How does the Data Act transform the relationship with a trust service provider?
Until the Data Act became applicable, the management of electronic archives and digital evidence relied primarily on contractual stipulations and market practice. Users now benefit from explicit rights that are directly enforceable against providers.
The Act applies to providers that hold and process data on behalf of their clients, in particular in the context of electronic archiving, timestamping or digital evidence management services. It strengthens, in particular, the following rights:
- A right of effective access to archives, metadata and digital evidence;
- A right to retrieve and share data with selected third parties;
- Protection against unjustified technical or contractual obstacles likely to restrict the exercise of these rights.
This legal framework clearly affirms that professional data entrusted to a provider remains under the control of its user, who must be able to use and dispose of it freely, under fair and transparent conditions.
Your practical rights: access, retrieval and data portability
Retrieve your data with ease
One of the central contributions of the Data Act lies in an effective right of retrieval. In practical terms, users may request, at any time and without having to justify their request, the return of all data entrusted to a provider: electronic archives, qualified timestamps, metadata and chains of evidence. The Act requires that such data be provided in a structured, commonly used and machine-readable format, enabling its use, preservation or transmission without excessive dependence on a specific technical environment.
Providers may charge for these operations only insofar as the fees are strictly limited to the actual technical costs incurred, and are transparent, proportionate and non-discriminatory, in accordance with Article 9 of the Data Act.
The Data Act introduces a transformative concept in the field of trust services: data portability. This principle, already established under the GDPR in relation to personal data, is now extended to professional data and digital evidence. Users may therefore retrieve their data in order to transfer it to another provider or to enable its reuse by third parties, without unjustified impediment.
This right is fundamental to safeguarding freedom of choice, preventing technological lock-in and ensuring business continuity. It applies equally to archives and to digital evidence required for the defence of rights or regulatory compliance. Whether you use our electronic archiving, qualified timestamping or digital evidence management services, you retain control over your digital assets.
Trade secrets and intellectual property: a balanced framework
The Data Act recognises that certain elements, such as proprietary algorithms or derived data, may fall within the scope of trade secrets and benefit from specific protection. However, that protection is not absolute: it must be proportionate, documented and justified so as not to undermine users’ rights. Any restriction must be proportionate, clearly justified and properly documented, and must not interfere with users’ fundamental rights over their own data.
This framework requires a clear distinction between data belonging to clients and elements relating to providers’ internal technologies, thereby ensuring transparency and legal certainty.
Anticipating and implementing the Data Act
For users, the Data Act provides a protective and structured framework. For trust service providers, it entails the formalisation of procedures governing access, export and traceability, together with clarification of the conditions under which rights may be exercised.
This regulation contributes to strengthening confidence in the digital evidence services ecosystem by reconciling data sovereignty, legal certainty and high technical standards.
Frequently asked questions
May I retrieve all my archives at any time, without providing justification?
Yes. The Data Act recognises a continuing right of access to and retrieval of professional data entrusted to a provider. This right may be exercised at any time, without any obligation to provide reasons, and covers in particular electronic archives, qualified timestamps, metadata and associated chains of evidence. The data must be returned in a structured, commonly used and machine-readable format, enabling its use or transmission to a third party.
In which formats must my data be provided?
The Act requires that data be returned in open or widely used formats that are documented and usable without excessive reliance on proprietary technology. The objective is to ensure effective reuse of the data, whether for internal retention, audit purposes, transmission to third parties or migration to another provider.
May retrieval or export of data be subject to a charge?
Yes. Article 9 of the Data Act recognises that certain operations relating to access, export or return of data may generate significant technical costs. It therefore permits such operations to be charged, provided that the fees are transparent, proportionate, non-discriminatory and strictly limited to the costs actually incurred. Any deterrent or unjustified flat-rate pricing would be contrary to the purpose of the legislation.
Yes. The Act requires the implementation of appropriate technical and organisational measures to prevent any unauthorised access, disclosure or unlawful use of data. These measures include, in particular, encryption, access traceability, strict authorisation controls and mechanisms for detecting unauthorised access.
May I transfer my data to another provider?
Yes. The Data Act guarantees the right to data portability in respect of professional data. You may retrieve your archives and evidential materials in order to transfer them to another provider or enable their reuse by a third party, without unjustified technical or contractual impediment.
This right is intended to prevent technological lock-in and to ensure business continuity.
Yes. Users retain full control over their data and may share it with third parties of their choice, including for legal, compliance or audit purposes.
Providers must facilitate such uses, subject to compliance with applicable security, traceability and data integrity requirements.
Conclusion: your data, your control, our commitment
The Data Act represents a significant development for professional users of trust services. It enshrines their rights, strengthens their control over their data and strictly frames the obligations imposed on providers.
At Evidency, this regulation constitutes a structuring milestone, aligned with our commitment to transparency, security and flexibility. Data belongs to its users, and every measure is implemented to ensure that they can use and dispose of it freely, securely and without constraint.
Disclaimer
The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.
The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Evidency. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.
