Switching Law Firm Software Without Lock-in: Your Rights Under the EU Data Act

It’s a scenario many law firms are familiar with: The software no longer meets their needs—there’s no interface with accounting, the client portal looks like it’s from another decade, and support takes weeks instead of days to respond. The desire to switch is there, but then the obstacles arise: an automatic contract renewal for twelve months, an “export” consisting of several thousand unstructured PDF files, a quote for data migration in the four-digit range. It was precisely this practice of locking in customers—the “lock-in”—that for years was the strongest argument against switching providers. As of September 12, 2025, there is a legal counterbalance: The EU Data Act stipulates how switching between data processing services must take place—and cloud-based law firm software generally falls precisely under this category. Furthermore, since May 30, 2026, the Federal Network Agency has been monitoring compliance in Germany. This article explains what rights law firms now have, where the limits lie, and how to successfully switch providers in practice. It does not replace a legal review of the specific contract by an attorney, but it does provide a solid working basis for the decision.

Why the Switch Has So Often Failed in the Past

Three factors have tied law firms to their providers for years. First, the contractual terms: long minimum contract terms, automatic renewals, and cancellation windows that can easily be missed once a year. Second, data technology: Your firm’s files are stored in proprietary formats, and the data the provider delivers as an export cannot be meaningfully processed in any other system. Third, the price tag at the exit: fees for exporting, converting, or simply releasing the data. The result was a rational stalemate—firms stay not because they’re satisfied, but because leaving seems more expensive than staying.

Lawmakers have recognized this pattern. Chapter VI of the Data Act (Regulation (EU) 2023/2854) explicitly aims to reduce lock-in effects in cloud services and to facilitate switching from a technical, contractual, and financial perspective.

To Which Systems Do the Switching Rights Apply?

The scope covers “data processing services”—as defined in Article 2(8) of the Data Act, digital services that provide on-demand network access to a shared pool of configurable, scalable, and elastic computing resources. In other words: virtually all cloud models, namely Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Cloud-based law firm software, web-based document management, and hosted email solutions: Anyone using such a service in the EU can invoke the portability provisions—regardless of where the provider is based.

Two important caveats apply. Traditional on-premises licensed software running in your own server room is not a data processing service as defined by the regulation; in this case, the contract alone governs what happens upon termination. Furthermore, the switching provisions require that the new provider offer the “same type of service”—that is, a service with the same primary purpose, the same main functions, and the same service model (Art. 2 No. 9). Services custom-built for a single customer and trial versions are also partially exempt.

The Five Key Rights When Switching Providers

First: a short notice period. To initiate the switch, the contract may stipulate a notice period of no more than two months; automatic contract renewals without the customer’s consent are not permitted (Art. 25 Data Act). So, anyone who cancels this summer can still initiate the switch in the fall.

Second: a binding transition period. The switch must generally be completed within 30 days. Only if the provider provides a valid justification that this is not feasible for technical reasons may the period be extended to up to seven months (Art. 25, para. 4). Throughout this entire period, the service must continue to operate and IT security must be maintained.

Third: a complete, usable data export. The provider must hand over all exportable data and digital assets—in a common, machine-readable format. For SaaS and PaaS offerings, the provider must also provide open interfaces, including documentation, free of charge (Art. 30). Users who were previously offered an “export” consisting of a thousand individual PDFs can now request structured data.

Fourth: Transparency before and during the switch. Providers must provide information on the procedures, methods, and formats for switching and refer to an online registry containing data structures and standards (Art. 26); all parties involved are obligated to cooperate in good faith (Art. 27).

Fifth: limited—and soon to be abolished—switching fees. Until January 12, 2027, only reduced fees that cover actual costs may be charged, and these must have been disclosed transparently before the contract is concluded. As of January 12, 2027, data transfer fees will be completely prohibited (Art. 29).

Does this also apply to existing contracts?

Yes. The provisions on switching in Chapter VI have been in effect since September 12, 2025—including for contracts concluded before that date. Agreed-upon longer terms or notice periods do not preclude the statutory right to switch. This distinguishes Chapter VI from the abuse control provisions for data clauses in Chapter IV: For existing contracts, it applies only as of September 12, 2027, provided they are open-ended or have a very long remaining term.

One nuance remains: While the data export itself must be free of charge, early termination fees intended to recoup initial costs are not generally prohibited—but they must be clearly identified as such in the pre-contractual phase and must not constitute hidden export fees. Whether a specific clause meets this requirement must be assessed on a case-by-case basis.

Who Enforces the Rights: DADG and the Federal Network Agency

The Data Act is an EU regulation and is directly applicable—what it does not regulate are the competent authorities and sanctions. Germany has addressed this with the Data Regulation Application and Enforcement Act (DADG): The Bundestag passed it on March 26, 2026, and it entered into force on May 30, 2026. The central supervisory authority is the Federal Network Agency; it explicitly oversees the regulations on switching providers and is preparing a complaint portal. Where personal data is involved, the Federal Commissioner for Data Protection and Freedom of Information also plays a role. The law imposes substantial fines on providers that maintain barriers to switching; law firms can also rely on contractual claims.

In practice, this means that anyone in a dispute with a provider over cancellation does not have to file a lawsuit immediately. Simply referring to the legal obligation—and the prospect of filing a complaint with the Federal Network Agency—changes the course of many negotiations.

Switching Smoothly in Six Steps

The legal framework is one thing; organization is another. Six steps have proven effective.

First: Take stock. Which cloud services does the law firm use, where is the data stored, and what are the contract terms? Without this overview, you can’t plan a switch—or calculate a deadline.

Second: Compare the contract to the law. Notice periods, fees, export commitments: Compare what the contract says with what the Data Act requires. The difference is your leverage in negotiations.

Third: Give written notice of the switch and request information. Procedures, formats, interface documentation—the provider must supply them. The deadlines begin once you’ve given notice, so document every step.

Fourth: Request a test export before terminating the contract. Format, completeness, metadata, document attachments, history—only the test will show whether the data arrives in the target system. A switch without a test export is like flying blind.

Fifth: Actively manage the transition phase. Plan for parallel operation, realistically assess the 30-day deadline, and log the migration. Involving the new provider early on allows both parties to fulfill their obligation to cooperate.

Sixth: Wrap things up properly. After a successful migration, request and document the deletion of data from the old provider—once the data processing contract ends, so does the legal justification under data protection law for retaining the data. We’ve compiled what to look for when selecting a new tool in the Checklist for New Law Firm Tools; the criteria from the law firm software comparison will help you make the decision yourself.

Limitations Law Firms Should Be Aware Of

Four points are essential for an honest assessment. First, with SaaS, there is no right to functional equivalence: The obligation to ensure functional equivalence applies only to IaaS providers; when switching law firm software, you receive your data, not an identical system from the new provider. Second, the provider’s trade secrets remain protected—the transition ends where third-party know-how would have to be disclosed. Third, at the EU level, a legislative process is underway with the “Digital Omnibus,” which also provides for amendments to the Data Act; this is not yet applicable law, so it should be monitored. Fourth, the regulation is new: terms such as “reasonable” or “without undue delay” will only be given concrete meaning through practical application and future guidelines from the authorities. Those involved in disputes are, in part, navigating uncharted territory.

Conclusion

Switching service providers at a law firm used to be a one-sided game: the data was held by the provider, the deadlines were set in the contract, and the risk lay with the client. The EU Data Act has shifted the balance—with short notice periods, a right to usable data export, open interfaces, and the end of switching fees starting in January 2027. Anyone considering a switch should not treat these new rights as a footnote, but rather as the basis for planning: Inventory, contract review, test export, transition phase, clean termination. Digital law firm platforms like Jurono can help organize data and processes from the start so that they remain portable; the review of contracts and compliance with data protection laws remains the law firm’s responsibility. If you’d like to learn how structured digital workflows can look in your law firm, you can find more information at jurono.eu.