EU Data Governance Act (DGA)

Applied September 2023. Framework for voluntary cross-sector data sharing via data intermediaries and altruism organisations. Sets public sector data reuse conditions for European data spaces.

JurisdictionEuropean Union
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

The EU Data Governance Act (DGA) is a directly applicable EU regulation (Regulation (EU) 2022/868) that has applied since 24 September 2023 and establishes a framework for trustworthy, voluntary cross‑sector data sharing, including reuse of protected public sector data, regulation of data intermediation services and data altruism mechanisms.European Commission – Data Governance ActOfficial Journal – Regulation (EU) 2022/868CMS – DGA Overview

Key Requirements

1. Re‑use of protected public sector data

2. Regulation of data intermediation services (DIS)

3. Data altruism framework

4. Safeguards for international data transfers and third‑country access

5. Designation of competent authorities and penalties

Compliance Challenges

1. Complex interplay with GDPR and sectoral laws

Example: Legal analyses note that health and financial authorities must design processes to enable reuse of sensitive datasets without violating sector‑specific secrecy rules, creating significant legal and governance complexity.Clifford Chance – Overview of the DGAAlston & Bird – What You Should Know About the DGACMS – DGA Overview

2. Setting up neutral data intermediation structures

Example: Industry commentary emphasises that cloud providers and large platforms may need to create ring‑fenced entities or business units to comply with neutrality obligations while continuing their core data‑driven activities.Alston & Bird – What You Should Know About the DGAClifford Chance – Overview of the DGACMS – DGA Overview

3. International transfer and foreign government access controls

4. Public sector readiness and designation of authorities

Implementation Best Practices

1. Establish a DGA governance and mapping programme

2. Implement neutral and secure data intermediation architecture

Recent developments

  • — European Commission opens infringement procedures against 18 Member States for failing to designate or properly empower authorities responsible for implementing the Data Governance Act, giving them two months to remedy shortcomings or face a possible reasoned opinion[8]. This highlights uneven national implementation and creates legal uncertainty for technology and data intermediation service providers relying on DGA-supervisory structures[8]. (source)
  • — European Commission initiative introduces common EU logos for trusted data intermediation service providers and data altruism organisations under the DGA to help individuals and companies identify compliant data-sharing intermediaries[2]. Technology firms offering data intermediation or altruism services are adapting branding and compliance programs to meet logo-use criteria and strengthen user trust in cross-border data sharing[2]. (source)
  • — Commission sends reasoned opinions to several Member States (including Czechia, Germany, Estonia, Greece, Cyprus, Luxembourg, Austria, Poland, Portugal, and Slovenia) for failing to designate or empower competent authorities under the DGA[2]. Continued enforcement pressure increases the risk of fragmented supervision for tech and cloud providers operating EU-wide data spaces, prompting industry calls for faster, harmonised national implementation[2]. (source)
  • — European Commission reiterates that the DGA is fully applicable and functioning as a key pillar of the European data strategy, supporting the creation of Common European Data Spaces in sectors such as health, mobility, finance and manufacturing[1]. Technology companies participating in these data spaces face new obligations around trusted data sharing, neutrality of intermediaries, and technical measures for secure reuse of public-sector and industrial data[1]. (source)
  • — Commission communication on DGA enforcement stresses that designated national authorities must register data altruism organisations and monitor compliance of data intermediation service providers from 24 September 2023 onward[8]. Providers of data marketplaces, cloud-based sharing platforms and other tech intermediaries must ensure strict organisational separation of intermediation from other services and prepare for supervisory scrutiny and potential sanctions[8]. (source)
  • — Commission highlights that the European Data Act, now in force, *complements* the DGA by defining access and use rights for data, while the DGA continues to increase trust in voluntary data-sharing mechanisms[7]. The combined framework is driving technology-sector reassessment of data strategies, with businesses aligning DGA-compliant governance (intermediaries, altruism, public-sector reuse) with Data Act rules on device data access, cloud switching and industrial data sharing[7]. (source)
  • — EU “Data Act explained” communication explicitly positions the Data Act as building on and complementing the DGA, which has been applicable since September 2023[6]. Tech companies, especially IoT and cloud providers, are using DGA structures (trusted intermediaries, data spaces) as the governance backbone for Data Act–driven data-access and interoperability obligations[6]. (source)
  • — EU open data portal reminds stakeholders that the DGA has created a harmonised framework for data sharing and governance, enabling greater reuse of public sector data that cannot be open data and establishing voluntary data altruism organisations[9]. Public-sector bodies, data platforms and AI developers are leveraging these mechanisms to access previously restricted datasets while addressing privacy, security and monetisation concerns in line with the Act[9]. (source)
  • — Industry analysis summarises DGA obligations on public-sector bodies, data intermediation services and data altruism organisations, including requirements to prevent unlawful international transfers and governmental access to non-personal data that conflict with EU or Member State law[3]. Tech companies and cloud providers are updating routing, access-control and data-localisation strategies to comply, especially for non-personal industrial and IoT data processed across jurisdictions[3]. (source)
  • — Commission marks one year of DGA applicability (from September 2023), emphasising its role in increasing trust in data sharing and supporting sectoral Common European Data Spaces[1]. Over the first year, technology-sector reactions include investment in DGA-compliant data-sharing platforms, emerging business models for neutral data intermediaries, and greater focus on user-consent and altruistic data-sharing frameworks[1]. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates