🇪🇺Data Governance Act

← Back to laws in European Union

The Data Governance Act builds trust in data sharing

The Data Governance Act is an EU law designed to make more data available for use and re-use while protecting the rights and interests attached to that data. It does not replace the GDPR. It sits beside the GDPR and creates a governance framework for data sharing, especially where data is valuable but difficult to release because it may contain personal data, confidential business information, statistical confidentiality or third-party intellectual property.

The law is part of the European Union's wider data strategy. Its focus is not only privacy compliance in the narrow sense, but the creation of trusted routes for data access, data intermediation, data altruism and cross-sector data spaces. For organisations, the practical question is whether they are using data, sharing data, operating a data marketplace, supporting data altruism, or seeking access to protected public sector data in a way that brings them within the Act.

What the Act covers

Article 1 sets out four main areas. The Act lays down conditions for the re-use of certain categories of data held by public sector bodies, creates a notification and supervisory framework for data intermediation services, creates a voluntary registration framework for data altruism organisations, and establishes the European Data Innovation Board.

The Act applies directly across EU Member States. It entered into force after publication in the Official Journal and applies from 24 September 2023. It is important to read it as a governance law: it tells organisations how trusted data sharing structures should be built, supervised and operated.

Re-use of protected public sector data

One of the Act's most important contributions is a structured regime for the re-use of certain protected data held by public sector bodies. This does not mean that every public body must release such data. The Act expressly does not create a general obligation on public sector bodies to allow re-use. Instead, where re-use is allowed, it gives a framework for conditions, safeguards and request handling.

The protected categories under Article 3 include data protected because of commercial confidentiality, statistical confidentiality, third-party intellectual property rights, and personal data that falls outside the open data regime. This is particularly relevant for research, innovation, public policy, health, mobility, energy, environment and other sectors where public sector datasets can be valuable but cannot simply be published as open data.

Conditions for re-use

Article 5 requires conditions for re-use to be non-discriminatory, transparent, proportionate and objectively justified. Public sector bodies must preserve the protected nature of the data. In practice, this may mean anonymisation for personal data, modification or aggregation for confidential information, secure processing environments, remote access controls, on-premise secure access, confidentiality obligations and restrictions on re-identification.

The Act also addresses exclusive arrangements. Agreements or practices that grant exclusive rights for re-use of protected public sector data are generally prohibited, with a limited exception where exclusivity is necessary for a service or product in the general interest and the strict conditions in the Act are satisfied.

Single information points and request handling

The Act requires Member States to support access through single information points. These points are meant to help potential re-users identify available protected datasets and understand how to request access. The Commission also establishes a European single access point offering a searchable electronic register of data available through national single information points.

Article 9 deals with request procedures. Unless national law sets shorter limits, competent public sector bodies or competent bodies must decide on requests for re-use within two months. Exceptionally extensive and complex requests may be extended by up to 30 days, with reasons for the delay.

Data intermediation services

The Act creates a regulatory framework for data intermediation services. These services are designed to help connect data holders, data subjects and data users for the purpose of data sharing. Examples may include data marketplaces, data sharing ecosystems and data pools where multiple participants make data available under defined conditions.

Article 10 covers three broad types of data intermediation services: services between data holders and potential data users, services between data subjects or natural persons and data users, and services of data cooperatives. The Act distinguishes these services from ordinary cloud storage, analytics tools, email services, browser tools or closed internal data sharing arrangements that do not aim to establish commercial data-sharing relationships between an open or undetermined set of parties.

Why neutrality matters

The Data Governance Act is concerned with trust. A data intermediary should not simply use the data exchanged through it for its own unrelated purposes. The Act's model separates data provision, intermediation and use so that data holders and data subjects can participate without losing control or being pushed into unfair data exploitation.

For businesses, this means that a platform that calls itself a data marketplace, data exchange, data cooperative or personal data space should examine whether it is a regulated data intermediation service. Product design, terms of service, group structures, pricing, data use limits, technical tools and conflict-of-interest controls all matter.

Data altruism

The Act also recognises data altruism. This means the voluntary sharing of data, based on consent for personal data or permission for non-personal data, without seeking a reward beyond compensation for the costs of making the data available, for objectives of general interest. Examples of general interest objectives may include healthcare, combating climate change, improving mobility, official statistics, public services, public policy making and scientific research in the general interest.

Registration as a recognised data altruism organisation is voluntary, but it gives organisations a trusted EU label where they meet the Act's requirements. Recognised organisations must operate under transparency, record-keeping, security and rights-protection obligations. They must not use data for objectives other than the general interest purposes for which the data subject or data holder allowed the processing.

Relationship with the GDPR and other EU laws

The Data Governance Act does not create a new legal basis for processing personal data. Where personal data is involved, the GDPR and other EU or national data protection laws continue to apply. If there is a conflict between the Data Governance Act and EU or national personal data protection law, the data protection law prevails.

This point is central. A public sector re-use arrangement, a data intermediary or a data altruism organisation may satisfy the DGA and still need a separate GDPR analysis for lawful basis, transparency, data subject rights, security, DPIAs, controller-processor roles and international transfers. The DGA makes trusted sharing easier; it does not remove privacy law obligations.

Third-country access and protected non-personal data

The Act includes safeguards for protected non-personal data held in the Union. It addresses transfers to third countries and access requests from third-country courts, tribunals or administrative authorities. The purpose is to prevent protected non-personal data, including commercially sensitive or intellectual-property-sensitive data, from being exposed in ways that conflict with Union or Member State law.

Organisations involved in re-use, intermediation or recognised data altruism should therefore check not only where data is stored, but also who may legally compel access to it. Contracts, technical safeguards, encryption, access controls and third-country transfer review should form part of the governance design.

Supervision, complaints and penalties

Member States must designate competent authorities for data intermediation services and for the registration of data altruism organisations. Those authorities must be legally distinct from, and functionally independent of, the providers and organisations they supervise. Natural and legal persons have a right to lodge complaints in relation to matters within the scope of the Act.

Article 34 requires Member States to lay down penalties for infringements of specified obligations, including obligations relating to third-country transfers of non-personal data, notification by data intermediation services providers, conditions for providing data intermediation services and conditions for registration as a recognised data altruism organisation. Penalties must be effective, proportionate and dissuasive.