EU Data Governance Act — Regulation (EU) 2022/868 (data-intermediation notification, public-sector data re-use, data-altruism organisations)

Mechanism

The Data Governance Act establishes four interlocking regimes:

1. Public-Sector Data Re-Use (Chapter II, Arts 3–10)

Public-sector bodies holding data protected by commercial confidentiality, statistical confidentiality, intellectual-property rights, or personal-data rules may make that data available for re-use under harmonised conditions. Key elements:

• Single information points in each member state must provide a

searchable register of available data assets and route re-use requests to the competent sectoral body.

• Exclusivity agreements between public-sector bodies and private

re-users are prohibited (or capped at a maximum of 12 months), preventing capture of public data by a single commercial player.

• Non-personal protected data (e.g., commercially sensitive

statistical records, trade-secret-protected public contracts) may be made available under conditions ensuring technical protection (anonymisation, aggregation) but only within the EU or to countries that offer equivalent data-protection safeguards (Art 5(12) — extending GDPR-style transfer concerns to non-personal data for the first time at EU level).

2. Data-Intermediation-Services Notification Regime (Chapter III, Arts 11–18)

Any legal entity providing data-sharing services between data holders and data users (B2B, B2C, or cooperative/data-pooling models) must:

• Notify the national competent authority before operating.
• Maintain structural separation between the intermediation service

and any own-account data business (prohibiting simultaneous intermediation and use of the data intermediated).

• Offer access on fair, transparent, and non-discriminatory terms

including non-exclusive licences and cost-oriented pricing.

• Not use data for purposes beyond facilitating the intermediation

transaction.

The regime creates a new regulated category in EU financial-market terms analogous to AIF or payment-institution licensing — a notification-based operating licence for data-broker and data- marketplace platforms. National competent authorities maintain a public register of notified providers (updated in the European Data Innovation Board cross-border register under Art 29).

3. Data-Altruism-Organisation Recognition (Chapter IV, Arts 19–29)

Voluntary "recognised data-altruism organisations" (RDAOs) may collect and aggregate data from natural persons and legal entities for general-interest research/innovation purposes. Key elements:

• EU-wide RDAO status granted by national authority with mutual

recognition across member states.

• Standardised consent forms for personal data donated to RDAOs,

overseen by national data-protection authorities to ensure GDPR compliance.

• Annual transparency reporting on data volumes, purposes, and

downstream re-use.

• Designed to enable federated medical-research databases, mobility

data pools, agricultural sensor data aggregation, and smart-city data cooperatives for academic/public-interest users.

4. European Data Innovation Board (Chapter V, Arts 30–32)

Commission-chaired expert group composed of national competent authorities, EDPB, ENISA, and sectoral representatives. Core functions:

• Advise the Commission on cross-border data-space interoperability

standards and semantic-interoperability frameworks.

• Co-ordinate data-intermediation notification registers across member

states.

• Develop guidelines on international-transfer safeguards for

non-personal data (Art 5(12) assessments).

• Support the Commission's sectoral common-data-space programme

(European Health Data Space, Agri-Data Space, Finance Data Space, etc.).

Relationship to sister statutes

The DGA sits in the EU data-economy legislative sequence as:

The DGA is the parent statute for the common-data-space programme and the foundational governance framework enabling subsequent horizontal (Data Act) and sectoral (EHDS, Open Finance) data-sharing instruments.

Downstream implications

• Data-marketplace and data-broker operators across the EU are now

in a notification-based regulatory perimeter — compliance overhead comparable to PSD2 for fintechs: new registration obligations, structural-separation requirements, and annual reporting. New entrant barrier but also legitimacy signal for incumbents.

• US cloud hyperscalers (AWS, Azure, GCP) face the Art 5(12)

international-transfer constraint on non-personal public-sector data: a government dataset licensed for re-use under the DGA may not flow to a US-based cloud environment without an adequacy finding or technical safeguards — a soft data-localization pressure that compounds the GDPR transfer constraints.

• EU common-data-spaces (Health, Agriculture, Finance, Mobility)

are all predicated on the DGA notification and altruism frameworks as the enabling layer. Delays in EDIB guideline adoption flow through to delays in sectoral space launch timelines.

• RDAOs create a new institutional actor type in EU research

ecosystems — federated health-data consortia (e.g., 1+Million Genomes initiative), mobility-data cooperatives, and agricultural IoT-data pools now have a formal legal wrapper for cross-border consent aggregation.

Open questions

• EDIB international-transfer guidance (Art 5(12)) remains

incomplete as of mid-2026; the practical boundary between "technical-safeguard" adequacy and formal third-country adequacy decisions for non-personal data is unresolved.

• Structural-separation enforcement in the first cohort of

notified data intermediaries has not been tested by a major Commission or national-authority enforcement action; the grey zone between "pure intermediation" and "own-account data use" (especially in AI-training contexts) is live controversy.

• RDAO scaling — as of 2026 only a small number of RDAOs have

obtained national recognition; cross-border registry under EDIB has been slow to operationalise.