Data portability and provider switching

Data Act classification is a launch prerequisite

The Data Act has applied since 12 September 2025. Its rules on switching between data processing services may also cover software as a service if the specific offering meets the statutory criteria. Whether and to what extent individual Kasp products fall within scope must be documented based on the functions, infrastructure, contracts and customer roles actually offered.

Kasp therefore does not present this classification as complete. A general JSON download, a privacy policy or this information page alone demonstrates neither complete provider switching nor fulfilment of Articles 23 to 30 of the Data Act.

The German Data Act Application and Enforcement Act (DADG) has applied since 30 May 2026. In particular, it designates the Federal Network Agency as the central enforcement authority and the BfDI as the competent data protection supervisory authority for the personal-data aspect at non-public bodies. The outstanding Kasp evidence is therefore not merely observation of a future legislative process.

GDPR data portability and Data Act switching are not the same

Subject to its conditions, Article 20 GDPR concerns personal data provided by a data subject and requires a structured, commonly used and machine-readable format. This right can be asserted through Exercise data subject rights . Identity, entitlement, the rights of others and the applicable statutory scope are checked before disclosure.

By contrast, the Data Act's switching rules address customers of a data processing service within scope. They may require contractual, technical and organisational support for switching to another provider or to the customer's own infrastructure. The precise scope depends on the service's classification and statutory exceptions.

The account download is deliberately limited

Account settings offer a versioned JSON export of the expressly identified, directly readable account categories. This download is not a complete Data Act switching export. In particular, organisation, Orbit and Command data, and private audit data, must not be disclosed through unchecked raw queries.

Until approval, these areas lack a paginated server-side projection binding the tenant, requester, roles, third-party rights, secrets, deletion states and data snapshot. A broader export can be requested through the data rights request channel; acknowledgement of receipt does not yet confirm a particular export scope or completion date.

What must be reliably established before approval

Where the switching rules apply, before contract conclusion the contract must regulate, among other things, the switching process, a notice period generally no longer than two months, a transition period generally no longer than 30 calendar days, support and business continuity, a retrieval period of at least 30 calendar days, and subsequent complete erasure. Statutory extensions and exceptions must be transparently justified.

Exportable data and digital assets, excluded internal categories, data structures, formats and interfaces must also be documented. Information on the jurisdiction of the infrastructure used and safeguards against incompatible government access to non-personal EU data belongs in the published and contractual information.

Until 12 January 2027, switching charges may be imposed only to the legally permitted extent of direct switching costs; after that, the Data Act generally provides for no switching charges. Kasp may present a price or fee waiver as a product commitment only when the rate card, checkout, contract and billing enforce the same position.

No general-availability approval without this evidence

• the legal and technical classification of Kasp as a data processing service for each offered product and customer model
• an exhaustive inventory of all exportable data and digital assets, with narrowly justified exceptions
• a paginated server projection for Orbit, organisation and Command data, bound to the tenant and requester
• documented formats, data structures, interfaces, transition support, retrieval periods and erasure steps
• contractual information on the notice period, transition period, infrastructure location, protection against third-country access and switching charges

These are product, contractual and operational records. They cannot be replaced by a general compliance statement. Questions can be addressed to kontakt@kasp.ai .

Official sources

• Regulation (EU) 2023/2854 (Data Act), in particular Articles 23 to 30.
• European Commission: Data Act explained.
• German Data Act Application and Enforcement Act (DADG), in particular sections 2 and 3.
• General Data Protection Regulation, in particular Article 20.

This product-specific transparency information is neither individual legal advice nor an official classification by an authority.