What the EU Data Act Means for Industrial IoT Privacy

Industrial equipment is becoming a source of continuous information. A mining truck reports its location and fuel consumption, a factory robot records operating conditions, and a refrigeration system sends temperature readings to a cloud platform. Much of this information looks technical rather than personal, yet it can reveal working patterns, individual performance, business relationships and commercially sensitive decisions.

The European Union’s Data Act changes who can access data generated by connected products and related services. For Australian manufacturers, miners, logistics firms and technology providers, the rules matter whenever equipment is sold into the EU or supports customers there. The law creates new data-sharing rights, while raising difficult questions about privacy, trade secrets, cybersecurity and control over industrial data.

The law’s central shift in data control

The Data Act applies mainly to data produced by connected products and related services. A connected product might be a vehicle, medical device, industrial machine or smart meter. A related service could be software that operates, monitors or analyses that product. The information covered includes product data generated by use, as well as service data created while a digital service is running.

The person or organisation using the product gains a stronger position. Users must be able to access relevant data, usually without charge, and may ask the data holder to share it with a third party. This could allow a factory operator to give machine-performance information to an independent maintenance company rather than being locked into the manufacturer’s preferred service network.

That change is significant because manufacturers have traditionally treated equipment telemetry as their own asset. Under the new framework, the company that owns or leases a machine may gain rights to information that previously disappeared into a vendor’s cloud. A Queensland mining business, for example, could seek data from a fleet of connected haul trucks to compare maintenance providers or build its own operational dashboard.

The arrangement is not a free-for-all. The Data Act contains safeguards for trade secrets, security and the rights of other people whose information appears in the data. It also interacts with the GDPR, which remains the primary framework where the dataset contains personal information.

Why industrial data can become personal data

Industrial IoT privacy is difficult because machines often observe people indirectly. A sensor may record a forklift’s movements, but those movements can be linked to a particular operator through a roster or login. A wearable used at a warehouse can reveal a worker’s location, pace and breaks. A production line’s error logs may show when an individual employee was operating a station.

Under the GDPR, personal data is interpreted broadly. A name is obvious, but a device identifier, pseudonymous user code or timestamped activity trail can also identify someone when combined with other information. The Data Act does not turn every machine reading into personal data, yet it does require organisations to handle the personal component lawfully when it exists.

This creates a practical distinction between data access and permission to use data. A company may have a right to receive a dataset under the Data Act, but it still needs an appropriate legal basis to process personal information. It may need to remove names, aggregate readings, restrict access or explain the purpose for which the data will be used.

The issue is familiar to anyone following the risks around biological databases and identity. The discussion in this DNA privacy analysis shows how information collected for one purpose can acquire wider consequences when reused. Industrial telemetry is less intimate than genetic material, but the same principle applies: data that appears harmless in isolation can become revealing when combined.

What Australian businesses need to watch

The law has a direct effect on Australian companies that manufacture connected equipment for European customers. It can also affect a business in Australia that uses an EU-made machine and wants to obtain its operational data. A local organisation may have rights as a user even when the supplier, cloud host and equipment designer are all based overseas.

The EU’s market reach will be especially relevant to sectors such as mining, medical technology, agriculture, transport and energy. A Melbourne industrial automation company selling robotic systems to German factories may need to redesign its data-access controls. An Australian agricultural technology provider supplying connected irrigation equipment to European farms may need to document what data the devices produce, where it is stored and who can retrieve it.

The Australian context adds its own complications. A mine in Western Australia can span enormous distances, use subcontractors and rely on intermittent connectivity, while still sending telemetry to a European software platform. In New South Wales, a water utility may operate connected pumps and meters through several vendors. These arrangements make it difficult to identify the data holder, the user and the party responsible for privacy compliance.

Australian privacy law is also developing separately. The Privacy Act and possible reforms will shape how local companies handle employee and customer information, while the EU rules impose their own requirements for products entering the European market. Treating the Data Act as an issue for the legal team alone would be a mistake; procurement, engineering, security and operations all need to understand the consequences.

Sharing data without exposing the business

One of the hardest questions is how to provide useful data while protecting commercial secrets. A manufacturer may hold detailed information about machine efficiency, failure rates, component suppliers and production capacity. A customer’s request for access might be legitimate, but the resulting dataset could reveal the manufacturer’s design choices or the customer’s own competitive position.

The Data Act recognises this tension. Trade secrets may be protected where disclosure would cause serious economic harm, although secrecy cannot be used as a blanket excuse to refuse every request. Businesses will need to assess the specific risk, apply proportionate safeguards and explain why particular fields are withheld or transformed.

Technical controls will become more important. Role-based access, secure application programming interfaces, audit logs, encryption and granular export settings can reduce the chance that a broad data request becomes an uncontrolled copy of an entire operational system. Data minimisation also matters: a maintenance provider may need vibration readings and fault codes, not employee names or every location ping.

Contracts should support these controls rather than undermine them. Agreements can define data categories, response times, security standards, permitted purposes and procedures for suspected misuse. They should also identify what happens when a customer changes service providers. A cloud platform that makes data technically available but commercially impractical to export may still frustrate the law’s purpose.

Privacy risks in workplaces and public infrastructure

Industrial IoT systems often sit close to employees. A connected tool can measure usage, a camera can infer activity and an access-control system can generate a detailed record of movements. If an employer uses these records to rank individuals or discipline staff, the privacy impact is much greater than if the same information is used to detect a machine fault.

Australian workplaces have particular reasons to be cautious. A FIFO workforce at a Pilbara mine may be tracked across accommodation, transport and restricted areas. A distribution centre near Sydney may collect scan times and route data for every shift. The operational justification may be genuine, but constant monitoring can change how workers behave and create pressure that is difficult to see in a technical risk assessment.

The Data Act’s user-access rights should therefore be paired with privacy-by-design practices. Organisations should separate machine diagnostics from worker-performance records where possible, limit retention, apply aggregation and tell employees what is being collected. If a dataset can be linked back to a person, access should be controlled according to sensitivity rather than labelled “non-personal” simply because it originated from a machine.

Physical boundaries matter too. A company reviewing its digital controls may benefit from considering physical privacy measures, such as screen placement, restricted equipment rooms and protection against casual observation. Industrial privacy is not confined to APIs and cloud permissions; a visitor photographing a control panel can create a data leak just as surely as a poorly configured account.

New leverage for competition and interoperability

The Data Act is also intended to reduce dependence on dominant technology providers. Users should have more ability to move data between services, switch cloud providers and use independent repair or analytics businesses. This could help industrial customers challenge expensive maintenance arrangements that rely on proprietary data silos.

For an Australian business, the commercial opportunity may be as important as the compliance burden. A local predictive-maintenance provider could offer services to European factories if it can receive the necessary machine data under clear terms. A Brisbane logistics company could use independent software to analyse fleet information rather than accepting the vehicle manufacturer’s dashboard as the only option.

Cloud switching provisions and interoperability requirements will force companies to examine architecture early. Data stored in a proprietary format, scattered across regional servers or mixed with unrelated customer records will be harder to transfer. Engineering teams should map the journey from sensor to gateway, platform, analytics tool and end user, including the people and systems that can alter the data along the way.

The commercial culture around connected services may shift as a result. At a food event, customers might focus on comparing individual stalls, such as those described in this account of festival food stalls. In industrial markets, customers will increasingly compare who controls the information behind the product, how easily it can be exported and whether an independent provider can make useful sense of it.

Preparing systems for the Data Act era

The first practical step is a data inventory. Businesses should list connected products, related services, sensor outputs, user accounts, cloud locations, third-party recipients and retention periods. They should classify each field as personal, non-personal, commercially sensitive, security-sensitive or a combination of these categories.

Product design will need to reflect those classifications. New equipment should offer understandable access mechanisms, usable export formats and controls that distinguish operational data from employee monitoring. Existing products may require firmware updates, revised dashboards or new customer portals. Documentation should explain what the device collects without burying important information in a dense technical manual.

Governance needs to extend beyond the organisation’s own systems. Suppliers, distributors, repairers and analytics partners may all handle connected-product data. Due diligence should examine whether vendors can honour access requests, protect trade secrets, delete data when required and support a customer moving to a different provider. The bargain-basement cloud arrangement can become expensive when it cannot produce a reliable audit trail.

A useful perspective is that privacy is part of system resilience, not an obstacle added after deployment. Writers such as Deepali Gupta explore how technology and society shape each other, a perspective that fits industrial IoT well. A sensor network designed around clear purpose, limited collection and accountable access is easier to secure and easier to explain to workers, customers and regulators.

For Australian organisations, the sensible approach is to start with the machines that have the greatest European exposure and the greatest human impact. Map their data flows, identify personal information, review contracts and test an export before a customer demands one. The practical takeaway is simple: treat every connected industrial system as a privacy, competition and security environment at the same time, then build access controls that make those responsibilities visible and manageable.