Farm data ownership, sharing and security: what to check in a contract
Tractors, irrigation controllers, weather stations and farm management software generate data every day: field boundaries, yields, fertiliser and spray rates, machine hours. Who may use that data, and for what, is usually settled in the fine print of a purchase or subscription contract. EU assessments show that uncertainty over data ownership is one of the barriers to wider uptake of digital tools; in Bavaria, high investment and running costs together with unclear data ownership were the obstacles cited most often. Farmers may hesitate to share data for fear of breaches, misuse and loss of control over their own information (EU CAP Network, 2025).
The EU Code of Conduct on Agricultural Data Sharing (2018)
In 2018 European organisations representing farmers and cooperatives, machinery, fertiliser, crop protection, seed, feed, agricultural contractors, animal breeders and young farmers, led by Copa-Cogeca, published the EU Code of Conduct on Agricultural Data Sharing by Contractual Agreement (EUCC). It is voluntary and explicitly farmer-oriented. At its centre is the "data originator": the person or business that creates or collects agricultural data, or commissions someone else to do so. The data originator holds the same position as the data rights holder (Ryan et al., 2024).
Its five main principles are (Ryan et al., 2024):
- Data rights: rights are granted to the data originator who creates the data or has it created.
- Access, control and portability: the data originator should be able to access, control and reuse the data, and third-party access requires explicit consent. Portability means data can be moved from one machine or system to another.
- Transparency: data cannot be shared with third parties not listed in the contract, and contract changes need the agreement of all parties.
- Privacy and security: personal data are protected under the GDPR, anonymised or pseudonymised where appropriate, and those affected by a security breach must be told immediately.
- Liability and intellectual property: liability for breaches must be clear and intellectual property protected.
Its weakness is that it is voluntary: there are no sanctions for non-compliance, and the literature criticises it for not dealing adequately with data lock-in, where a farmer becomes tied to one brand's system. A study based on six workshops across Europe with 89 stakeholders concludes that the code still matters for the sector but should be updated in line with the Data Act and backed by model contract terms (Ryan et al., 2024).
The EU Data Act: Regulation (EU) 2023/2854
The Data Act was published in the Official Journal of the EU on 22 December 2023 and has applied since 12 September 2025. Users of connected products (for example industrial or agricultural machinery) and related services can access the data they co-generate while using the product. They can share it themselves or ask the data holder to share it with a third party of their choice; gatekeepers under the Digital Markets Act are excluded as recipients. The data holder is usually the company that makes the product or provides the related service, and it must have a contract with the user setting out rights to access, use and share the data. It may not use non-personal data generated by the product without the user's agreement (European Commission, 2025).
Other points that matter to growers (European Commission, 2025):
- The data holder must tell the user what type of data the product will generate, in what volume and how often; users should be able to request access through a simple process, and the data must be made available to them free of charge.
- Data obtained by the user cannot be used to develop a competing connected product.
- Where data go to another business, a data holder may charge micro, small and medium-sized enterprises and non-profit research organisations no more than the cost of making the data available.
- All businesses, in particular SMEs, are protected against unfair contractual terms imposed by a stronger party; the Commission has published a draft recommendation on voluntary model contractual terms.
- Cloud and software-as-a-service providers must make switching easier and be able to export data in a commonly used, machine-readable format.
The obligation to design products so that users can access data directly started to apply after 12 September 2026 (Ryan et al., 2024).
The Common European Agricultural Data Space
In its European Strategy for Data the Commission announced a Common European Agricultural Data Space to make trusted data sharing easier between private stakeholders, such as farmers, machinery companies and data service providers, and public authorities. It is being built step by step: first a preparatory action called AgridataSpace, then deployment, both funded by the Digital Europe Programme (European Commission, undated). The aim is for the farming sector to share and access data in a secure and trusted environment and so improve its economic and environmental performance (European Commission, 2021).
KVKK and GDPR: when is farm data personal data?
Under the GDPR, personal data is any information relating to an identified or identifiable living individual. Data that has been pseudonymised or encrypted but can still be re-identified remains personal data, while data that has been irreversibly anonymised falls outside the regulation. Information about legal persons, such as a company registration number, is not personal data (European Commission, undated). Türkiye's Personal Data Protection Law No. 6698 (KVKK) likewise defines personal data as any information relating to an identified or identifiable natural person (KVKK, 2016).
In practice, the field, yield or machine data of a self-employed farmer can count as personal data as long as it can be linked to that farmer. A company's corporate data, by contrast, falls under the Data Act and contract law rather than data protection law. The Data Act is aligned with the GDPR: where the user is not the person whose data is requested, personal data can only be shared on a valid legal basis such as consent (European Commission, 2025).
The KVKK requires the data controller, when collecting data, to state its identity, the purpose of processing, to whom the data may be transferred, the collection method and the legal basis. The data subject has the right to learn whether their data is processed, to request correction and deletion and to know the third parties the data was transferred to. The controller must take appropriate security measures and report a breach to the data subject and to the Board as soon as possible (KVKK, 2016).
Cross-border services: points to watch
- Organisations established outside the EU that offer goods or services, paid or free, to people in the EU fall under the GDPR; a technology provider based in Kozan that serves farmers in Larissa is covered (European Commission, undated).
- The Data Act does not oblige a data holder to share data with third parties based outside the EU (European Commission, 2025). A Larissa grower who wants to share machine data with an adviser in Türkiye is on safer ground downloading the data and sharing it directly.
- When a grower or company in Türkiye transfers personal data to a cloud abroad, Article 9 of the KVKK applies: without an adequacy decision, an appropriate safeguard such as a standard contract is needed, and a standard contract must be notified to the Authority within five working days of signature (KVKK, 2016).
Checklist for a digital service contract
| Question | What the contract should say | Basis |
|---|---|---|
| Who owns the data? | Your business is named as data originator; your rights are spelled out | EUCC |
| What data is collected? | Data types, volume and collection frequency; purpose of processing | Data Act; KVKK Art. 10 |
| How do I access it? | A simple request route and free access; download format | Data Act |
| Who is it shared with? | Third parties listed by name; your consent needed for any new sharing | EUCC; KVKK Art. 11 |
| Can the provider use the data itself? | No use of non-personal data without your agreement | Data Act |
| Where is it stored? | Country of the servers; legal basis for any transfer abroad (adequacy decision, standard contract) | KVKK Art. 9 |
| Anonymisation | Whether data used in pooled analysis is irreversibly anonymised | GDPR; EUCC |
| Security and breaches | Measures taken; when and how you will be told of a breach | KVKK Art. 12; EUCC |
| If I switch provider | Data handed over in a common, machine-readable format; deletion at the end of the contract | Data Act; KVKK Art. 11 |
| If the contract changes | Changes only by mutual agreement; whether the provider can change terms unilaterally | EUCC; Data Act |
Sources
- Ryan, M., Atik, C., Rijswijk, K., Bogaardt, M.-J., Maes, E. ve Deroo, E., 2024. The future of agricultural data-sharing policy in Europe: stakeholder insights on the EU Code of Conduct. Humanities and Social Sciences Communications 11:1197 (accessed 29 September 2026)
- Avrupa Komisyonu, 2025. Data Act explained (Shaping Europe's digital future) (accessed 29 September 2026)
- Avrupa Komisyonu, tarihsiz. Digitalising the EU agricultural sector (Shaping Europe's digital future) (accessed 29 September 2026)
- Avrupa Komisyonu, 2021. Common European data spaces for agriculture and mobility (etkinlik raporu, 13.12.2021) (accessed 29 September 2026)
- Avrupa Komisyonu, tarihsiz. Data protection explained: What is personal data? Who does the data protection law apply to? (accessed 29 September 2026)
- KVKK, 2016. 6698 sayılı Kişisel Verilerin Korunması Kanunu (Resmî Gazete 7.4.2016, sayı 29677; 2024 değişiklikleri işlenmiş metin), mevzuat.gov.tr (accessed 29 September 2026)
- EU CAP Network / Avrupa Komisyonu DG AGRI, 2025. Assessing digitalisation under the CAP Strategic Plans (tematik rapor, Kasım 2025) (accessed 29 September 2026)