Custom data access portal for connected products
The Data Act gives the user of a connected product the right to the data that product and its related service generate, and the right to have that data shared with a third party. If the user cannot access the data directly, the data holder must make it available on a simple electronic request. That needs a front end. Appfront builds the data access portal: the user linked to their product, the datasets per model with their metadata, requesting and sharing in a machine-readable format, consents that can be withdrawn, and a register of every request.
What is a data access portal for connected products?
A data access portal is where the user of your product retrieves their data and controls who else receives it. Regulation (EU) 2023/2854, the Data Act, defines a connected product as an item that collects data about its use or environment and can transmit it. Article 4 requires the data holder to make readily available data available, together with the metadata needed to interpret it, without undue delay, free of charge and in a commonly used, machine-readable format, where relevant by means of a simple electronic request. Article 5 gives the user the right to have that data supplied to a third party. The portal turns those rights into a working process.
Without a portal, requests arrive through customer service and are handled by email. Someone has to check that the requester really is the user of that product, a developer pulls an export from the platform, and a request from a maintenance company acting on behalf of a customer stalls because nobody knows whether that is allowed. The regulation sets limits on both sides: you may not ask for more information or retain more log data than necessary, you may not make the user's choice unnecessarily difficult, and trade secrets may only be shared once safeguards have been agreed. That cannot be tracked with email and a spreadsheet.
We build custom portals because every product has different data and every organisation has a different customer relationship. A machine manufacturer supplies businesses that buy or lease machines, an appliance maker supplies consumers through an app, an installer supplies housing associations with thousands of installations. Which data is readily available, how you link a user to a product and which third parties make requests determine what the portal does. The legal assessment is for your legal counsel; we build the portal and the process.
Retrieve it themselves
Data per product.
Share
With consent, and revocable.
Recorded
Every request, nothing more.
How we build your data access portal for connected products
We start with your products and data: which models are connected, what data they generate and where it is stored, how you know who the user is, and how requests currently come in. Then we build a first version in which a user links their product and requests their data, because that is the core of the right. Your customer service works with it for a while. Sharing with third parties, the protection of trade secrets, the API and the pre-contractual information per model follow once that is running well. After that, we maintain the portal as your products or the guidance change.
Models, datasets, users.
The first version.
Third parties and trade secrets.
Go-live, monitoring, and maintenance when things change.
What a data access portal for connected products does in practice
The components below appear in almost every data access portal. Which ones you need depends on your products, your users and the third parties that request data.
User and product
Linking and verification.
Datasets
Per model, with metadata.
Requesting
Download or API.
Sharing with third parties
Consent and revocation.
Trade secrets
Protected until agreed.
Request register
Handling and refusal.
Who we build a data access portal for connected products for
The portal is intended for manufacturers and suppliers who fall under the Data Act as data holders and expect more requests than customer service can handle by hand. Micro and small enterprises are exempt from these obligations under certain conditions.
Machine builders
Machines at businesses.
Instruments
Consumers via an app.
Installations
Climate, energy, lifts.
Vehicles
Fleet and maintenance.
Test your idea first: a working prototype in 1 day
With OneDayBuild, we make your idea tangible in a single day for €1,150, so you know whether further development is worth the investment. Decide to go ahead with the full build? Then we deduct the cost in full.
View OneDayBuild →Technology and integrations
This page is about the portal through which users and third parties request data. For the whole Data Act programme, including separating raw from derived data in your architecture and switching between cloud services, see our page on Data Act software. If the data from your devices still needs to be collected and stored, look at a custom IoT platform or industrial IoT software, and for a portal covering all your customer matters, see our page on a customer portal. You can read about our way of working on building software.
Why choose Appfront for your data access portal for connected products?
A request that sits in a mailbox for weeks, an export with no explanation of what the fields mean, or a third party receiving data without permission: any of these brings a data holder complaints and questions from the regulator. That is what we build around: users handle things themselves, every instance of sharing has a permission that can be withdrawn, and every request can be traced.
Self-service
Users retrieve data themselves.
Controlled sharing
Permission per third party.
Demonstrable
Register of requests.
Security and privacy in a data access portal for connected products
Product data can contain personal data, for example about when someone is at home or how a vehicle is driven. The portal only delivers data to the user linked to the product and to third parties with that user's permission, and where the data contains other people's personal data, we take the GDPR into account. Data designated as trade secrets is only shared once the agreed safeguards have been documented.
The portal runs in a European data centre, with encrypted connections and storage. Login uses two-factor authentication, and third parties get their own access limited to exactly the data and the duration covered by the permission. The register keeps what is needed to handle a request and secure the infrastructure, and nothing more.
Frequently asked questions about a data access portal for connected products
Questions that product managers, CTOs and compliance officers at manufacturers ask before they start.
A portal in which the user of a connected product requests their product data and arranges for a third party to receive it, as the Data Act requires. The portal links the user to their product, shows which data is available, delivers it in a machine-readable format and records every request.
The Data Act does not prescribe a portal, but it does require that data be available easily, free of charge and, where possible, on simple electronic request. If the user cannot reach their data directly through the product, a portal is a practical way to comply. Micro and small enterprises are exempt under certain conditions.
The regulation has applied since 12 September 2025. The obligation to design products so that the data is accessible by default applies to connected products and services placed on the market after 12 September 2026.
A company designated as a gatekeeper under the Digital Markets Act does not qualify as a third party. Beyond that, you can protect trade secrets under certain conditions or, in exceptional cases, refuse, with a justification and a notification to the competent authority. The portal records this for each request.
The readily available data that the product and the related service generate, together with the metadata needed to use them. Which data that is for your products is something you decide together with your legal adviser; we map out where it is held and how it gets into the portal.
That page covers the whole process: the architecture, the separation between raw and derived data, and switching between cloud services. This page covers the portal and the process through which users and third parties make their requests.
For manufacturers and suppliers with many connected products in use and data spread across multiple systems. If you have only a handful of customers who rarely ask for anything, a well-documented procedure with a manual export may be enough.
Want to handle product data requests properly?
Tell us which products you supply, what data they generate and how requests currently come in. We'll show you how a portal can handle that.