Navigating the EU Data Act with GitLab

Navigating the EU Data Act with GitLab

Important Notice

The information in this summary is intended as an overview and outline of certain EU Data Act related matters and it does not provide legal advice and shall not be construed or used as such, nor does this document form part of, create or amend any agreement, representations, warranties or any other obligation between GitLab and its customers. Customers are advised to seek and rely only on independent legal advice on any EU Data Act related matter. GitLab shall have no liability arising from any errors, misstatements or omissions in the content of this summary.

Regulatory Context

The EU Data Act entered into force on January 11, 2024, and is a key pillar of the European data strategy that will make a significant contribution to the Digital Decade’s objective of advancing digital transformation. Most of the new rules will apply as of September 12, 2025.

The Data Act establishes harmonized rules on fair access to and use of data across the EU, with the primary goal of creating a fair distribution of value from data by establishing clear rules for accessing and using data within the European data economy.

The Data Act requires data processing service providers like GitLab to facilitate user data access, ensure fair sharing terms, remove switching barriers (commercial, technical, contractual, and organizational), respond to public sector data requests, and enable customer migration to other providers—obligations that apply to any provider serving EU customers regardless of their location.

GitLab’s Approach

This document helps customers understand how GitLab has prepared for and addresses EU Data Act compliance requirements, providing transparency into our approach as data service providers adapt their contractual frameworks and data governance strategies.

The information in this document was current as of August 2025.

How GitLab addresses the key requirements of the EU Data Act

Requirement Description Data Act Reference GitLab’s Implementation

Technical Protection Measures on Unauthorised Use or Disclosure of Data

Art. 11 GitLab implements industry standard safeguards to protect data held on cloud infrastructures in the EU, and its single, unified Trust Center provides access to customers to comprehensive security and privacy collateral and an interactive knowledge base.

Provisions around facilitating switching between data processing service providers, transparency and pre-contractual information

Art. 23 & 25 GitLab ensures no commercial, technical, contractual or organizational impediments to customer transitions, enables standardized data exports in machine-readable formats, with GitLab’s Subscription Agreement including appropriate measures supporting such transitions.

Through its Privacy Statement, documentation and Data Processing Addendum, GitLab provides transparent information about our data processing activities, including what data we process, how it’s stored, and how customers can access and control their data.

Information on switching and porting methods and formats, as well as details of data structures, data formats and the relevant standards and open interoperability specifications of exportable data

Art. 26 GitLab makes available current information regarding data porting procedures for our services, including available methods and formats. Users can access comprehensive porting procedures through our Project Import/Export documentation and API documentation. Our export functionality provides data in structured formats as detailed in our development documentation.