An Indian or Malaysian cloud provider is revising its European customer terms. The agreement charges for data export, limits migration assistance and treats embeddings, configuration and audit logs as provider assets. A customer wants to move its workload or use a second provider.
Licentium’s EU Data Act cloud switching review identifies which services and terms require changes. The engagement produces a scope assessment, switching addendum, export and deletion specification, and revised charging communications. It supports providers correcting their terms and customers negotiating an exit.
Chapter VI has applied since 12 September 2025. For services subject to Article 29, switching charges are prohibited from 12 January 2027. Existing agreements need assessment now, including the exceptions and payment categories that affect that result. (Regulation (EU) 2023/2854, the Data Act, arts 29, 31, 50.)
Who the review is for
Providers can commission the review when renewing EU contracts, revising standard terms or responding to a migration request. Customers can use it before accepting an exit offer, giving notice or adding another provider.
Coverage depends on the actual service. The statutory definition requires ubiquitous, on-demand network access to shared, configurable, scalable and elastic computing resources, capable of rapid provisioning and release with minimal management effort or provider interaction. A SaaS or AI API label alone does not establish coverage. Covered providers serving EU customers fall within scope regardless of establishment. (Data Act, arts 1(3)(f), 2(8).)
The initial assessment identifies the contracting entities, service types, upstream dependencies and any required EU legal representative. A provider without an EU establishment must designate that representative; a contract review does not itself make the appointment. (Data Act, art 37(11)–(13).)
What the engagement produces
Service scope and contract gap assessment
The assessment maps each relevant service against the statutory definition and any bespoke or testing exception. It identifies the affected agreement, order forms, data terms, service levels and incorporated policies.
The gap record connects each required change to its legal basis, responsible team and missing evidence. It distinguishes statutory obligations from additional protections requested by either party. For existing terms, the work also identifies the amendment process and customer communications required.
The AI cloud exit guide explains the underlying export, timing and continuity rules.
Switching and exit addendum with responsibility schedule
The addendum defines the affected services, notice route, assistance, transition, retrieval, termination and deletion. The ordinary notice ceiling is two months. Switching must follow without undue delay, ordinarily within 30 calendar days after the notice period ends. Retrieval must remain available for at least 30 calendar days after the transition ends. (Data Act, art 25(2)(a), (d), (g).)
Technical infeasibility requires a justified provider notice within 14 working days of the switching request. The alternative transition cannot exceed seven months. The customer separately has a right to extend the transition once for a period appropriate to its purposes. (Data Act, art 25(4)–(5).)
The schedule assigns export, import, testing, security, incident escalation and cutover decisions to named roles. It preserves reasonable assistance, continued contracted functions during transition, information about known continuity risks and cooperation between participants. Additional operational commitments requiring the destination provider’s performance need that provider’s agreement. (Data Act, arts 24, 25(2)(a)–(b), 27.)
Data export and deletion specification
The specification examines customer content, outputs, embeddings, configuration, audit logs and relevant metadata separately. It records each category’s format, location, rights, export method and implementation owner. Customer materials mixed with protected information need an identified separation method.
Exportable data and digital assets have different statutory definitions. For digital assets, the customer must have a right of use independent of the source-service contract. Provider or third-party intellectual property and trade secrets can limit disclosure. A blanket ownership label cannot replace the required category-by-category assessment and contractual specifications. Internal trade-secret exclusions must not impede or delay switching. (Data Act, arts 2(32), 2(38), 25(2)(e)–(f), 30(6).)
The deletion schedule coordinates retrieval, successful-switch confirmation, backup expiry, access revocation and evidence of deletion. It specifies erasure after retrieval expires, or a later agreed date, once switching has succeeded. Any retained category needs a specific legal basis and retention period. For personal data processed on the customer’s behalf, the controller chooses return or deletion. The GDPR processor exception concerns storage required by Union or Member State law. (Data Act, arts 1(5), 25(2)(g)–(h); Regulation (EU) 2016/679, art 28(3)(g).)
Charging, renewal and transition communications
The charging review separates statutory switching work, ordinary service fees, early-termination amounts and optional extra services. Before 12 January 2027, Article 29 permits switching charges only up to directly incurred switching costs. From that date, covered switching charges, including relevant data egress, must cease. Qualifying bespoke services have a specific exception. (Data Act, arts 2(35)–(36), 29(1)–(4), 31(1).)
Ordinary service fees continue while the relevant service contract applies. Early-termination amounts need assessment under the actual agreement and applicable law; their separate classification does not validate every charge. Extra services beyond statutory switching duties can be priced where the customer requests them and agrees the price in advance. Renaming mandatory assistance does not make it optional. (Data Act, arts 23, 25(2)(c), 29; recital 89.)
The outputs include revised fee descriptions, renewal wording and transition notices. Billing and customer-facing teams receive the agreed categories, effective date and explanation of any remaining payments.
How the work proceeds
The engagement starts with service classification and the customer’s intended route: replacement, return to its own infrastructure or ongoing parallel use. Legal and technical teams then map the export inventory and upstream restrictions before the contract package is drafted.
The final handover identifies amendments, implementation tasks and unresolved dependencies. Provider teams confirm export capability and support capacity. The customer appoints an exit owner and arranges destination readiness. Technical teams perform the agreed export and migration tests; those results inform acceptance and any further contractual changes.
Technical and cross-border boundaries
Infrastructure services within Article 30(1) carry an obligation to take all reasonable measures within the provider’s power to assist functional equivalence. Covered software and platform services have duties concerning free open interfaces and applicable standards or export formats. The review identifies the relevant service category and the conditions governing those requirements. It does not treat AI SaaS migration as a statutory promise of identical model outputs. (Data Act, arts 2(37), 24, 30(1)–(6).)
EU personal-data transfers require their own lawful route, including relevant overseas support access. A foreign retention requirement needs a specific conflict assessment; it cannot simply be inserted as an unlimited exception to deletion. (GDPR, arts 28(3)(g), 44–46.)
Indian providers within the directions of India’s Computer Emergency Response Team (CERT-In) need to distinguish required information and communication technology logs and subscriber records from material scheduled for deletion. Where Malaysia’s Personal Data Protection Act applies, the controller’s outward personal-data transfers need a section 129 basis. The export and deletion specification must reflect the applicable duties. (CERT-In Directions, 28 April 2022, paras (iv)–(v); Malaysia Personal Data Protection Act 2010, ss 2–3, 10, 129.)
Choosing Indian or Malaysian law does not remove a covered EU-facing service from the Data Act. Contract remedies and dispute procedures still need assessment under the applicable law and forum. (Data Act, art 1(3)(f).)
For non-personal data held in the EU, the Data Act separately addresses conflicting foreign governmental access and related transparency. It does not impose a general ban on every overseas commercial transfer. The agreement should identify processing jurisdictions and the applicable disclosure procedures. (Data Act, arts 28, 32.)
Where the customer is an EU financial entity within the Digital Operational Resilience Act (DORA), its classification and exit duties need coordination with the contract package. Critical or important functions require the additional transition and exit provisions. The DORA contract review covers that wider supplier-contract scope. (Regulation (EU) 2022/2554, arts 28(8), 30(2)(d), 30(3)(f).)
Supplier-failure recovery requires a separate assessment of available technology, licences and insolvency constraints. The software escrow analysis addresses that distinct continuity problem.
Information needed to scope the work
Provide:
- The provider and customer entities, EU Member States, proposed governing law and dispute forum.
- The agreement, order forms, renewal dates, notice provisions and incorporated online terms.
- The service description, architecture, cloud and model dependencies, and any bespoke-development or testing arrangements.
- The data and digital-asset inventory, licences, export documentation, sample files and retention schedule.
- The fee schedule, proposed exit charges, destination plan, required continuity and any financial-sector classification.
Technical migration, software development, performance certification, disputes and statutory representation require separately agreed arrangements. The core engagement concerns legal assessment and the documents needed to implement the agreed switching route.
Frequently asked questions
Does the review cover contracts signed before September 2025?
Yes. Chapter VI has applied since 12 September 2025 without a general exemption for earlier contracts. Article 50’s separate contract-age rules concern Chapter IV on unfair data terms. (Data Act, art 50.)
Does customisation exempt a SaaS service?
Only the statutory test can establish the bespoke regime. Most main features must be custom-built for one customer, or all components developed for that customer, and the service must not be offered broadly through the provider’s catalogue. The exception removes specified duties, including Article 29, while other switching obligations remain. Limited-period, non-production testing and evaluation has a separate Chapter VI exclusion. Providers must disclose the applicable exclusions before contracting. (Data Act, art 31.)
Must the provider export every embedding and audit log?
Classification depends on how the material arose, the applicable rights and any protected content. The review identifies what must be exported, what requires additional permission and what can lawfully be withheld. It does not presume that either party’s ownership label answers every category. (Data Act, arts 2(32), 2(38), 25(2)(e)–(f), 30(6).)
Will a January 2027 exit produce a zero bill?
The prohibition concerns covered switching charges. Ordinary service fees, properly assessed early-termination amounts and agreed extra services require separate treatment. The engagement checks each charge’s substance and legal basis. (Data Act, arts 2(36), 29, 31(1); recital 89.)
Can the customer keep using both providers?
The Data Act also addresses ongoing parallel use. In that setting, providers may pass through incurred egress costs, without exceeding them. The agreement should distinguish ongoing parallel use from temporary overlap within a switching process. (Data Act, art 34(1)–(2).)
Review your EU cloud switching terms
Contact Licentium with the service description, countries involved, agreement and intended switching or renewal date. The consultation can define which terms, export categories and charging changes the engagement needs to address.