If you have a connected machine, management software or an app that collects data, the Data Act concerns you too. And in these weeks Brussels is deciding how far you can say "no" when a customer asks for that data and it contains your trade secret.
Venice, 1291: the secret moves the furnaces
Back to Venice, the late thirteenth century. The glassmakers' furnaces are a danger to a city built almost entirely of wood, and in 1291 the Great Council orders them moved to Murano. That is the official version: fire risk. Many historians add a second, less declared reason: keeping the masters and their knowledge in one place, under control. In the following years the glassmakers received remarkable privileges, but also limits on their movements; tradition speaks of harsh penalties for anyone who took the craft abroad. On that last point popular sources are surer than documents, so we mention it with caution (for a general overview, see Murano on Wikipedia).
Here is the lesson: for Venice the craft was an asset, and protecting it was a matter of state. Today the asset is data and the way you use it. You will say: but shouldn't data circulate? Yes, and that is exactly where the debate begins.
What the Data Act says today
Regulation (EU) 2023/2854 entered into force on 11 January 2024 and has applied since 12 September 2025. In short: whoever holds data generated by connected products and related services must make it available to the user, and to third parties the user designates, on fair terms.
Trade secrets stay protected: the data holder can agree confidentiality measures and, according to Agenda Digitale's account, can refuse access only by proving serious and irreparable economic harm (Article 4(8)).
What is being discussed now
On 19 November 2025, within the Digital Omnibus package, the Commission proposed a new ground for refusal: when there is a risk that the secret ends up with entities in countries with weaker protection, or with European companies controlled by them. According to Agenda Digitale, the Council of the EU approved its negotiating mandate on 21 October 2026, with three changes to the initial text:
- the threshold drops from "high risk" to "significant risk";
- no notification to the authority for each refusal, but a quarterly report;
- instead of a list of excluded entities, Commission guidelines.
Note: this is a negotiating position. The European Parliament has not yet closed its own, and the final text may change. Always check the published version before deciding.
What it means for an SME
| If you are... | What concerns you |
|---|---|
| A data holder (manufacturer, software provider) | You may gain one more tool to protect know-how, but you will have to assess and document each refusal |
| A user of connected products | The supplier might deny you data if your group has non-EU control |
| Neither | No immediate obligation, but you should know where your data is |
The thread with the AI Act and the GDPR is the same: different rules, but all ask you to know what data you have.
What to do on Monday morning
- List the data that is truly a trade secret (price lists, recipes, algorithms, machine parameters) and where it sits.
- Reread contracts with suppliers and customers: who can access the data of connected products, and under which confidentiality clauses?
- Ask your legal advisor whether you are a data holder or a user under the Data Act, and note the date of the next update of the text.
The glassmakers of Murano knew what they were defending. Do you? If you want a simple method to find out, look at our services and book a free introductory call.
