# EU Data Act, Article 36

> EU Data Act, Article 36 (European Commission): Smart contract requirements · Regulation (EU) 2023/2854. Region: Europe. Privacy with disclosure: Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Regulator or standard-setter
- Region: Europe
- Subject: Smart contract requirements · Regulation (EU) 2023/2854
- Authority: European Commission
- Stance on on-chain confidentiality: Privacy with disclosure. Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.
- Tags: Data Act, safe termination, kill switch, status pending
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/reg-eu-data-act

## What it actually says

A useful case of a rule written for one context landing awkwardly on another. Article 36 sets essential requirements for smart contracts used to execute data-sharing agreements, including robustness, access control and, the contested one, safe termination and interruption. Read broadly, a mandatory kill switch cannot coexist with an immutable, non-upgradeable contract. Read as drafted, it addresses enterprise data-sharing rather than permissionless DeFi, and its extension to public-chain contracts was disputed from the start. It has applied since 12 September 2025. The Commission's Digital Omnibus proposal of November 2025 would delete Article 36 outright on legal-certainty grounds, which is a fair signal of how well the drafting landed, but that proposal is still in procedure.

## The instruments that matter

- **Article 36**: essential requirements for smart contracts used in data-sharing agreements, namely robustness, access control, safe termination and interruption, archiving, continuity
- **Applicable since 12 September 2025**
- **Digital Omnibus (November 2025)**: would delete Article 36 entirely without replacement, on legal-certainty grounds; still in procedure, so treat Article 36 as in force

## Sources

- [Regulation (EU) 2023/2854](https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng)
- [Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained)

## Related entries

- [CJEU on identifiability](https://www.sodalabs.xyz/privacy-hub/regulation/reg-cjeu-identifiability): Case law · is a wallet address personal data
- [EDPB blockchain guidelines](https://www.sodalabs.xyz/privacy-hub/regulation/reg-edpb-blockchain): Data protection guidance · Guidelines 02/2025
- [MiCA](https://www.sodalabs.xyz/privacy-hub/regulation/reg-mica): Market licensing · Regulation (EU) 2023/1114
- [Digital euro](https://www.sodalabs.xyz/privacy-hub/regulation/reg-digital-euro): Central bank digital currency · COM(2023) 369
- [eIDAS 2 and the EU Digital Identity Wallet](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eidas2): Digital identity · Regulation (EU) 2024/1183
- [EU AMLR Article 79](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eu-amlr): Anti-money laundering · Regulation (EU) 2024/1624