Locked In? How The EU Data Act’s Cloud Switching Rights Are Reshaping FinTech Infrastructure

The European cloud market is undergoing a fundamental shift. Regulation (EU) 2023/2854 – better known as the Data Act – introduces a sweeping new framework for switching between cloud and data processing services, designed to break down vendor lock-in effects and promote genuine cloud portability across the EU. For FinTech companies, these provisions carry a double significance: not only must cloud-using FinTechs understand and prepare for the Data Act’s switching rights, but many will also have to consider these new rights in light of their obligations as financial entities under the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554), which has applied since 17 January 2025.

Chapter VI of the Data Act (Articles 23-31) targets providers of “data processing services”: a category broad enough to capture cloud infrastructure, platform, and Software-as-a-Service providers. The Data Act applies to any such provider, irrespective of its place of establishment, as long as it provides data processing services to customers in the EU. A FinTech company may itself be considered a provider if it supplies data processing services to others, such as to a banking client. The Act’s objective is clear: customers must be able to switch to another provider, withdraw to on-premises infrastructure, or operate in a multi-cloud environment without being held back by commercial, technical, or contractual barriers.

The Data Act expressly recognises the relevance of multi-cloud approaches for digital operational resilience in the financial sector, with direct reference to DORA’s own framework. For FinTechs providing cloud services to regulated financial entities, or themselves falling within DORA’s scope, this intersection creates compliance requirements that deserve careful attention.

Requirements on Cloud Switching – and How DORA Amplifies Them

Under the Data Act, cloud service providers must take concrete measures to enable cloud switching. These include removing pre-commercial, commercial, technical, contractual, and organisational obstacles to such switching. Contracts must grant customers the right to switch providers, to terminate the agreement subject to a maximum notice period, and to migrate all exportable data and digital assets with reasonable provider assistance. Providers must also offer open interfaces free of charge to facilitate switching, data portability, and interoperability. For infrastructure services (IaaS) specifically, providers must take reasonable measures to ensure that customers can achieve comparable functionality (so-called functional equivalence) when migrating to another provider.

For FinTechs and financial institutions subject to DORA, the cloud switching rights under the Data Act are not merely welcome but structurally necessary. DORA requires financial entities to manage information and communication technology (ICT) risk comprehensively, including by maintaining workable exit strategies for third-party arrangements supporting critical or important functions. Article 28 of DORA requires financial entities to adopt a strategy on ICT third-party risk that includes a multi-vendor approach where applicable, and Article 30 requires detailed key contractual provisions on service descriptions, audit rights, data access, security, and exit strategies.

In practice, the Data Act gives financial entities statutory rights they can deploy to make DORA’s exit strategy requirements enforceable. Where DORA obliges the financial entity to plan for provider exits without business disruption, the Data Act obliges the cloud provider to cooperate by removing barriers, exporting data, and eliminating switching charges. The two regulations operate in parallel: DORA governs the financial entity’s internal governance, outsourcing oversight, and resilience testing, while the Data Act serves as a horizontal regime that strengthens the customer’s negotiation position against the provider.

Timelines and Regulatory Developments

The Data Act entered into force on 11 January 2024 and has applied generally since 12 September 2025. The cloud switching rights under Chapter VI therefore already apply.

However, a couple of important timing aspects lie ahead. First, the current possibility for providers to impose switching charges (although not exceeding the costs incurred by the provider that are directly linked to the switching process) will lapse after 12 January 2027. Second, providers must ensure compatibility with certain interoperability specifications and standards within 12 months after their publication. This latter requirement does not, however, apply to providers of infrastructure services (IaaS).

Separately, the European Commission has published draft non-binding Standard Contractual Clauses (SCCs) that translate Chapter VI’s provisions into ready-to-use contractual terms covering switching, exit, termination, security, and business continuity during the switching process.[1]

It is also worth noting that the EU Commission’s 2025 Digital Omnibus proposal suggests introducing lighter regulation in certain cases, provided the underlying contract was concluded before the general application of the Data Act on 12 September 2025. Lighter regulation is proposed for custom-made data processing services and for SMEs and SMCs providing data processing services. Notably, SMEs and SMCs would in such cases be permitted to include early-termination penalties in fixed-term contracts. This proposal remains under legislative consideration and is not yet settled law.

FinTechs To-Do List

• Audit existing cloud contracts against the Data Act’s Chapter VI. Review whether your agreements include explicit switching rights, maximum notice and transition periods, data export commitments, and open interface obligations.
• Verify cloud switching charge terms. Confirm that any charges set out in your contracts are limited to costs directly linked to the switching process, and note the 12 January 2027 deadline for the full prohibition of switching charges.
• Assess DORA alignment. If you are a DORA-regulated financial entity, or act as an ICT provider to such a financial entity, map your cloud exit strategies to both DORA’s Article 28 and 30 requirements and the switching rights in the Data Act’s Chapter VI. Ensure the ICT third-party risk policy covers multi-vendor strategies and comprehensive exit plans.
• Adopt the Commission’s draft Standard Contractual Clauses. Consider integrating the Commission’s SCCs for cloud switching into your procurement processes, particularly for new agreements or contract renewals.
• Watch the Digital Omnibus. Monitor the Commission’s proposal for a potential simplification of the regulatory framework.
• Consider your timing for cloud switching. During the transitional period, providers may charge reduced fees but remain incentivised to support the process. After 12 January 2027, switching charges will be prohibited, which will reduce costs but could potentially affect provider support.

[1] https://digital-strategy.ec.europa.eu/en/library/draft-recommendation-non-binding-model-contractual-terms-data-access-and-use-and-non-binding