Cyber-Management
EN / FRbook a consultation

Data Governance Act

EU Data Governance Act (DGA): does it apply to your business?

It mainly covers businesses that broker, pool or donate data. See where you stand.

book a free 25-minute consultation

Does it apply to you?

Does the Data Governance Act apply to you?

Yes to the first: you have direct duties today. Yes to the others: the law reaches you, more lightly or through contracts. The exact tests are in the section for your IT manager, below.

  • Do you connect those who hold data with those who want to use it?A data marketplace, a sector data exchange, a personal-data space or a data broker. You must notify your national authority before you operate.
  • Do you re-use protected data held by public bodies?Data covered by commercial or statistical confidentiality, or by others’ rights. Specific re-use conditions apply.
  • Do you collect data that people or companies donate for the public good?For research, health, climate or city planning. You can register as a recognised data altruism organisation, a label of trust.
  • Do you take part in a sector data space, or work with an intermediary?Health, mobility, energy, agriculture, manufacturing. Expect the rules to reach you through contracts.

Not in scope?

None of these? You probably have no direct duties.

Cloud providers, analytics services and companies using data for their own purposes are not data intermediaries under this law. GDPR still applies to any personal data you share, and the separate Data Act may apply if you make connected products.

What changes for you

Neutral, notified, and separate from your other business.

The EU Data Governance Act sets rules for sharing data, not for processing it. It has applied since 24 September 2023, and the grace period for data intermediaries already operating ended on 24 September 2025.

A data intermediary notifies its national authority before operating (Arcep in France), stays neutral, does not use the data for its own purposes, and keeps the service apart from its other activities. Operating without notification can lead to suspension.

The real risk is being stopped from operating, and losing the trust a data-sharing business depends on. The fix is a clear answer on your status, then the notification and the governance the law expects. Where personal data is shared, GDPR applies in full.

What to do first

Confirm your status, then put the governance in place.

What we deliver

  • A documented answer for each activity: direct duties, indirect, or out of scope
  • For data intermediaries: the notification file, and the neutrality and separation rules
  • For data altruism: the registration file and the transparency the label requires
  • One design covering both the Data Governance Act and GDPR when personal data is shared
  • Preparation for the sector data spaces you take part in

Who does what

We lead the governance work. Your IT team keeps the technical side.

What we lead

  • Work out how the law applies to each activity
  • Prepare the notification or registration file (you submit it)
  • Write the neutrality, separation and transparency rules
  • Align the design with GDPR

What stays with your IT provider

  • Set up the access separation and security measures
  • Keep the logs and records the rules require
  • Run the platform day to day

We check their work against the rules, so the evidence holds up with the authority.

How it starts

Your first step: confirm your status.

You learn, activity by activity, whether the Data Governance Act applies to you and what it asks. The work is then sized to your role (intermediary, data altruism or re-user), at a fixed fee.

Price
Fixed fee

Fixed quote after the free call.

book a free 25-minute consultation

For your IT manager, DPO or CFO

What the DGA actually requires.
  1. 01Ch. II · Arts 3–9

    Re-use of protected public sector data

    Public bodies must comply with specific conditions: appropriate technical and organisational measures, proportionate fees, transparency about re-use conditions.

  2. 02Ch. III · Arts 10–15

    Data intermediary services

    Providers must notify the national competent authority before operating. Cannot use data for their own commercial purposes. Must maintain strict separation between intermediary and other activities. Must implement appropriate technical and security measures.

  3. 03Ch. IV · Arts 16–25

    Data altruism

    Recognised organisations must meet specific governance, transparency, security, and accountability requirements — public register of data uses, restriction to stated altruistic purposes, annual activity reports to the competent authority.

  4. 04Ch. VI · Arts 29–30

    European Data Innovation Board

    EDIB coordinates the development of common standards for EU data spaces — sector-specific data ecosystems in health, energy, mobility, agriculture, manufacturing.

National penalties — and operational suspension.

The DGA is enforced by national competent authorities designated by each member state. Penalties for non-compliance are set by national law — the DGA requires them to be effective, proportionate, and dissuasive.

Data intermediary service providers operating without notification, failing to meet neutrality obligations, or misusing data entrusted to them face suspension from operating and, depending on national implementation, significant financial penalties. Designations vary by member state — in France, Arcep is the competent authority for data intermediation (SREN law of May 2024), working with the CNIL where personal data is involved; other member states designate their own authorities. Data intermediary service providers operating today without notification are already in violation, regardless of country.

  • Penalty structure

    National

    each member state sets penalties that must be effective, proportionate, and dissuasive.

  • Operational sanction

    Suspension

    data intermediaries operating without notification face suspension.

  • Competent authority

    Per state

    each EU member state designates its own — e.g. Arcep in France.

Typical timeline

Scope-dependent. Most engagements are a focused governance build.

  1. Weeks 1–2

    Scoping

    Confirm direct vs indirect DGA applicability. Map data flows. Identify chapter-specific obligations.

  2. Weeks 3–8

    Governance build

    Notification preparation, neutrality framework, security and transparency controls, public register design (where altruism).

  3. Ongoing

    Operational compliance

    Annual activity reports (altruism organisations), supervisory authority interactions, GDPR alignment for personal data flows.

FAQ

What data, legal and IT teams ask us about the Data Governance Act.

Exactly who does the DGA apply to?
The Data Governance Act is Regulation (EU) 2022/868. Direct obligations fall on a few categories: public bodies holding data protected by confidentiality rules (trade secrets, statistical data, third-party IP), under Chapter II; data intermediary service providers (data marketplaces, sector data exchanges, personal data spaces, brokers), who must notify before operating; and data altruism organisations, which may register for a trust label. Participants in EU data spaces (health, mobility, energy, agriculture, manufacturing) and businesses whose clients are intermediaries feel it indirectly, through contractual flow-down of neutrality, transparency and security duties.
Does the DGA apply to my business if we are not a data intermediary?
The DGA's direct obligations fall most heavily on data intermediary service providers and data altruism organisations. If your organisation does not provide these services and does not re-use protected public-sector data, the DGA does not impose direct compliance obligations on you. It can still affect you indirectly — if you participate in a sector data space, if your clients or partners are intermediaries or public bodies subject to the DGA, or if you supply connected products whose data may fall under the related Data Act.
What is a data intermediary under the DGA?
A service provider that facilitates the voluntary sharing of data between data holders and data users — acting as a neutral third party. Examples: data marketplaces, sector data exchanges, personal data management services, data brokering platforms. The DGA explicitly excludes cloud providers, data analytics services, and other businesses that process data for their own commercial purposes rather than facilitating sharing between third parties.
How does the DGA interact with GDPR when shared data includes personal data?
GDPR continues to apply in full: the DGA governs sharing, GDPR governs processing. The DGA creates no new lawful basis for processing personal data; it creates a governance framework in which GDPR-compliant sharing can happen more efficiently. An intermediary handling personal data must meet the DGA’s neutrality and notification rules and GDPR’s lawful basis, data subject rights and security duties at the same time, plus any national data protection law.
What are EU data spaces and how might they affect our business?
Sector ecosystems (health, mobility, energy, agriculture, manufacturing, finance) where organisations pool and share data under governed, standardised conditions enabled by the DGA. In affected sectors, taking part may become a client expectation, a public-procurement prerequisite or a competitive advantage. The European Health Data Space (EHDS), for example, already creates significant governance obligations for healthcare and digital-health companies.
What's the difference between the Data Governance Act and the Data Act?
They are complementary but distinct. The DGA establishes the governance infrastructure for voluntary data sharing — registration regimes, frameworks for public-sector data re-use. The Data Act (Regulation (EU) 2023/2854, applicable since 12 September 2025) gives users of connected products and related services the right to access and share data generated by those products — IoT, smart appliances, industrial machinery. DGA = who can share data and under what conditions. Data Act = who has the right to access data generated by connected products.
Is there a DGA compliance deadline we need to meet?
The DGA has applied since 24 September 2023. Providers already offering data intermediation services on 23 June 2022 had a transition period until 24 September 2025 (Article 37); it has expired, so any provider operating today without notification to its national competent authority is in breach. New businesses must notify before commencing operations.

Related

Adjacent EU regulation.

EU GDPR

Continues to apply in full where DGA-shared data includes personal data. The DGA is sharing infrastructure; GDPR is processing rules.

Read more

EU Cybersecurity Act

Adjacent EU digital regulation — both part of the EU digital single-market strategy.

Read more

NIS2

Where data intermediary services support critical infrastructure, NIS2 obligations may also apply.

Read more
back to compliance hub