EU regulatory changes and digital transformation: a comprehensive overview
22 August 2025
The European Union continues to actively shape the digital single market by implementing a comprehensive legal framework that covers various aspects of the digital economy. In recent years, EL has adopted several important pieces of legislation aimed at regulating digital services, protecting data, ensuring cybersecurity, and creating a level playing field for all market participants.
This overview examines three major regulatory changes that have a significant impact on businesses operating in the European Union’s digital space: the Digital Fairness Act (Digitaalse õigluse seadus), EU Data Act (ELi andmeseadus), and the NIS 2 Directive (Võrgu- ja infosüsteemide turvalisuse direktiiv). These acts are important elements of the EU strategy to create a secure, fair, and competitive digital ecosystem.
Understanding these regulatory changes is crucial for businesses operating in the EU or serving European customers, as failure to comply with the new requirements may result in significant fines and reputational risk. At the same time, these changes create new opportunities for innovation, competition, and the protection of consumer rights.
Digital Fairness Act
Background and objectives of the DFA
The Digital Fairness Act (DFA) is a new initiative by the European Commission aimed at closing gaps in consumer protection online. The initiative emerged from a digital fairness fitness check conducted in 2024, which identified significant shortcomings in existing legal frameworks [1].
The DFA’s main objective is to ensure fair conditions for consumers in the digital environment, protect them from manipulative practices, and create a level playing field in online commerce. The Act seeks to complement the EU’s existing digital legal framework, including the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and the Digital Markets Act (DMA).
Key provisions of the DFA
The Digital Fairness Act is aimed at addressing the following problematic practices:
1.Unfair commercial practices involving dark patterns – these are user interface designs that manipulate users and steer them toward making decisions that may not be in their best interests. Examples include hidden subscriptions, complicated service cancellation processes, and misleading wording.
2.Misleading marketing by influencers – regulating social media advertising practices, requiring transparency for sponsored content, and protecting consumers, especially minors, from covert advertising.
3.Addictive design of digital products – combating features that foster addiction among users, especially children and adolescents, such as infinite scrolling, autoplay, and gamification, which are intended to increase the time spent in an app.
4.Unfair personalization practices – regulating the use of personal data to manipulate consumer behavior, including personalized pricing and targeted advertising, which can increase users’ vulnerability.
In addition, the DFA aims to:
•Ensure a level playing field for online retailers
•Simplify the enforcement of legislation
•Potentially simplify existing rules
Impact of the DFA on businesses
The Digital Fairness Act will have a significant impact on businesses operating in the EU’s digital space:
1.Changes to User Interface Design – companies must review the design of their websites and applications to eliminate dark patterns and addictive features.
2.New Requirements for Influencer Marketing – brands and marketing agencies must ensure full transparency regarding sponsored content and comply with stricter rules when working with influencers.
3.Restrictions on personalization – companies must review their personalization strategies to ensure fairness and transparency in how consumer data is used.
4.Stronger enforcement – stricter oversight by regulatory authorities and potentially higher fines for non-compliance are expected.
Current status and timeline of the DFA
The Digital Fairness Act is currently at the public consultation stage. The European Commission opened a feedback period from 17 July to 24 October 2025, during which interested parties can submit their comments and proposals [1].
According to information on the European Commission's official website, the initiative is expected to be presented in the second quarter of 2025. This will be followed by the legislative process, which includes discussions in the European Parliament and the Council of the EU.
Considering the usual timetable for the adoption of EU legislation, it can be expected that the Digital Fairness Act will enter into force no earlier than 2026-2027, with a possible transition period for businesses to adapt to the new requirements.
EU Data Act
Background and objectives of the Data Act
The EU Data Act is one of the European Union's most ambitious legislative acts in the field of data regulation. It was developed as part of the previous European Commission's strategy for regulating data-related services and artificial intelligence [2].
The main objective of the Data Act is to stimulate the EU data economy by establishing fair rules for accessing and using data. The Act seeks to strike a balance between fostering data-driven growth and protecting interests such as intellectual property and trade secrets.
Key Provisions of the Data Act
The EU Data Act covers three critical areas:
1.Data sharing and access (mainly B2B, but also B2C):
•Users of connected devices have the right to obtain or directly access the data generated by their devices.
•If the data cannot be accessed directly, the data holder must provide it without undue delay in a well-structured, machine-readable format.
•Users may instruct data holders to share data with so-called data recipients.
•This ensures that users (and third parties chosen by them) can make meaningful use of the generated information, subject to appropriate confidentiality and trade secret safeguards.
2.Obligations to share important data with public authorities under certain conditions (B2G):
•In exceptional cases, such as emergencies or when data is needed to perform a specific task in the public interest, companies may be required to share data with public authorities.
•The Act sets strict conditions for such requests to ensure proportionality and necessity.
3.Customers' right to seamlessly switch between data processing service providers:
•Providers of data processing services (such as cloud or edge computing) must provide information about available data and the process of switching service providers.
•They must remove all obstacles (technical, contractual, and otherwise) to switching service providers, which requires a thorough review of contracts.
•Providers must assist customers in exiting the service, which may in some cases require technical changes to ensure interoperability.
•Although an early termination fee may be charged, there should be no fee for switching service providers.
Impact of the Data Act on companies
The EU Data Act has a significant impact on various business sectors:
1.Manufacturers of connected devices must:
•Ensure “access by design” to data generated by their devices
•Review their contracts and privacy policies
•Develop technical solutions for secure and efficient data sharing
2.Providers of cloud and data processing services face:
•The need to remove barriers to switching service providers
•Requirements to ensure interoperability and data portability
•For restrictions on service provider switching and service termination fees
3.Companies that use data in their business models, must:
•Adapt their data monetization strategies
•Ensure compliance with fair data access rules
•Develop mechanisms for sharing data with third parties at users' request
4.All companies must be prepared:
•Potential requests from public authorities to provide data
•For new transparency requirements regarding data collection and use
•For potential compensation claims under FRAND (fair, reasonable and non-discriminatory terms) rules
Current status and timeline of the Data Act
The EU Data Act entered into force on 11 January 2024 and will apply from From 12 September 2025 [2]. This gives companies a limited time to prepare to comply with the new requirements.
The European Commission intends to issue additional guidance and standard contractual terms to help interpret the Data Act, including:
•Guidelines on reasonable compensation under the Data Act
•Three standard contractual terms governing data sharing between data holders, data users and data recipients
•Standard Contractual Terms Concerning Switching Between Data Processing Services
These documents are expected to be published before September 12, but the European Commission has indicated that the timeline is likely to shift. In addition, there are plans to update this autumn the frequently asked questions (FAQ) published by the European Commission about a year ago [2].
NIS 2 Directive
Background and objectives of NIS2
The NIS 2 Directive (Directive on the security of network and information systems 2) was adopted by the European Union on 28 November 2022 as Directive (EU) 2022/2555 [3]. It represents a significant expansion of the EU cybersecurity legal framework and replaces the original NIS Directive, which was adopted in 2016.
The main objective of NIS 2 is to raise the overall level of cybersecurity in the EU:
•Expanding the scope to a wider range of sectors and types of organizations
•By imposing stricter requirements for cybersecurity measures
•By strengthening cooperation mechanisms between EU Member States
•By harmonising sanction regimes across all Member States
Key provisions of NIS2
The NIS 2 Directive introduces several significant changes and new requirements:
1.Expanded scope:
•NIS 2 significantly expands the list of sectors considered “important” or “essential” to the EU economy and society.
•According to EU statistics, approximately 0,2% of all EU companies (around 100 000 organisations) must comply with the NIS2 requirements, significantly expanding the scope of the original directive [4].
•The new sectors include manufacturing, the food industry, digital service providers, waste management, the chemical industry, the space sector, postal and courier services, etc.
2.Cybersecurity measures:
•NIS 2 requires companies to implement security measures, including the use of multi-factor authentication [5].
•Organizations must implement comprehensive cybersecurity risk management measures, including risk analysis, incident handling, business continuity, supply chain security, encryption, and vulnerability management.
•Regular testing of the effectiveness of cybersecurity measures is required.
3.Incident reporting obligations:
•Organisations must notify the competent authorities of significant cybersecurity incidents within 24 hours of detecting the incident.
•Interim reports and a final report must be submitted within one month after the incident.
•Clearer criteria have been established for determining the “significance” of an incident.
4.Management responsibility:
•The management bodies of organisations bear personal liability for non-compliance with cybersecurity requirements.
•Regular cybersecurity training is required for members of management.
•Management must approve cybersecurity risk management measures and monitor their implementation.
5.Supervision and enforcement:
•Stricter sanctions regimes have been established, including administrative fines of up to 10 million euros or 2% of total worldwide annual turnover.
•Competent authorities are granted expanded supervisory powers, including the right to conduct on-site inspections and security audits.
•Establishment of the European Cyber Crises Liaison Organisation Network (EU-CyCLONe) for a coordinated response to large-scale incidents.
Impact of NIS2 on businesses
The NIS 2 Directive has a significant impact on companies in various sectors:
1.Expansion of the scope of companies covered:
•Many organisations that were previously not subject to cybersecurity regulation must now comply with the requirements of NIS 2.
•This is particularly important for medium-sized enterprises (50-249 employees), which now fall within the scope of the directive.
2.Increase in cybersecurity investments:
•Companies must increase their cybersecurity budgets to meet the new requirements.
•The need to implement new technologies and processes, such as multi-factor authentication, encryption, and intrusion detection systems.
3.Organizational changes:
•The need to appoint dedicated staff responsible for cybersecurity.
•The need for regular cybersecurity training for staff and management.
•Implementation of incident management and reporting processes.
4.Supply chain management:
•Companies must assess and manage cybersecurity risks in their supply chains.
•This may lead to changes in the processes for selecting suppliers and managing relationships.
5.Cross-border compliance:
•Organisations operating in several EU countries must take into account differences in the national implementation of NIS 2.
•Each EU country must establish a governing body and transpose NIS 2 into its federal laws, which may result in some differences in requirements [6].
Current status and timeline of NIS2
The NIS 2 Directive was adopted on 28 November 2022 and entered into force in January 2023. EU Member States were required to transpose the Directive into national law by 17 October 2024.
1.As of July, only a few Member States have fully completed the transposition process [7]. For example:
•Malta completed the transposition on 8 April 2025 by adopting the “Measures for a High Common Level of Cybersecurity across the European Union (Malta) Regulations, 2025” [8].
•Germany planned to enact the NIS 2 Implementation Act (NIS-2UmSuCG) in March 2025, but this was postponed due to new elections and the formation of a government [9].
The NIS 2 Directive will be fully implemented in 2025 and will affect many companies operating in the digital space. Organizations should begin preparing for compliance as soon as possible if they have not already done so.
Interrelationship between regulatory acts
The Digital Fairness Act, the EU Data Act and the NIS 2 Directive are part of the EU's broader strategy to regulate the digital economy and create a secure, fair and competitive digital single market. These legislative acts complement each other and other existing regulatory frameworks, such as the GDPR, DSA and DMA.
Complementary aspects
1.Protection of consumer and user rights:
•The Digital Fairness Act focuses on protecting consumers from unfair practices online.
•The EU Data Act gives users the right to access data generated by their devices and control its use.
•NIS 2 ensures the security of systems and networks, indirectly protecting users from data breaches and cyberattacks.
2.Data regulation:
•The EU Data Act establishes rules for accessing and using data.
•The Digital Fairness Act regulates the use of personal data for personalization and targeting.
•NIS 2 ensures the security of data and systems where they are stored and processed.
3.Creating a level playing field for companies:
•The Digital Fairness Act seeks to ensure a level playing field for online merchants.
•The EU Data Act aims to prevent data monopolisation and ensure fair access.
•NIS 2 establishes uniform cybersecurity standards for all companies in certain sectors.
Potential conflicts and complexities
1.Compliance with multiple requirements:
•Companies that fall within the scope of all three regulatory acts may face challenges in complying with all requirements simultaneously.
•For example, the EU Data Act's requirement for the free exchange of data may conflict with the data security requirements of NIS 2.
2.Different implementation deadlines:
•The EU Data Act will enter into force in September 2025.
•NIS 2 should have been transposed into national law by October 2024.
•The Digital Fairness Act is currently being developed and is unlikely to enter into force before 2026-2027.
•These different deadlines can make it difficult for companies to plan and implement the necessary changes.
3.National differences in implementation:
•EU directives, such as NIS 2, require transposition into national law, which may lead to differences in implementation between Member States.
•This creates additional complexities for companies operating in multiple EU countries.
Recommendations for companies
Given the complexity and scope of EU regulatory changes, companies are advised to take the following steps:
General recommendations
1.Conduct an applicability assessment:
•Determine whether your company falls within the scope of each regulatory act discussed.
•Assess which aspects of your business operations are affected by each act.
2.Develop a compliance plan:
•Create an action plan for implementing the necessary changes, taking into account the effective dates of each regulatory act.
•Allocate resources and a budget for implementing the plan.
3.Designate responsible persons:
•Designate employees or teams responsible for compliance with each regulatory act.
•Provide the necessary training and support to these employees.
4.Monitor legislative developments:
•Regularly monitor updates and clarifications from the European Commission and national regulators.
•Participate in public consultations, such as the current consultations on the Digital Fairness Act.
Specific recommendations regarding the Digital Fairness Act
1.User interface audit:
•Review websites and applications for dark patterns and addictive features.
•Develop a plan to remove or modify them.
2.Review of marketing practices:
•Ensure transparency regarding sponsored content and collaborations with influencers.
•Develop guidelines for marketing teams and partners.
3.Assessment of personalisation practices:
•Analyse how data is used to personalise content and advertising.
•Ensure fairness and transparency in these practices.
Specific recommendations regarding the EU Data Act
1.Audit of data and its use:
•Determine what data your products or services generate.
•Assess how this data is used and with whom it may be shared.
2.Updating contracts and policies:
•Review contracts with customers and suppliers, taking the new requirements into account.
•Update privacy policies and terms of use.
3.Technical preparation:
•Develop technical solutions to ensure “access by design” to data.
•Ensure that data can be shared securely and efficiently.
4.For cloud service providers:
•Remove barriers to switching service providers.
•Develop processes to support customers when switching away from the service.
Specific recommendations regarding NIS 2
1.Cybersecurity risk assessment:
•Conduct a thorough cybersecurity risk assessment.
•Develop a plan to manage the identified risks.
2.Implementation of required security measures:
•Implement multi-factor authentication and other required measures.
•Ensure that the effectiveness of these measures is tested regularly.
3.Development of incident management processes:
•Establish procedures for incident detection, response and reporting.
•Ensure the ability to notify the competent authorities within 24 hours.
4.Staff and management training:
•Organize regular cybersecurity training.
•Ensure that management is aware of its responsibilities.
Summary
The European Union continues to actively shape the digital single market through a comprehensive legal framework. The Digital Fairness Act, the EU Data Act and the NIS 2 Directive are important elements of this strategy, which aims to protect consumer rights, ensure fair access to data and raise the level of cybersecurity.
These regulatory changes create both challenges and opportunities for businesses. On the one hand, businesses must invest resources to comply with the new requirements and adapt their business models. On the other hand, these changes may foster innovation, competition, and increased consumer confidence.
The key to navigating this complex regulatory landscape is a proactive approach: understanding the requirements early, careful planning and timely implementation of the necessary changes. Companies that can effectively adapt to the new rules will gain a competitive advantage and be able to take advantage of the opportunities created by the EU's digital single market.
You do not lose—you earn! Would you like to know how?
480.00€
Tallinn, Estonia
Reset password
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
