---
title: "Re-using public-sector data: open data and high-value…"
description: "What the Open Data Directive, the high-value datasets regulation and Chapter II of the Data Governance Act let businesses do with data held by public bodies,…"
url: https://pitch.law/academy/re-using-public-sector-data-open-data-and-high-value-datasets
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# Re-using public-sector data: open data and high-value datasets

What the Open Data Directive, the high-value datasets regulation and Chapter II of the Data Governance Act let businesses do with data held by public bodies, on what terms, and how to ask for it.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

Three texts govern the re-use of public-sector data:

- the Open Data Directive, [Directive (EU) 2019/1024](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1024) of 20 June 2019, in force since 16 July 2019. Member States had to transpose it by 17 July 2021 ([Article 17](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_17)), and it replaced the 2003 directive on public sector information from that date ([Article 19](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_19)). As a directive it works through national law, so your rights against a given body come from the transposing law of its country;
- Commission [Implementing Regulation (EU) 2023/138](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R0138) on high-value datasets, in force since 9 February 2023 and applicable since 9 June 2024 ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R0138#art_6));
- Chapter II of the Data Governance Act, [Regulation (EU) 2022/868](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R0868), applicable since 24 September 2023, for public data that is protected.

### Who and what is covered

The directive covers existing documents held by public sector bodies: the State, regional and local authorities and bodies governed by public law. It also covers certain public undertakings (utilities, public transport operators, and air and sea carriers with public service obligations) and publicly funded research data ([Article 1](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_1)). "Document" means any content, whatever the medium ([Article 2](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_2)).

Article 1(2) excludes a long list. The main ones for business: documents outside the body's public task, documents in which third parties hold intellectual property rights, documents excluded from access for security or statistical or commercial confidentiality, documents restricted for personal data protection, logos and crests, and documents of broadcasters, most educational establishments and cultural establishments other than libraries, museums and archives. A public body may not use its database right to block or restrict re-use (Article 1(6)).

### The core duties

- **Re-use is the rule.** Documents within scope must be re-usable for commercial or non-commercial purposes ([Article 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_3)). For public undertakings and for documents in which libraries, museums and archives hold IP rights, the rules apply only where re-use is allowed.
- **Requests.** Where no other time limits apply, a body answers within 20 working days, extendable by 20 more for extensive or complex requests. A refusal must give reasons and the means of redress, including review by an impartial body ([Article 4](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_4)).
- **Formats.** Documents are made available, where possible, in open, machine-readable formats with metadata. There is no duty to create or adapt documents where that is disproportionate, or to keep producing a type of document for re-users. Dynamic data must be made available right after collection, via APIs and where relevant as a bulk download ([Article 5](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_5)).
- **Charges.** Re-use is free, though marginal costs of reproduction, provision, dissemination, anonymisation and protecting confidential information may be recovered. Bodies that must generate revenue, libraries, museums, archives and public undertakings may charge more, capped at cost plus a reasonable return on investment ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_6)). That return is at most 5 percentage points above the ECB's fixed interest rate (Article 2(16)). Standard charges must be published in advance ([Article 7](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_7)).
- **Conditions and licences.** Conditions must be objective, proportionate, non-discriminatory and justified by a public interest objective, and may not be used to restrict competition ([Article 8](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_8)). They must be the same for comparable re-use, including cross-border, and a body that uses its own data commercially must apply the same terms to itself ([Article 11](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_11)).
- **No exclusivity.** Contracts may not grant exclusive rights. The exception, for a service in the public interest, is reviewed at least every three years and must be published online two months before it takes effect ([Article 12](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_12)).
- **Research data** that is publicly funded and already published in a repository is re-usable, including commercially ([Article 10](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_10)), and free (Article 6(6)).

### High-value datasets

Annex I to the directive lists six thematic categories: geospatial, earth observation and environment, meteorological, statistics, companies and company ownership, and mobility ([Article 13](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_13)). The specific datasets must be free, machine-readable, provided via APIs and, where relevant, as a bulk download ([Article 14](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1024#art_14)). Member States could exempt revenue-dependent bodies from the free-of-charge rule for at most two years after the implementing act entered into force (Article 14(5)).

The implementing regulation fills in the details for datasets held by public sector bodies. Bodies must offer the datasets via APIs that match re-users' reasonable needs, publish API terms of use and quality-of-service criteria, document the API, name a point of contact and label the datasets as high-value in their metadata ([Article 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R0138#art_3)). The licence is CC0 or CC BY 4.0, or an equivalent or less restrictive open licence, and attribution may be required. The rules also cover machine-readable datasets created before 9 June 2024, and any exemption must be published online ([Article 4](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R0138#art_4)).

The Annex lists the datasets per category. For companies, for example, it covers basic company information (name, status, registration date, registered office, legal form, registration number, Member State and activity) and company documents and accounts, under CC BY 4.0 or a less restrictive licence, with extra conditions on personal data where relevant.

### Protected data: Chapter II of the DGA

Data that the directive excludes because of commercial or statistical confidentiality, third-party IP or personal data can sometimes still be re-used under the DGA ([Article 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_3)). Nothing obliges the body to allow it (Article 1(2)). Where it does:

- exclusive arrangements are banned, except for a general-interest service and then for at most 12 months ([Article 4](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_4));
- the body may require anonymisation or modification first, or access only in a secure processing environment, and may check results and block those that endanger third parties' rights. Re-users must keep the information confidential, may not re-identify anyone, and must announce any plan to transfer non-personal data to a third country ([Article 5](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_5));
- fees are cost-based, with discounts or free access possible for SMEs, start-ups, civil society and education ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_6));
- each Member State runs a single information point with a searchable asset list ([Article 8](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_8));
- a decision follows within two months, extendable by 30 days, with a right of redress ([Article 9](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0868#art_9)).

## In practice

A Belgian proptech start-up wants to show parcel boundaries and building footprints in its valuation app. Cadastral parcels and buildings are geospatial high-value datasets. It finds them through the metadata label, reads the API terms and quality-of-service criteria, and checks the licence. The Annex sets CC BY 4.0 or a less restrictive licence for these datasets; under CC BY 4.0 it must credit the source in the app. It writes the attribution and the API's availability limits into its own customer terms, so it does not promise more than the source delivers.

A compliance start-up builds a supplier-screening tool on company register data. The basic company information is a high-value dataset, but as soon as the tool also shows directors or shareholders who are individuals, it handles personal data. The Annex allows extra conditions on personal data, and the GDPR applies in full, so the start-up documents its legal basis and retention before it scales.

A mobility app asks a public transport operator for real-time vehicle positions. The operator is a public undertaking: it is not obliged to allow re-use, and if it does, it may charge above marginal cost. The app's best argument is non-discrimination: if the operator already gives the feed to one app, it must offer comparable terms to others.

A municipality offers a start-up exclusive access to its parking sensor data. Under Article 12 the municipality cannot grant that unless the exclusivity is necessary for a service in the public interest, and even then it must publish the deal online two months in advance. A non-exclusive licence is the safer deal.

A research spin-off needs detailed data a regional agency holds under statistical confidentiality. The route is a DGA request via the single information point. It should expect a secure processing environment and checks on its results, and plan its project timeline around the two-month decision period.

## Frequently asked questions

### Can a public body charge us for data?

For most data, only marginal costs. Bodies that must earn revenue, libraries, museums, archives and public undertakings may charge up to cost plus a reasonable return. High-value datasets and published research data are free.

### Can we use open data to train an AI model?

Usually, if the licence allows unrestricted re-use, as CC0 and CC BY 4.0 do. Personal data still needs a GDPR basis, and third-party IP is outside the directive. See [data for AI](https://pitch.law/academy/data-for-ai-data-spaces-and-licensing-training-data).

### Must a body create a dataset for us?

No. There is no duty to create or adapt documents where that is disproportionate, or to keep producing them (Article 5(3) and (4)).

### What if our request is refused?

The refusal must give reasons and name the means of redress, which includes review by an impartial body (Article 4(3) and (4)). Ask whether the DGA route applies if the data is protected.

## How this connects

Public data often ends up inside a commercial product, so the open licence, the API terms and your own customer contracts have to fit together. We help through [data licensing and sharing](https://pitch.law/solutions/data-licensing-sharing) and [data and database rights protection](https://pitch.law/solutions/data-and-database-rights-protection). We draft your customer terms in our [Document Studio](https://pitch.law/technologies/contract-studio), and test a body's re-use licence or a data partner's terms clause by clause with [Contract Review](https://pitch.law/technologies/clause-library-risk-review).

### At a glance

**Provisions cited**

- Directive (EU) 2019/1024: Articles 1 to 8, 10 to 14, 17 and 19, Annex I
- Implementing Regulation (EU) 2023/138: Articles 3, 4 and 6, Annex
- Regulation (EU) 2022/868: Articles 1, 3 to 6, 8 and 9

**Key dates**

- 16-07-2019: Open Data Directive in force
- 17-07-2021: transposition deadline
- 09-02-2023: high-value datasets regulation in force
- 24-09-2023: DGA applies
- 09-06-2024: high-value datasets regulation applies

**In this series**

- [The Data Governance Act: data intermediaries and data altruism](https://pitch.law/academy/data-governance-act-data-intermediaries-and-data-altruism)
- [Data for AI: data spaces and licensing training data](https://pitch.law/academy/data-for-ai-data-spaces-and-licensing-training-data)

**Related reading**

- [The EU Data Act](https://pitch.law/academy/eu-data-act)
- [Database rights and trade secrets](https://pitch.law/academy/database-rights-and-trade-secrets)

## In short

- Which public data you may re-use, and which is excluded
- Charges, licences and response times
- High-value datasets free via API since June 2024
- Protected public data under the Data Governance Act
- What to check before building a product on public data

## Related solutions

- [Solutions](https://pitch.law/solutions/data-licensing-sharing)
  ### [Data Licensing and Data Sharing](https://pitch.law/solutions/data-licensing-sharing)
  [Share or license data without giving away more than you meant to. Clear scope, settled ownership of what is derived from it, and the GDPR layer built in.](https://pitch.law/solutions/data-licensing-sharing)
- [Solutions](https://pitch.law/solutions/data-and-database-rights-protection)
  ### [Data and Database Rights Protection](https://pitch.law/solutions/data-and-database-rights-protection)
  [How to protect the data and databases you build, through database rights, trade secrets, copyright and the contracts that hold them together.](https://pitch.law/solutions/data-and-database-rights-protection)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/contract-studio)
  ### [Document Studio](https://pitch.law/technologies/contract-studio)
  [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio)
- [Technology](https://pitch.law/technologies/clause-library-risk-review)
  ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review)
  [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
  [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)