The European Data Act Takes Effect in 2025. Your Cloud-Hosted Payroll Data Just Became a Compliance Risk.
Your payroll software holds the salary history of every person you've ever employed — every DSN declaration filed, every payslip generated, every social contribution calculation. You paid for that software every month to produce that data. As of September 2025, EU law says you have a legal right to get it back. And most cloud payroll vendors aren't ready to give it to you.
That's not a technology problem. It's a business model problem. And the EU Data Act just made it your problem too.
What the EU Data Act actually says
EU Regulation 2023/2854 — the Data Act — entered into force in January 2024 and applies fully from September 2025. The part most commentary skips: it's not just about big tech. Article 5 requires that any cloud service provider make your data available on request — in a format that works in any other system, not just theirs — at no extra charge. Article 29 goes further: from September 2027, switching fees for moving your data to a competing provider must be zero.
For a French employer using cloud payroll software, this translates directly. Your DSN history — the Déclaration Sociale Nominative, the monthly payroll declaration filed with net-entreprises.fr for every employee — your payslips, your social contribution records: all of it must be exportable. In a format another system can actually use. Within 30 days of your request.
Most cloud payroll vendors in France have not published a Data Act compliance roadmap. Payfit, valued at €1 billion and charging €49 per employee per month, had no public portable data export as of early 2025. Sage Paie generates partial exports in a proprietary format that another provider cannot import without specialist conversion. Your vendor's silence on this is not an oversight — it's the retention model working as designed.
Why payroll data is different
Running payroll is the one admin task where a mistake has immediate, personal consequences. A DSN error triggers a URSSAF inquiry — an investigation by the agency that collects social security contributions. A missing payslip gives an employee grounds for a labour dispute. French employers carry this anxiety every month, and then hand the data that proves their compliance to a vendor they cannot fully audit.
French labour law requires employers to retain payslips indefinitely — there is no statutory limit. DSN correction records must be kept for five years. URSSAF can audit payroll contributions for any of the past three years without advance warning. The Inspection du Travail, France's employment inspectorate, can review employment records with no notice requirement.
All of that compliance evidence sits on your payroll vendor's servers. When a vendor is acquired or closes, your access to that evidence changes overnight. When Gymlib, a French employee benefits platform, was acquired in 2023, employers using their payroll integration had to manually reconstruct months of data. Under the EU Data Act, that situation is now illegal — but only if you know your rights and exercise them before a problem forces the question.
The number on your invoice is not the real cost
Three employees on Payfit costs €147 per month, €1,764 per year. Five employees: €245 per month, €2,940 per year. What's not on that invoice: the three years of payroll history accumulating on Payfit's servers, exportable only in formats they support, accessible only while you keep paying.
"You've filed a DSN for every employee, every month, for years. That data belongs to you — not to the server hosting your payroll software."
Payroll vendors measure satisfaction by renewal rates and satisfaction scores — they ask customers how likely they are to recommend the service. They don't measure what actually matters to your compliance: can you extract your complete payroll history today, in a format your accountant or a competing provider can import, without data loss? Most employers have never asked this. The vendors have not volunteered the answer.
There's an irony most payroll vendors won't mention. The DSN format — the technical specification every French employer uses to file monthly declarations — is publicly documented by net-entreprises.fr. The government published the spec. Payroll vendors built software on top. You pay them monthly to file data in a format the government made free to use. That's the market: access to public infrastructure, sold back to you with a monthly subscription.
What the law now gives you
Ask your payroll vendor three things this week: a complete export of all DSN filings for the past five years in a format another provider can import; their Data Act portability compliance timeline; and what happens to your data if you stop paying.
If they cannot answer all three clearly, you are experiencing exactly what the EU Data Act was designed to address.
From September 2025, your cloud payroll vendor must provide your data in a portable format on request, within 30 days, at no charge. By September 2027, they cannot charge switching fees to move to a competitor. The CNIL — France's data protection authority, the Commission Nationale de l'Informatique et des Libertés — enforces GDPR on employee data. Parallel enforcement at the EU level covers business-generated operational data under the Data Act.
What most commentary misses: the software industry frames this regulation as a compliance burden on vendors. For French employers, it's the opposite — a legal right to demand back what you generated. Your DSN history is your compliance archive. It belongs where you decide, not where your vendor decided when you signed up.
What changes with Liberté
Liberté stores payroll data on infrastructure you control — not on Liberté's servers by default. DSN filings go directly to net-entreprises.fr via the official government connection. Your payslips, contribution calculations, and complete DSN history live on your infrastructure, in standard formats, portable from the first day you use the platform.
With this architecture, the regulation doesn't require a platform update — the design was built this way before the law required it. There's a meaningful difference between a platform that treats data portability as a legal obligation to be met and one that treats it as the baseline design. You feel that difference the first time a vendor is acquired or a filing goes wrong and someone needs to reconstruct three years of records.
Free, launching Q2 2026 in France. Join the waitlist at liberte.free.