B2B IoT / connected-product brand without EU Data Act DSR endpoint or contact
The EU Data Act gives customers of connected products, such as B2B Internet of Things (IoT) devices, a right to request access to and portability of the data those products generate. This check looks for a dedicated mechanism for these requests, either a /.well-known/data-rights page or a clearly visible contact, within one click of the site's footer. On this site, the business appears to sell a connected product, but no such endpoint or contact was found.
Why this matters
The EU Data Act began to apply from 12 September 2025 and has staged provisions through 2026 and beyond. It gives users of connected products rights to access and share the data those products generate, and obligations fall on manufacturers and data holders. Whether it applies to you depends on whether you make or sell connected products in the EU, so check with a legal adviser. It is a newer, less well-known obligation, so it is easy to overlook.
How to fix it
Your privacy lawyer and developer should publish a /.well-known/data-rights page or add a clearly visible 'Request your data' link in the site footer, along with a dedicated contact address such as data-rights@yourdomain.com and a stated response timeframe, commonly 30 days. Document the internal process for handling these requests once they arrive. Budget around a day to set this up properly.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit