The Data Governance Act (DGA) is Regulation (EU) 2022/868, the European Union law that creates trusted mechanisms for sharing data beyond the protection of personal data: the reuse of protected data held by public bodies, neutral data intermediation services and voluntary data altruism. In EU data regulation it is the first pillar of the European data strategy, and it has applied since 24 September 2023.
The DGA does not oblige anyone to share data. Instead, it defines how sharing must be organized when it happens, so that companies, researchers and citizens can rely on neutral intermediaries, clear conditions and supervision by national authorities. It therefore sits alongside the GDPR, which protects personal data, and the Data Act, which grants rights of access to data.
How the Data Governance Act is structured
The Data Governance Act is built around four main building blocks, each addressing a different obstacle to data sharing that the European Commission identified before the law was proposed in November 2020. The regulation was adopted on 30 May 2022 and became applicable after a 15-month transition period.
| Chapter | Subject | Who is addressed |
|---|---|---|
| Chapter II | Reuse of protected data held by public sector bodies | Public bodies and reusers |
| Chapter III | Data intermediation services | Neutral intermediaries and data marketplaces |
| Chapter IV | Data altruism | Not-for-profit organizations collecting donated data |
| Chapter VI | European Data Innovation Board | Commission and national authorities |
| Chapter VII | International access to non-personal data | Reusers, intermediaries and altruism organizations |
Each member state designates competent authorities that register intermediaries and altruism organizations, monitor compliance and impose penalties. The regulation also requires a single information point in every member state where reusers can find out which public datasets exist and under what conditions they may be requested.
Reuse of protected public sector data
Chapter II covers public data that the Open Data Directive excludes because it is protected by confidentiality: commercially confidential data, statistically confidential data, data covered by third-party intellectual property, and personal data. The DGA does not create a right to reuse such data; it sets conditions that apply when a public body chooses to allow reuse.
Typical conditions include anonymization or pseudonymization before release, access through a secure processing environment controlled by the public body, and contractual confidentiality obligations. Exclusive reuse arrangements are generally prohibited and, where exceptionally justified for a service of general interest, are limited in duration and must be published. Fees must be transparent, non-discriminatory and proportionate, with reductions possible for SMEs and research.
| Data category | Main risk | Typical safeguard |
|---|---|---|
| Commercially confidential data | Exposure of trade secrets | Aggregation or secure environment |
| Statistically confidential data | Identification of respondents | Remote access with output checking |
| Third-party intellectual property | Infringement of rights | Reuse only with rights cleared |
| Personal data | Re-identification | Anonymization plus GDPR legal basis |
Data intermediation services and neutrality
A data intermediation service connects data holders or data subjects with data users through technical, legal or other means, for example a data marketplace, a data pool shared among competitors or a personal data space. Providers must notify the competent authority before starting, and may then use the label of a data intermediation services provider recognized in the Union. Providers that already operated in September 2023 had until 24 September 2025 to comply.
The core obligation is neutrality. The provider may not use the data it brokers for its own purposes, must offer the intermediation through a legally separate entity, must set prices that do not depend on whether customers buy other services, and must apply fair, transparent and non-discriminatory access conditions. These rules aim to prevent large platforms from turning intermediation into a channel for collecting competitors’ data.
- Covered: marketplaces matching data holders and users, data cooperatives, personal data spaces.
- Not covered: cloud storage, analytics tools, closed groups such as one firm’s supply chain, and services that add substantial value to the data before selling it.
- Key obligation: structural separation of the intermediation business from other activities.
Data altruism and the European consent form
Data altruism is the voluntary sharing of data, without reward beyond compensation of costs, for objectives of general interest such as health research, climate action, mobility planning or official statistics. Organizations that collect such data can register as a recognized data altruism organization if they are not-for-profit, legally independent from any for-profit activity and transparent about how the data is used.
Registered organizations appear in a public EU register and must keep records of who processed the data and for what purpose. The regulation also provides for a European data altruism consent form, a common template that lets individuals give and withdraw consent in a consistent way across member states, while the GDPR remains the legal basis for any personal data involved.
How the DGA relates to neighboring data laws
The DGA is easily confused with other EU data instruments because they share vocabulary. The decisive difference is that the DGA regulates the trustworthiness of sharing mechanisms, while the other laws decide who may access which data.
| Instrument | Main question it answers | Binding effect |
|---|---|---|
| Data Governance Act | How can data be shared through trusted channels | Conditions for voluntary sharing |
| Data Act | Who may access data from connected products and services | Access and switching rights |
| Open Data Directive | Which open public data must be reusable | Reuse of non-protected public data |
| GDPR | How personal data must be protected | Rights and duties for personal data |
| Free Flow of Non-Personal Data Regulation | Can states require local storage | Ban on unjustified data localization |
The DGA also supports the common European data spaces, such as the European Health Data Space, by supplying the governance model for intermediaries. Its Chapter VII requires reusers, intermediaries and altruism organizations to take measures against unlawful third-country government access to non-personal data, a concern often discussed in relation to the US CLOUD Act. The Digital Omnibus package proposed in late 2025 would fold the DGA’s rules into the Data Act; until such a change is adopted, the regulation applies as written.
Compliance pitfalls and practical choices
Most compliance problems arise from misclassifying a service. A company that calls itself a data platform must decide whether it merely provides tools, which falls outside the DGA, or actively matches holders and users, which triggers notification and neutrality duties.
| Mistake | Consequence | Better approach |
|---|---|---|
| Running intermediation inside the main company | Breach of separation duty | Create a separate legal entity |
| Using brokered data for own analytics | Breach of neutrality | Strict purpose limitation and logging |
| Treating the DGA as a GDPR exemption | Unlawful processing | Secure a GDPR legal basis separately |
| Assuming public data must be released | Unfounded access claims | Check the body’s reuse decision first |
Penalties are set by national law and must be effective, proportionate and dissuasive, so their level differs between member states. Organizations operating in several countries should therefore notify in the member state of their main establishment and track how that authority interprets the rules.
The short version
The Data Governance Act is a set of ground rules for sharing data safely in the European Union. It does not force anyone to hand over data. It explains how sharing should work when people or organizations decide to do it.
Think of it as the rules for a trustworthy middleman. If a company runs a marketplace where others exchange data, it must stay neutral and may not secretly use that data for itself. If a charity collects data that people donate for medical research, it must be non-profit and open about what happens to the data. Public offices that hold sensitive records can let researchers use them, but only with strong privacy safeguards.
Where it makes a difference
A group of mid-sized agricultural machinery makers wants to pool anonymized soil and yield data from farms so that agronomists can build better fertilization models. None of the manufacturers trusts the others to hold the shared pool, so they commission an independent operator to run it.
Because the operator matches data holders with data users, it qualifies as a data intermediation service. It notifies the competent authority, sets up the pool as a separate legal entity, publishes uniform access terms and commits not to analyze the data for its own products. A university hydrology institute later requests access through a secure environment.
The result is a shared dataset that competitors are willing to contribute to, because the DGA’s neutrality rules make the intermediary accountable to a regulator rather than to any single participant.