DGA

The Data Governance Act builds trust in data sharing. It sets conditions for re-using certain protected data held by public bodies, creates a regime of neutrality for data intermediation services that connect data holders with data users, and lets organizations register as data altruism organizations that collect data made available for the general interest.

It has applied since 24 September 2023. Its impact on most businesses is indirect, but it matters to anyone building a data marketplace, data sharing pool or consent-based data platform.

• Data intermediation services that establish commercial relationships for data sharing between data holders or data subjects and data users, such as data marketplaces and data sharing pools.
• Organizations seeking recognition as data altruism organizations.
• Public sector bodies that allow re-use of data protected by commercial or statistical confidentiality, intellectual property or data protection.
• Services that add substantial value to data, such as analytics products, are generally not data intermediation services.

Member states set penalties for breaches by data intermediation services and data altruism organizations. Competent authorities can suspend a service or remove an organization from the register.

1. Check whether any service you run is data intermediation, as defined, rather than a value-adding data product.
2. If it is, notify the competent authority before starting and set up structural separation.
3. Limit use of the data to making it available to data users.
4. Offer fair, transparent and non-discriminatory access and publish the terms.
5. If you re-use public sector data, meet the conditions the public body sets, such as secure processing environments.