---
title: "The Data Governance Act: data intermediaries and data…"
description: "What Regulation (EU) 2022/868 asks of data marketplaces, data pools and data cooperatives, how a not-for-profit becomes a recognised data altruism…"
url: https://pitch.law/academy/data-governance-act-data-intermediaries-and-data-altruism
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# The Data Governance Act: data intermediaries and data altruism

What Regulation (EU) 2022/868 asks of data marketplaces, data pools and data cooperatives, how a not-for-profit becomes a recognised data altruism organisation, and where the rules on protected public-sector data fit in.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

The Data Governance Act (DGA) is [Regulation (EU) 2022/868](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R0868). It was adopted on 30 May 2022, published in the Official Journal on 3 June 2022 and entered into force on 23 June 2022. It has applied since 24 September 2023 ([Article 38](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_38)).

The [Data Act](https://pitch.law/academy/eu-data-act) gives users rights over data. The DGA works one level up: it sets rules for the go-betweens that make data sharing happen, and for organisations that collect data people donate for the common good. [Article 1](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_1) lists four building blocks: re-use of certain protected public-sector data (Chapter II), a notification regime for data intermediation services (Chapter III), voluntary registration of data altruism organisations (Chapter IV) and the European Data Innovation Board (Chapter VI). Data protection law prevails in case of conflict, and the DGA does not create a legal basis for processing personal data (Article 1(3)).

### Chapter II in brief: protected data held by public bodies

Chapter II covers data held by public sector bodies that is protected on grounds of commercial or statistical confidentiality, third-party intellectual property or personal data, insofar as it falls outside the Open Data Directive ([Article 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_3)). No public body is obliged to allow re-use (Article 1(2)). If it does, exclusive deals are banned except where needed for a service in the general interest, and then for no more than 12 months ([Article 4](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_4)). The body may require anonymisation or limit access to a secure processing environment ([Article 5](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_5)), fees must be cost-based ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_6)), and a decision is due within two months ([Article 9](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_9)). We cover that route in [re-using public-sector data](https://pitch.law/academy/re-using-public-sector-data-open-data-and-high-value-datasets).

### Chapter III: data intermediation services

**What counts.** A data intermediation service aims to establish commercial relationships for data sharing between an undetermined number of data subjects and data holders on one side and data users on the other ([Article 2(11)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_2)). [Article 10](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_10) names three types:

- intermediation between data holders and potential data users, including platforms or databases for the exchange or joint use of data and infrastructure that connects holders with users;
- intermediation between data subjects (or individuals offering non-personal data) and data users, in particular to help people exercise their GDPR rights;
- services of data cooperatives, structures of data subjects, one-person businesses or SMEs that negotiate data terms for their members (Article 2(15)).

**What does not count.** Article 2(11) excludes at least four things. First, services that obtain data, add substantial value to it and license the result without connecting holders and users (the classic data vendor). Second, services focused on intermediating copyright-protected content. Third, services used by a single data holder, or by multiple legal persons in a closed group such as a supply chain or a contractual collaboration, including services mainly meant to keep connected devices working. Fourth, non-commercial data sharing by public bodies. [Article 15](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_15) also leaves out not-for-profit data altruism, unless it aims to set up commercial relationships.

**Notification, not authorisation.** A provider notifies the competent authority and may then start ([Article 11](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_11)). The notification gives the name, legal form and ownership structure, the main establishment, a public website, contact persons, a description of the service with its Article 10 category, and the expected start date (Article 11(6)). One notification covers every Member State (Article 11(5)). A provider with several EU establishments falls under the Member State of its main establishment; a provider outside the EU must designate a legal representative in a Member State where it offers the service (Article 11(2) and (3)).

On request, the authority issues a standardised declaration within one week of a complete notification. It can also confirm compliance with Articles 11 and 12, after which the provider may call itself a "data intermediation services provider recognised in the Union" and use the common logo (Article 11(8) and (9)). Changes must be notified within 14 days, and stopping the activity within 15 days (Article 11(12) and (13)). The Commission keeps a public register (Article 11(10)).

**The Article 12 conditions.** This is where business models get tested ([Article 12](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_12)):

- _Neutrality and a separate entity_ (point (a)): the provider may use the data only to put it at the disposal of data users, and must provide the service through a separate legal person.
- _No bundling_ (point (b)): prices and terms may not depend on whether the customer also uses other services of the provider or a related entity.
- _Usage metadata_ (point (c)): data about how people use the service (date, time, geolocation, duration, connections) may only be used to develop the service, including fraud detection and cybersecurity, and must be given to data holders on request.
- _Formats_ (point (d)): pass data on in the format received; convert only for interoperability, at the user's request, where Union law requires it or to align with standards, with an opt-out for holders and data subjects.
- _Extra tools_ (point (e)): storage, curation, conversion, anonymisation or pseudonymisation only at the explicit request or with the approval of the holder or data subject.
- _Fair, transparent and non-discriminatory access_, including prices (point (f)), and procedures against fraud and abuse (point (g)).
- _Continuity_ if the provider becomes insolvent, with ways for holders and users to retrieve their data (point (h)).
- _Interoperability_ with other intermediation services, using open standards common in the sector (point (i)).
- _Security_ (points (j) to (l)): prevent unlawful transfer of or access to non-personal data, tell data holders without delay about unauthorised access, and give competitively sensitive information the highest level of security.
- _Duties towards data subjects_ (points (m) and (n)): act in their best interest, explain intended uses and standard terms before they consent, state any third-country jurisdiction of the intended use, and offer tools to give and withdraw consent.
- _A log_ of the intermediation activity (point (o)).

**Supervision and dates.** Authorities monitor compliance and may ask for information. After giving the provider 30 days to respond, they can impose financial penalties, suspend the service, or order it to stop after serious or repeated infringements ([Article 14](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_14)). Member States set penalties for breaches of Articles 11 and 12 ([Article 34](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_34)). Providers already active on 23 June 2022 had until 24 September 2025 to comply ([Article 37](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_37)).

### Chapter IV: data altruism

Data altruism is voluntary sharing of data, on the consent of data subjects or the permission of data holders, without any reward beyond compensation of costs, for objectives of general interest such as healthcare, climate, mobility, official statistics, public services or scientific research (Article 2(16)). Member States may adopt national policies ([Article 16](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_16)). Registration is voluntary.

To qualify, an entity must carry out data altruism activities, be a legal person pursuing general-interest objectives, operate on a not-for-profit basis and be legally independent of any for-profit entity, run the activity through a functionally separate structure, and comply with the Commission's rulebook within 18 months after the delegated acts establishing it enter into force ([Article 18](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_18), [Article 22](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_22)). The application lists, among other things, the statutes, sources of income, objectives and the nature of the data. The authority registers a compliant entity within 12 weeks and the registration is valid across the EU ([Article 19](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_19)). The entity may then use the label "data altruism organisation recognised in the Union" and the common logo, with a QR code linking to the Union register ([Article 17](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_17)).

Once registered, the organisation keeps records of everyone allowed to process the data, when, for what purpose and for what fee, and files an annual activity report ([Article 20](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_20)). It informs people before processing about the objectives and any processing in a third country, uses the data only for those objectives, avoids misleading marketing, offers tools to give and withdraw consent or permission, and secures non-personal data ([Article 21](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_21)). The Commission is to adopt a European data altruism consent form, modular per sector and GDPR-compliant ([Article 25](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_25)). An organisation that keeps breaching the rules after notice loses the label and is removed from the registers ([Article 24](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_24)).

### The European Data Innovation Board

The Board is a Commission expert group of the national authorities, the European Data Protection Board, the European Data Protection Supervisor, ENISA, the Commission and the EU SME Envoy ([Article 29](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_29)). It advises on consistent practice for public-sector re-use, intermediation and altruism, on cross-sector standards, and it proposes guidelines for common European data spaces ([Article 30](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_30)).

## In practice

A Belgian start-up builds a marketplace where logistics companies offer shipment data to any analytics firm that wants it, for a fee per deal. That is an Article 10(a) service. Before launch, it notifies the authority and moves the marketplace into its own company. If the group also sells its own analytics, the marketplace may not feed that business with customer data, and it may not offer cheaper marketplace fees to customers who also buy analytics. It also needs a log, a plan for continuity in case of insolvency, and terms that explain format conversions and offer the opt-out.

A machinery maker runs a portal where its own dealers and component suppliers exchange maintenance data under framework contracts. That is a closed group and falls outside Chapter III. If the maker later opens the portal to any paying data buyer, the analysis changes.

A company that buys raw sensor data, enriches it and sells licences to the result, without putting buyers in touch with the sources, is a data vendor excluded by Article 2(11)(a).

A patient association wants to collect data from members' wearables for research into a rare disease. It can register as a data altruism organisation if it meets Article 18, but registration does not replace the GDPR. It still needs a lawful basis, consent tools that let members withdraw, and the records and annual report of Article 20.

The contracts matter as much as the notification. An intermediary's terms for holders and users should cover its own purpose limit, usage metadata, format conversion and opt-out, incident notification, and exit with data retrieval. Inside a group, a written agreement should document the separation Article 12(a) requires.

## Frequently asked questions

### Is our data-sharing software an intermediation service?

The definition turns on establishing commercial relationships between an undetermined number of holders and users. The recitals explain that cloud storage, analytics or data-sharing software that only provides technical tools, without aiming to set up such relationships, is not meant to be covered. A platform that matches sellers and buyers of data usually is.

### Do we need approval before we start?

No. You notify and may then start (Article 11(4)). The authority can later act if you do not meet Article 12. The optional confirmation of compliance gives you the EU label.

### Can our company set up a data altruism organisation?

The organisation must be a not-for-profit legal person that is legally independent of any for-profit entity (Article 18(c)). A vehicle controlled by a company is unlikely to qualify. A company can, however, donate data to a recognised organisation.

### Does the DGA allow us to use personal data we receive?

No. It does not create a legal basis for processing (Article 1(3)). Every use of personal data still needs a basis under the GDPR, and the GDPR prevails.

## How this connects

The DGA is mostly a contract and structure question: who holds which data, who may use it for what, and in which entity. We help with the terms and the set-up through [data licensing and sharing](https://pitch.law/solutions/data-licensing-sharing) and [data and database rights protection](https://pitch.law/solutions/data-and-database-rights-protection). We draft holder and user terms in our [Document Studio](https://pitch.law/technologies/contract-studio), and check terms a partner sends you clause by clause with [Contract Review](https://pitch.law/technologies/clause-library-risk-review).

### At a glance

**Provisions cited**

- Regulation (EU) 2022/868: Articles 1 to 6, 9 to 12, 14 to 22, 24, 25, 29, 30, 34, 37 and 38

**Key dates**

- 23-06-2022: entry into force
- 24-09-2023: the DGA applies
- 24-09-2025: end of the transition for intermediaries active on 23-06-2022

**In this series**

- [Data for AI: data spaces and licensing training data](https://pitch.law/academy/data-for-ai-data-spaces-and-licensing-training-data)
- [Re-using public-sector data: open data and high-value datasets](https://pitch.law/academy/re-using-public-sector-data-open-data-and-high-value-datasets)
- [Non-personal data across borders](https://pitch.law/academy/non-personal-data-across-borders)

**Related reading**

- [The EU Data Act](https://pitch.law/academy/eu-data-act)
- [Database rights and trade secrets](https://pitch.law/academy/database-rights-and-trade-secrets)

## In short

- Whether your platform is a data intermediation service
- Notification and the Article 12 conditions, point by point
- Registration as a recognised data altruism organisation
- Protected public-sector data as context
- Dates, supervision and penalties

## Related solutions

- [Solutions](https://pitch.law/solutions/data-licensing-sharing)
  ### [Data Licensing and Data Sharing](https://pitch.law/solutions/data-licensing-sharing)
  [Share or license data without giving away more than you meant to. Clear scope, settled ownership of what is derived from it, and the GDPR layer built in.](https://pitch.law/solutions/data-licensing-sharing)
- [Solutions](https://pitch.law/solutions/data-and-database-rights-protection)
  ### [Data and Database Rights Protection](https://pitch.law/solutions/data-and-database-rights-protection)
  [How to protect the data and databases you build, through database rights, trade secrets, copyright and the contracts that hold them together.](https://pitch.law/solutions/data-and-database-rights-protection)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/contract-studio)
  ### [Document Studio](https://pitch.law/technologies/contract-studio)
  [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio)
- [Technology](https://pitch.law/technologies/clause-library-risk-review)
  ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review)
  [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
  [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)