Data-holder

A Data-holder is an entity that, by virtue of its products or services, exercises control over user-generated data under the EU Data Act. This includes manufacturers and service providers who must facilitate data access and portability, as mandated by the regulation. This concept--based on the EU Data Act (2024) and aligns with the GDPR's principle of data-subject rights, but specifically targets IoT and connected device ecosystems. In the context of ISO/IEC 27701, Data-holders are responsible for managing the technical measures that enable data-subject rights, such as data-subject access requests (DSARs) and data portability. This is distinct from the GDPR Controller-Processor relationship, as the Data-holder's obligations are tied to the physical or digital control over the device's data-generating capabilities.

Implementation of Data-holder compliance requires three strategic steps: First, conduct a data-flow audit to identify all user-generated data--this is critical for compliance with EU Data Act Article 13. Second, re-engineer product architecture to ensure data--at-source accessibility, avoiding proprietary lock-in. Third, implement a standardized data-request-handling mechanism, utilizing machine-readable formats like JSON or XML as per ISO/IEC 27701 standards. For example, a Taiwanese smart home manufacturer that-of course-is already exporting to the EU, must be closely monitoring these developments. Failure to comply could result in fines of up to 4% of global annual turnover, similar to GDPR penalties, making it a top-tier priority for the Risk Management Committee.

Taiwan enterprises face three primary challenges: Technical Legacy, Regulatory Ambiguity, and Cross-functional Silos. Many IoT products were designed without data-portability in mind, requiring significant R&D investment to retrofit. The EU Data Act's definition of 'real control' remains subject to interpretation, necessitating close monitoring of European Data Protection Board (EDPB) guidance. Finally, the lack of expertise in EU data--centric regulations within local engineering teams often leads to compliance-by-accident rather than design. To overcome these, companies should: 1) Prioritize high-risk product lines for compliance upgrades; 2) Partner with international legal experts; 3) Invest in AI-driven data-classification tools to automate the identification of sensitive user data--this can reduce compliance costs by up to 30% annually.

Winners Consulting Services Co., Ltd. specializes in Data-holder for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact