European Data Governance Act

Article 1 Subject matter and scope

This Regulation establishes frameworks for public data re-use, data intermediation services, altruistic data collection registration, and the European Data Innovation Board. It does not mandate data re-use by public authorities and does not override confidentiality obligations. Sector-specific rules and data protection law take precedence, while competition law applies independently.

Article 2 Definitions

Data is defined as digital representations or compilations of acts, facts or information in any medium; re-use means use of public sector data by any person for purposes other than the initial public task, excluding transfers between public bodies; and key concepts reference the GDPR and Free Flow of Non-Personal Data Regulation for personal and non-personal data, with data holders as persons who may grant access and data users as those with lawful access and rights to use data. Processing is defined by reference to the GDPR and Free Flow Regulation; access means data use under specific requirements without necessarily requiring transmission or download; and public sector bodies and bodies governed by public law are entities established for general interest needs with legal personality, financed and managed by state or public authorities, or with administrative boards more than half appointed by such authorities. A secure processing environment is a physical or virtual space with organisational means ensuring compliance with data protection law, intellectual property rights, and confidentiality, allowing the provider to control and supervise all processing including data display, storage, download, export and derivative calculations; a legal representative is a person established in the EU designated to act for non-EU data intermediation service providers or entities collecting data for general interest purposes based on data altruism, empowered to receive enforcement and registration actions from competent authorities.

Article 3 Categories of data

This chapter governs re-use of information held by governmental bodies where protections exist for trade secrets, statistical privacy, third-party intellectual property, or personal data outside Directive 2019/1024. It excludes data from state-owned enterprises, broadcasters and their subsidiaries, museums and schools, bodies protecting public security or defense, and information outside the organisations' defined public responsibilities.

Article 4 Prohibition of exclusive arrangements

Exclusive re-use rights for protected data held by public bodies are prohibited, unless necessary for a general interest service otherwise impossible to provide. Any exclusive rights must be granted through formal acts, comply with transparency and equal treatment, and last maximum 12 months. Pre-existing non-compliant agreements must end by December 2024.

Article 5 Conditions for re-use

Public sector bodies must publicly announce non-discriminatory, transparent, proportionate re-use conditions via a single information point, preserving data protection through anonymisation, modification, aggregation or secure processing environments, and imposing confidentiality obligations, re-identification prohibitions with technical and operational measures, and breach notification requirements on re-users. Bodies must prevent disclosure of confidential data and require re-users transferring protected non-personal data to third countries to obtain the body's and affected legal persons' permission, with contractual commitments to maintain confidentiality and accept transmitting Member State court jurisdiction. Union legislative acts may designate certain non-personal data as highly sensitive where transfer to third countries risks Union public policy objectives or re-identification; the Commission then adopts delegated acts with special conditions for such transfers limited to what is necessary and non-discriminatory.

Article 6 Fees

Public sector bodies may charge transparent, non-discriminatory and proportionate fees for permitting reuse of specified data categories, with costs limited to operations like reproduction, rights clearance, and data preparation. Fees must include incentives for non-commercial reuse by research organizations, SMEs and startups, potentially through discounts or free access, with publicly disclosed criteria for determining beneficiary categories.

Article 7 Competent bodies

Each Member State shall designate competent bodies to support public sector entities that grant or refuse reuse access, either by establishing new ones or using existing public services with appropriate legal, financial, technical and human resources. These bodies provide technical assistance including secure processing environments, data structuring guidance, privacy-preserving techniques, and help with obtaining consent from data subjects and permissions from data holders.

Article 8 Single information points

Member States must maintain a centrally accessible single information point offering comprehensive information on data reuse requirements and a searchable inventory of available data resources with relevant details like format and reuse conditions. The point receives and directs reuse requests to competent bodies, may provide simplified assistance for SMEs and startups, and the Commission shall establish a European-level register linking to national points.

Article 9 Procedure for requests for re-use

Competent bodies must decide on reuse requests within two months, extendable by 30 days for complex cases with notification to the applicant. Persons affected by decisions have effective redress rights through independent national review mechanisms, such as competition authorities, data protection supervisors or courts, whose determinations are binding on the relevant body.

Article 10 Data intermediation services

Intermediation services connecting data holders with potential users, connecting individuals wanting to share personal or non-personal data with users, and data cooperative operations must comply with specified requirements and notification procedures.

Article 11 Notification by data intermediation services providers

Data intermediation services providers must notify the competent authority of their main establishment (or a designated legal representative if non-Union based) before starting activities, enabling cross-Member State service provision; notification must include provider name, legal status, ownership, contact details, website, service description, and activity start date. The competent authority must ensure fair procedures that do not restrict market competition and issue a standardised compliance confirmation within one week upon request. Providers confirmed to comply with Articles 11 and 12 may use a Commission-established label and common logo in their intermediation communications.

Article 12 Conditions for providing data intermediation services

Data intermediation service providers must operate through a separate legal entity and not use shared data except to make it available to users or to develop the service itself (including fraud detection and cybersecurity); they must collect data about natural or legal persons only for service development and make it available to data holders on request, and cannot condition commercial terms on purchase of additional services. Providers must exchange data in its received format and may convert it only to improve interoperability, upon user request, or where required by law, with opt-out options unless mandatory; they may offer additional tools like storage, curation, anonymisation and pseudonymisation only with explicit data holder or subject approval. Providers must ensure fair, transparent and non-discriminatory access, prevent fraudulent or abusive practices, maintain service continuity during insolvency with data recovery, ensure interoperability with other services, prevent unlawful transfers, promptly notify data holders of unauthorised access, apply appropriate security measures (highest level for sensitive information), and when serving data subjects act in their best interest by clearly informing them of intended uses before consent.

Article 13 Competent authorities for data intermediation services

Each Member State must designate one or more competent authorities to handle notifications for data intermediation services and report them to the Commission by 24 September 2023, and inform the Commission of any changes. These authorities must meet the requirements in Article 26 and cooperate with data protection, competition, cybersecurity and sectoral authorities to ensure consistent application of this regulation.

Article 14 Monitoring of compliance

Competent authorities must monitor and supervise data intermediation services providers' compliance with requirements based on requests or own initiative, request proportionate and reasoned information, notify providers of non-compliance within 30 days to respond, and can require cessation of infringements within a reasonable time or immediately for serious breaches. Authorities may impose dissuasive financial penalties, require postponement or suspension of services until corrective changes are made, or require complete cessation for serious or repeated unresolved infringements. For providers outside the Union that fail to designate a legal representative or provide necessary compliance information, authorities may postpone or suspend services.

Article 15 Exceptions

This chapter does not apply to non-profit data altruism organisations or other non-profit entities collecting data for general interest unless they establish commercial relationships between multiple data subjects or holders and data users.

Article 16 National arrangements for data altruism

Member States may establish organisational or technical arrangements and national policies to support data altruism, potentially helping data subjects share their personal data from public sector bodies for general interest purposes, and must notify the Commission if they do so.

Article 17 Public registers of recognised data altruism organisations

Competent national authorities must maintain and update public registers listing accredited data altruism organisations. The Commission maintains a Union-wide register for information purposes and establishes a common logo by implementing acts that recognised organisations must display prominently on all publications about their data altruism work, with a QR code linking to the Union register.

Article 18 General requirements for registration

To register as a recognised data altruism organisation, an entity must conduct data altruism activities, be a legal person pursuing general interest objectives, operate on a non-profit basis independently from for-profit entities, separate its data altruism activities structurally, and comply with a rulebook 18 months after delegated acts enter into force.

Article 19 Registration of recognised data altruism organisations

Qualifying entities may apply to register in the national register of their establishment Member State or main establishment Member State, and non-Union entities must designate a legal representative in a Member State; applications must include entity name, legal status, statutes, income sources, establishments, website with specified information, contact details, objectives of general interest, data nature and categories, and proof of Article 18 compliance. A competent authority must register a compliant entity in the public national register within 12 weeks, with registration valid across all Member States and specified information published; registered organisations must notify the authority of changes within 14 days.

Article 20 Transparency requirements

Recognised data altruism organisations must maintain detailed records of entities processing their data, including timing, stated purposes and any fees charged. They must submit annual activity reports to their competent authority documenting their activities, how they advanced general interest objectives, all data processors and their goals, data processing techniques including privacy safeguards, results where applicable, and financial information.

Article 21 Specific requirements to safeguard rights and interests of data subjects and data holders with regard to their data

Recognised data altruism organisations must clearly inform data providers before processing about the general interest purposes and any third-country processing locations. They may not repurpose data beyond declared objectives or use misleading marketing, must provide user-friendly consent and withdrawal tools, ensure appropriate security for stored data, notify holders of breaches promptly, and disclose third-country jurisdictions when facilitating processing by others.

Article 22 Rulebook

The Commission will adopt rules establishing information requirements for obtaining informed consent, technical and security standards for data storage and consent tools, awareness-raising strategies involving multiple disciplines, and recommendations on interoperability standards. These rules will be developed in close partnership with data altruism organisations and stakeholders.

Article 23 Competent authorities for the registration of data altruism organisations

Each Member State must designate one or more authorities to maintain a national register of recognised data altruism organisations, and must notify the Commission of these authorities by a specified date and of any changes. Registration authorities must cooperate with data protection authorities regarding personal data processing and with relevant sectoral authorities.

Article 24 Monitoring of compliance

Competent authorities must monitor recognised data altruism organisations for compliance, may request proportionate information, and upon finding non-compliance must notify the organisation giving it 30 days to respond, then may require cessation and take appropriate measures, ultimately leading to loss of the recognised label and removal from registers. When such an organisation operates across multiple Member States, competent authorities of the home and affected Member States must cooperate and exchange information, responding swiftly and proportionately to reasoned requests for measures, with information used only for the specific purpose requested.

Article 25 European data altruism consent form

The Commission will establish a standard consent form to simplify data collection across Member States using a modular, sector-customisable approach. For personal data, the form must enable GDPR-compliant consent and withdrawal. The form will be available in paper-printable and electronic, machine-readable formats for easy understanding.

Article 26 Requirements relating to competent authorities

Competent authorities must be legally distinct and functionally independent from service providers and organisations they oversee, exercise tasks impartially and transparently, maintain standards prohibiting conflicts of interest for senior staff, and possess adequate resources including technical knowledge to carry out assigned functions.

Article 27 Right to lodge a complaint

Individuals and organisations may file complaints, individually or collectively, with the relevant competent authority against data intermediation providers or data altruism organisations. The competent authority must update the complainant on proceedings and decisions and inform them of available judicial remedies.

Article 28 Right to an effective judicial remedy

Affected parties may pursue judicial remedies in Member State courts against binding decisions by competent authorities concerning data intermediation services and data altruism organisations. Where authorities fail to act on complaints, affected parties can either seek judicial review or access review by an impartial specialist body under national law.

Article 29 European Data Innovation Board

The Commission establishes an expert group comprising representatives from national competent authorities, EU data protection bodies, ENISA, SME envoys, and relevant sector experts, organised into three subgroups for authority coordination, technical standards, and stakeholder engagement, with the Commission providing secretariat support.

Article 30 Tasks of the European Data Innovation Board

The European Data Innovation Board advises the Commission on developing consistent practices for public sector data reuse, data altruism, competent authority oversight, protection of commercially sensitive data, cybersecurity standards, and cross-sector standards to reduce fragmentation in the European data economy. It must help Member States coordinate conditions for reusing public sector data across the internal market and help competent authorities for intermediation services and altruism registration through training and information exchange, including methods for notification, monitoring, and coordination on fees or penalties. It must support international data access and transfer cooperation and advise the Commission on implementing acts for data reuse, the data altruism consent form, and global regulatory frameworks for non-personal data.

Article 31 International access and transfer

Public sector bodies, data reuse recipients, intermediation providers and altruism organisations must apply reasonable technical, legal and contractual safeguards to prevent international transfer or access violating Union or Member State law, and may only enforce foreign court or administrative orders based on an international agreement or where the foreign system requires reasoning, specificity and proportionality with court review possibility. When conditions for international transfer are met, the entity must provide only minimal data determined through fair reading of the request and must notify the data holder of foreign authority requests before complying, unless the request concerns law enforcement and disclosure would compromise enforcement effectiveness.

Article 32 Exercise of the delegation

The Commission has indefinite power to adopt delegated acts from 23 June 2022, subject to consultation with Member States and three-month review periods for the European Parliament and Council to object; revocation by either institution terminates future delegating powers but does not invalidate existing acts.

Article 33 Committee procedure

The Commission receives assistance from a committee operating under Regulation (EU) No 182/2011 procedures, with specified rules governing when its examination or implementing powers apply.

Article 34 Penalties

Member States must establish penalty rules for breaches of obligations concerning non-personal data transfers to third countries, data intermediation service notifications, conditions for providing such services, and recognition of data altruism organisations, ensuring penalties are effective, proportionate and dissuasive. When penalising data intermediation providers and recognised data altruism organisations, Member States should consider factors including the seriousness and length of the breach, remedial actions taken, prior violations, financial gains or losses from the breach, and other relevant circumstances.

Article 35 Evaluation and review

The Commission must evaluate the Regulation and report to Parliament and Council by September 2025, assessing the effectiveness of Member State penalty rules, the compliance and enforceability of penalties for non-Union-based intermediaries and altruism organisations, and the types of altruism organisations registered and their purposes. Member States are required to provide necessary information for this assessment.

Article 36 Amendment to Regulation (EU) 2018/1724

The scope of business and life event procedures covered in the digital single window is expanded to include notification of data intermediation services providers and registration of recognised data altruism organisations, with confirmation of receipt or registration as the expected output.

Article 37 Transitional arrangements

Entities already providing data intermediation services on 23 June 2022 have until 24 September 2025 to comply with the obligations for such services under the Regulation.

Article 38 Entry into force and application

This Regulation entered into force twenty days after publication in the Official Journal and applies from 24 September 2023, binding all Member States in its entirety and directly applicable.