The Data Governance Act: data intermediaries and data altruism

The legal framework

The Data Governance Act (DGA) is Regulation (EU) 2022/868. It was adopted on 30 May 2022, published in the Official Journal on 3 June 2022 and entered into force on 23 June 2022. It has applied since 24 September 2023 (Article 38).

The Data Act gives users rights over data. The DGA works one level up: it sets rules for the go-betweens that make data sharing happen, and for organisations that collect data people donate for the common good. Article 1 lists four building blocks: re-use of certain protected public-sector data (Chapter II), a notification regime for data intermediation services (Chapter III), voluntary registration of data altruism organisations (Chapter IV) and the European Data Innovation Board (Chapter VI). Data protection law prevails in case of conflict, and the DGA does not create a legal basis for processing personal data (Article 1(3)).

Chapter II in brief: protected data held by public bodies

Chapter II covers data held by public sector bodies that is protected on grounds of commercial or statistical confidentiality, third-party intellectual property or personal data, insofar as it falls outside the Open Data Directive (Article 3). No public body is obliged to allow re-use (Article 1(2)). If it does, exclusive deals are banned except where needed for a service in the general interest, and then for no more than 12 months (Article 4). The body may require anonymisation or limit access to a secure processing environment (Article 5), fees must be cost-based (Article 6), and a decision is due within two months (Article 9). We cover that route in re-using public-sector data.

Chapter III: data intermediation services

What counts. A data intermediation service aims to establish commercial relationships for data sharing between an undetermined number of data subjects and data holders on one side and data users on the other (Article 2(11)). Article 10 names three types:

• intermediation between data holders and potential data users, including platforms or databases for the exchange or joint use of data and infrastructure that connects holders with users;
• intermediation between data subjects (or individuals offering non-personal data) and data users, in particular to help people exercise their GDPR rights;
• services of data cooperatives, structures of data subjects, one-person businesses or SMEs that negotiate data terms for their members (Article 2(15)).

What does not count. Article 2(11) excludes at least four things. First, services that obtain data, add substantial value to it and license the result without connecting holders and users (the classic data vendor). Second, services focused on intermediating copyright-protected content. Third, services used by a single data holder, or by multiple legal persons in a closed group such as a supply chain or a contractual collaboration, including services mainly meant to keep connected devices working. Fourth, non-commercial data sharing by public bodies. Article 15 also leaves out not-for-profit data altruism, unless it aims to set up commercial relationships.

Notification, not authorisation. A provider notifies the competent authority and may then start (Article 11). The notification gives the name, legal form and ownership structure, the main establishment, a public website, contact persons, a description of the service with its Article 10 category, and the expected start date (Article 11(6)). One notification covers every Member State (Article 11(5)). A provider with several EU establishments falls under the Member State of its main establishment; a provider outside the EU must designate a legal representative in a Member State where it offers the service (Article 11(2) and (3)).

On request, the authority issues a standardised declaration within one week of a complete notification. It can also confirm compliance with Articles 11 and 12, after which the provider may call itself a "data intermediation services provider recognised in the Union" and use the common logo (Article 11(8) and (9)). Changes must be notified within 14 days, and stopping the activity within 15 days (Article 11(12) and (13)). The Commission keeps a public register (Article 11(10)).

The Article 12 conditions. This is where business models get tested (Article 12):

• Neutrality and a separate entity (point (a)): the provider may use the data only to put it at the disposal of data users, and must provide the service through a separate legal person.
• No bundling (point (b)): prices and terms may not depend on whether the customer also uses other services of the provider or a related entity.
• Usage metadata (point (c)): data about how people use the service (date, time, geolocation, duration, connections) may only be used to develop the service, including fraud detection and cybersecurity, and must be given to data holders on request.
• Formats (point (d)): pass data on in the format received; convert only for interoperability, at the user's request, where Union law requires it or to align with standards, with an opt-out for holders and data subjects.
• Extra tools (point (e)): storage, curation, conversion, anonymisation or pseudonymisation only at the explicit request or with the approval of the holder or data subject.
• Fair, transparent and non-discriminatory access, including prices (point (f)), and procedures against fraud and abuse (point (g)).
• Continuity if the provider becomes insolvent, with ways for holders and users to retrieve their data (point (h)).
• Interoperability with other intermediation services, using open standards common in the sector (point (i)).
• Security (points (j) to (l)): prevent unlawful transfer of or access to non-personal data, tell data holders without delay about unauthorised access, and give competitively sensitive information the highest level of security.
• Duties towards data subjects (points (m) and (n)): act in their best interest, explain intended uses and standard terms before they consent, state any third-country jurisdiction of the intended use, and offer tools to give and withdraw consent.
• A log of the intermediation activity (point (o)).

Supervision and dates. Authorities monitor compliance and may ask for information. After giving the provider 30 days to respond, they can impose financial penalties, suspend the service, or order it to stop after serious or repeated infringements (Article 14). Member States set penalties for breaches of Articles 11 and 12 (Article 34). Providers already active on 23 June 2022 had until 24 September 2025 to comply (Article 37).

Chapter IV: data altruism

Data altruism is voluntary sharing of data, on the consent of data subjects or the permission of data holders, without any reward beyond compensation of costs, for objectives of general interest such as healthcare, climate, mobility, official statistics, public services or scientific research (Article 2(16)). Member States may adopt national policies (Article 16). Registration is voluntary.

To qualify, an entity must carry out data altruism activities, be a legal person pursuing general-interest objectives, operate on a not-for-profit basis and be legally independent of any for-profit entity, run the activity through a functionally separate structure, and comply with the Commission's rulebook within 18 months after the delegated acts establishing it enter into force (Article 18, Article 22). The application lists, among other things, the statutes, sources of income, objectives and the nature of the data. The authority registers a compliant entity within 12 weeks and the registration is valid across the EU (Article 19). The entity may then use the label "data altruism organisation recognised in the Union" and the common logo, with a QR code linking to the Union register (Article 17).

Once registered, the organisation keeps records of everyone allowed to process the data, when, for what purpose and for what fee, and files an annual activity report (Article 20). It informs people before processing about the objectives and any processing in a third country, uses the data only for those objectives, avoids misleading marketing, offers tools to give and withdraw consent or permission, and secures non-personal data (Article 21). The Commission is to adopt a European data altruism consent form, modular per sector and GDPR-compliant (Article 25). An organisation that keeps breaching the rules after notice loses the label and is removed from the registers (Article 24).

The European Data Innovation Board

The Board is a Commission expert group of the national authorities, the European Data Protection Board, the European Data Protection Supervisor, ENISA, the Commission and the EU SME Envoy (Article 29). It advises on consistent practice for public-sector re-use, intermediation and altruism, on cross-sector standards, and it proposes guidelines for common European data spaces (Article 30).

In practice

A Belgian start-up builds a marketplace where logistics companies offer shipment data to any analytics firm that wants it, for a fee per deal. That is an Article 10(a) service. Before launch, it notifies the authority and moves the marketplace into its own company. If the group also sells its own analytics, the marketplace may not feed that business with customer data, and it may not offer cheaper marketplace fees to customers who also buy analytics. It also needs a log, a plan for continuity in case of insolvency, and terms that explain format conversions and offer the opt-out.

A machinery maker runs a portal where its own dealers and component suppliers exchange maintenance data under framework contracts. That is a closed group and falls outside Chapter III. If the maker later opens the portal to any paying data buyer, the analysis changes.

A company that buys raw sensor data, enriches it and sells licences to the result, without putting buyers in touch with the sources, is a data vendor excluded by Article 2(11)(a).

A patient association wants to collect data from members' wearables for research into a rare disease. It can register as a data altruism organisation if it meets Article 18, but registration does not replace the GDPR. It still needs a lawful basis, consent tools that let members withdraw, and the records and annual report of Article 20.

The contracts matter as much as the notification. An intermediary's terms for holders and users should cover its own purpose limit, usage metadata, format conversion and opt-out, incident notification, and exit with data retrieval. Inside a group, a written agreement should document the separation Article 12(a) requires.

Frequently asked questions

Is our data-sharing software an intermediation service?

The definition turns on establishing commercial relationships between an undetermined number of holders and users. The recitals explain that cloud storage, analytics or data-sharing software that only provides technical tools, without aiming to set up such relationships, is not meant to be covered. A platform that matches sellers and buyers of data usually is.

Do we need approval before we start?

No. You notify and may then start (Article 11(4)). The authority can later act if you do not meet Article 12. The optional confirmation of compliance gives you the EU label.

Can our company set up a data altruism organisation?

The organisation must be a not-for-profit legal person that is legally independent of any for-profit entity (Article 18(c)). A vehicle controlled by a company is unlikely to qualify. A company can, however, donate data to a recognised organisation.

Does the DGA allow us to use personal data we receive?

No. It does not create a legal basis for processing (Article 1(3)). Every use of personal data still needs a basis under the GDPR, and the GDPR prevails.

How this connects

The DGA is mostly a contract and structure question: who holds which data, who may use it for what, and in which entity. We help with the terms and the set-up through data licensing and sharing and data and database rights protection. We draft holder and user terms in our Document Studio, and check terms a partner sends you clause by clause with Contract Review.

At a glance

Provisions cited

• Regulation (EU) 2022/868: Articles 1 to 6, 9 to 12, 14 to 22, 24, 25, 29, 30, 34, 37 and 38

Key dates

• 23-06-2022: entry into force
• 24-09-2023: the DGA applies
• 24-09-2025: end of the transition for intermediaries active on 23-06-2022

In this series

• Data for AI: data spaces and licensing training data
• Re-using public-sector data: open data and high-value datasets
• Non-personal data across borders

Related reading

• The EU Data Act
• Database rights and trade secrets