40(1); the GDPR-scale fine amounts in Art. 40(4) attach to Chapters II, III, and V, and Chapter VI is not among them. A full-text search of the regulation finds zero hits for "damages". So calibrate: a negotiating position backed by a regulator complaint route, with no private damages claim in the chapter's text.
Three questions before you sign
Does the contract on the table contain the Art. 25(2) terms? The written switching terms are owed to you before signature (Art. 25(1)). Check the notice period against 25(2)(d)'s two-month cap, look for the 30-calendar-day transitional period from 25(2)(a) and the retrieval window from 25(2)(g). If they're absent, asking where they are is a reasonable renewal email: the clause numbers do the arguing for you.
Is your data actually inside the export? Ask for the 25(2)(e) exhaustive specification and the Art. 26(b) register URL, then read them against the trade-secret exemptions in 25(2)(f). The load-bearing check for a compliance tool: does your evidence history land in exportable data, or does it only exist as references into proprietary vendor content that Art. 2(38) excludes? Then exercise Art. 30(5) once, on a quiet date, as a rehearsal: the export duty runs at your request, and the first request shouldn't happen mid-termination. Once the export sits in front of you, the next question is what shape it's in: one maintained control set with framework mappings, or per-framework silos? I wrote about that trade-off in One control set: NIS2 Art. 21(2), SOC 2's CC-series, and CRA Annex I, read side by side.
What does the switch cost, on paper? If a switching fee is quoted, map it to Art. 29(3): which costs is it made of, and how are they "directly linked to the switching process concerned"? Ask what happens to that line item on 12 January 2027, and remember the boundary — termination penalties sit outside the Art. 2(36) definition and outlive the date. And if the provider describes the service as custom-built, ask for the Art. 31(3) statement of which chapter obligations don't apply; if Art. 29 is among them, the countdown doesn't run for you.
The renewal letter, reread
Back to the renewal letter. The quote hasn't changed; what changed last September is that the unscoped exit, the thing that made signing feel inevitable, is now contract content with clause numbers attached. Before you answer, pull the current contract and look for the Art. 25 terms. If they're in there, you have a scoped, dated, priced exit to weigh the renewal against. If they're missing, that's your first question back, and you get to ask it by number.
devguard keeps your evidence and control set in an exportable, framework-mapped form: devguard.ch.