Digital & AI
Regulation (EU) 2022/868
Data Governance Act
Data Governance Act
Rules for sharing data that is not a free-for-all: public-sector reuse, trusted data intermediaries, and altruism — with a ban on using the intermediary hat to exploit the data.
Does this hit me?
You may be asked to donate data for research through a recognised altruism body. An ‘intermediary’ that is also selling your profile is the thing this file tries to stop.
Check in the wizardPick a country in the header to see who enforces this at home. Union text is not the last word for directives.
How it rolls in
Jun 2022
Entered into force.
Sep 2023
Applies.
Why it exists
The Union wanted more data to move without copying the surveillance-ad model. The Act is the plumbing; the Data Act is the access right.
What actually changes
- Public-sector bodies must have a route to reuse protected data (confidential, IP, personal) under conditions.
- Data intermediation services need notification and independence — they cannot monetise the data they pass.
- Data altruism organisations can be recognised for purposes of general interest.
- International transfers of non-personal public-sector data get a safeguard overlay.
How it hits you
You may be asked to donate data for research through a recognised altruism body. An ‘intermediary’ that is also selling your profile is the thing this file tries to stop.
Heard this? Not quite.
Claim: This replaces the GDPR.
Personal data in a DGA scheme still needs a GDPR lawful basis. The DGA is extra plumbing, not a new basis.
Latest official statements
All EU NewsNo tagged Commission, Parliament or Council statement in the current feeds.
Board one-pager
Board one-pager
Who this is for: EU digital, product and data teams. Regulation (EU) 2022/868. Applies since 24 September 2023.
Scope
- You offer data intermediation as a service, run a data-altruism scheme, or you are a public body holding protected data that others want to reuse.
First 90 days
- This month: Decide whether any product is intermediation vs. a controller using its own data.
- If intermediating: Notify the competent authority and split the commercial hat from the pipe.
Penalties: Fines and withdrawal of intermediary status under national rules implementing the DGA.
For companies
How to stay on the right side of this file
Practical order of work, not a substitute for counsel. Public-sector reuse desks, data intermediaries, and recognised altruism organisations.
You are probably
Public-sector reuse desks, data intermediaries, and recognised altruism organisations.
Effort
A scoped programme this year beats a scramble at the apply-date.
Budget
SME: owner time plus one honest vendor. Large: a named lead, not a taskforce slide.
Roles in this file
The same company can wear more than one hat. Classify before you buy a tool.
Legal
This pack names Legal as an owner of early work.
Decide whether any product is intermediation vs. a controller using its own data.
Compliance
This pack names Compliance as an owner of early work.
Notify the competent authority and split the commercial hat from the pipe.
Are you in scope?
This year's work- You offer data intermediation as a service, run a data-altruism scheme, or you are a public body holding protected data that others want to reuse.
Usually not, if
- A company that only uses data it already controls for its own purposes.
First moves
- This monthDecide whether any product is intermediation vs. a controller using its own data.Legal
- If intermediatingNotify the competent authority and split the commercial hat from the pipe.Compliance
- Do not call a SaaS analytics tool a ‘data space’ unless you actually pass third-party data without using it.
If you skip this
- Branding a commercial lake as altruism.
Done looks like
- Notification
- Independence policy
- Reuse conditions if you are public
Keep this evidence
- Notification
- Independence policy
- Reuse conditions if you are public
Ask vendors
- Are you a notified intermediary? Can you use our data for your own training?
Where programmes usually break
- Branding a commercial lake as altruism.
Call counsel when
- Fines and withdrawal of intermediary status under national rules implementing the DGA.
- A supervisor letter, a dawn information request, or a deal that warrants this file.
Enforcement
Fines and withdrawal of intermediary status under national rules implementing the DGA.
National competent authorities; Commission register.
Need a stack, not one file? Open the company desk
Professional briefing
Legal architecture and duties
For counsel, compliance, and policy teams. Not advice. The Official Journal still wins.
- Instrument
- Regulation
- Legal basis
- Art 114 TFEU · Regulation (EU) 2022/868
- Application
- Directly applicable since 24 September 2023.
Plumbing for data reuse and intermediation, not a new GDPR lawful basis. The independence of intermediaries is the enforcement snack. Pair with the Data Act for access rights.
How the file is built
Ch II public-sector reuse
Protected data (confidentiality, IP, personal) can be reused under conditions — not FOI.
Ch III intermediaries
Notification, neutrality, no use of the data for the intermediary’s own purposes.
Operators
| Role | Who | Core duties |
|---|---|---|
| Data intermediation service | Establishes commercial relationships for data sharing. | Notify, stay independent, keep logs. |
| Public-sector body | Holds protected data. | Reuse conditions, single information point. |
Scope
Services provided in the Union; public-sector data held by Union and Member State bodies as specified.
In
- Public-sector protected data
- Intermediation of personal and non-personal data
- Data altruism
Out, or narrower than assumed
- Pure controllers using their own data
- Competition-law exchanges already regulated elsewhere as carved out
Operative provisions
| Anchor | Rule | What it does in practice |
|---|---|---|
| Arts 10–15 | Intermediary notification and conditions. | A data marketplace that trains on the traffic is out of bounds. |
Secondary law and guidance
- Commission implementing acts on registers
- EDPB/EDPS opinions on the personal-data overlay
National layer. Competent authorities and public-sector reuse desks are national.
How it sits with other files
Enforcement and private rights
Who
National competent authorities.
Tools
Fines, withdrawal of status.
Private rights
Contractual; GDPR rights if personal data.
Risk register
| Risk | Signal | Control |
|---|---|---|
| False intermediary | Product uses customer data for own training while calling itself a space | Legal characterisation before launch. |
Open issues
- What counts as intermediation vs a processor.
- Altruism washing.
Primary sources
Rules for sharing data that is not a free-for-all: public-sector reuse, trusted data intermediaries, and altruism — with a ban on using the intermediary hat to exploit the data.
You feel it now
This is a this-year file.
Next
Applies since 24 September 2023
Where it lands
| Channel | People | Companies |
|---|---|---|
| Intermediation is a regulated hat | You may be asked to donate data for research through a recognised altruism body. An ‘intermediary’ that is also selling your profile is the thing this file tries to stop. | You cannot broker others’ data and harvest it for your own model. |
| Public-sector protected data | You may be asked to donate data for research through a recognised altruism body. An ‘intermediary’ that is also selling your profile is the thing this file tries to stop. | A reuse route exists; it is not a FOI dump and not a GDPR bypass. |
Who gains
Researchers and firms that need a lawful way to use public-sector protected data.
Who pays
Intermediaries (process) and public bodies (reuse desks).
Who pays
Intermediaries (process) and public bodies (reuse desks).
Who benefits
Researchers and firms that need a lawful way to use public-sector protected data.
Read the official text