EU Data Governance Act

Applies To

Overview

Regulation (EU) 2022/868, the Data Governance Act (DGA), entered into force on 23 June 2022 and has applied since 24 September 2023. It is one of the foundational instruments of the European Data Strategy, designed to increase trust in data sharing and to lower the cost and effort of making data available for re-use beyond its original purpose. Unlike the EU Data Act, which governs access to data generated by connected products, the DGA focuses on the institutional and organisational infrastructure that enables voluntary data sharing. It creates a mandatory notification and registration regime for data intermediary services, meaning neutral platforms that broker business-to-business and business-to-consumer data exchange without acquiring commercial rights over the data. It establishes conditions under which public sector bodies may permit re-use of data subject to existing legal protections, including personal data protected by GDPR, trade secrets, and intellectual-property-protected data. The DGA introduces the concept of 'data altruism' (voluntary data sharing by individuals and companies for purposes of general interest) and creates a voluntary EU Data Altruism Organisation label with associated governance requirements. A European Data Innovation Board (EDIB) has been established to advise the Commission on data-sharing practices and standards. For AI compliance teams, the DGA is directly relevant because it governs the data intermediaries and shared data pools that may be used to source training datasets. It also creates a reusable-data infrastructure on which AI systems across healthcare, mobility, energy, and agriculture depend.

Key Requirements

• •Providers of data intermediary services must notify the competent national authority before commencing operations and must meet conditions of neutrality, non-commercial data use, and technical separation from other services.
• •Data intermediaries must not use data shared through their platforms for any purpose other than making it available to data users, and must not sell the data or use it to develop competing products.
• •Public sector bodies wishing to allow re-use of protected data must establish transparent procedures, technical environments for secure processing, and charge fees that are cost-based and non-discriminatory.
• •Data altruism organisations can choose to register to use the EU label. They must be not-for-profit, keep data altruism activities separate, keep records, and follow the rulebook.
• •Data intermediaries and altruism organisations must maintain records of data-sharing activities sufficient to demonstrate compliance.
• •The European Data Innovation Board provides guidance on cross-sector and cross-border data-sharing standards; member states must cooperate with the EDIB.
• •Competent national authorities must be designated in each member state; they must have investigative powers, the ability to impose administrative measures, and coordinate with data protection authorities.
• •Public sector bodies are not required to allow re-use of their data; the DGA sets conditions only where they choose to (Article 1(2)).
• •Transfers of non-personal data to third countries by data intermediaries are subject to adequacy-equivalent safeguards to prevent regulatory circumvention.

What Your Organization Must Do

• →Check whether any group platform brokers data between others and needs national authority notification before operating.
• →Separate intermediary services technically from other business lines, and stop using brokered data for competing products.
• →Map AI training data sources to confirm which arrive through data intermediaries or public sector re-use arrangements.
• →Review public sector re-use terms for secure processing environments, transparent procedures, and cost-based, non-discriminatory fees.
• →Decide whether registering for the voluntary EU Data Altruism Organisation label fits your not-for-profit data activities.
• →Document data-sharing activities and third country transfer safeguards for non-personal data to evidence compliance.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

When did the EU Data Governance Act start applying to businesses?

The DGA entered into force on 23 June 2022 but has applied to businesses since 24 September 2023. Any data intermediary services or public sector re-use arrangements that were already operational by that date needed to be in compliance from that point forward.

Does a B2B data marketplace based outside the EU need to register under the DGA?

If the marketplace facilitates data sharing between parties in the EU, it is likely subject to DGA notification requirements regardless of where it is established. The regulation applies based on where the data intermediary service is offered, not where the provider is incorporated.

What is the difference between the EU Data Governance Act and the EU Data Act?

The DGA governs the institutional infrastructure for voluntary data sharing, including data intermediaries and altruism organisations. The EU Data Act focuses on access rights to data generated by connected products and related services. The two regulations are complementary but address distinct data-sharing scenarios.

What conditions must a data intermediary meet to legally operate under the DGA?

A data intermediary must notify the relevant national competent authority before commencing operations, maintain neutrality by not acquiring commercial rights over shared data, refrain from using data to develop competing products, and maintain technical separation from its other services.

What are the requirements for an organisation to obtain the EU Data Altruism Organisation label?

It must be a not-for-profit legal person with general-interest objectives, keep data altruism activities separate, and meet transparency and record-keeping duties. Registration is voluntary, and national authorities and the Commission keep the public registers.

What safeguards apply when a DGA-regulated data intermediary transfers non-personal data to a third country?

Transfers of non-personal data to third countries by data intermediaries must be subject to adequacy-equivalent safeguards. This prevents regulatory circumvention and mirrors the logic of GDPR transfer restrictions, ensuring data shared through EU infrastructure is not re-routed to jurisdictions with weaker protections.