Data sharing law and data spaces

Data has an awkward economic property. It costs a great deal to generate the first copy and almost nothing to make the second, so the party holding it has every reason to keep it and very little reason to release it. Where the holder also writes the contract, as a machinery manufacturer or a cloud provider does, the market does not correct the imbalance on its own. Voluntary sharing works well between equals and poorly between a large platform and its customers.

Governance frameworks address the same imbalance from the inside. A well-drafted data sharing agreement records the purpose, the parties, the lawful basis each relies on, what is shared and how long it is kept. That is the right instrument when two willing organisations want a defensible record of what they agreed. It is the wrong instrument when one side has no realistic ability to negotiate at all.

Legislation fills that second gap. It does so in three distinct ways, and separating them makes the rest of this module much easier. Some rules create an access right, so a party who previously had no claim on the data acquires one. Some rules constrain terms, so a party who already had to share must now do so on stated conditions rather than conditions of its choosing. Some rules create infrastructure and recognition, so that sharing which was always permitted becomes practically achievable across an entire sector.

Note what none of them do. None of these instruments displaces data protection law. Where the records in question are personal data, a lawful basis, a purpose, a retention position and the rights of the individual all still apply on top. A right to receive data is not a permission to process it for any purpose the recipient fancies, and reading a sharing regulation as though it silently amends the General Data Protection Regulation is a reliable way to build something unlawful.

The EU Data Act, Regulation (EU) 2023/2854, gives the user of a connected product a right of access to the data that the use of that product generates, and a right to require the data holder to make that data available to a third party the user nominates. The user may be a consumer or a business. The third party may be an independent repairer, an insurer, an analytics provider or a competitor of the manufacturer, with one notable exclusion: an undertaking designated as a gatekeeper under the Digital Markets Act is not an eligible recipient under this route.

The Act arrives on four dates rather than one, and the figure above is built around that fact because it is where most compliance mistakes start. It entered into force on 11 January 2024, which created the text but bound nobody to act. It became applicable on 12 September 2025, at which point the access and use duties on data holders and the corresponding rights of users became live. From 12 September 2026 a design obligation attaches to connected products and related services placed on the market after that date. From 12 January 2027 the charging rules for switching a provider of data processing services change again.

The design obligation is the one that reaches engineering rather than legal. It requires that connected products and connected services be designed so that the data they generate is accessible to the user by default, directly where the product allows it, in a structured, commonly used and machine readable form, securely and free of charge. A product that meets the access duty by having a support desk assemble a spreadsheet on request satisfies nobody once that date applies to it.

Ask the date question before the substance question. A vehicle telematics unit placed on the market in 2024 sits under the access duties but not the design duty. A sensor line launched in 2027 sits under both. Two products in the same catalogue can therefore carry different obligations, which is why the compliance record has to be held per product line and per placement date rather than per company.

Where a data holder is obliged to make data available to a data recipient, the Data Act requires it to do so under terms and conditions that are fair, reasonable and non-discriminatory, and in a transparent manner. The abbreviation FRAND is borrowed from standard-essential patent licensing, where the same problem arises: a party that must license cannot be allowed to price the obligation into irrelevance.

Each word carries weight. Fair excludes terms that would be unconscionable between commercial parties. Reasonable governs the level of any compensation, which may cover the cost of making the data available and, between businesses, a margin. Non-discriminatory prevents a data holder from quoting one price to an independent repair network and a different one to its own subsidiary for materially the same access. Transparent means the basis of the terms has to be capable of being stated rather than left to negotiation in the dark.

The Act also polices the contract itself. Terms about data access and liability that are unilaterally imposed on another enterprise and that depart grossly from good commercial practice can be found unfair and are not binding on the party they were imposed on. Separately, a public sector body may request data held by a business where it demonstrates an exceptional need, such as responding to a public emergency. That is a narrow gateway with its own conditions, not a general power for administrations to help themselves to commercial data.

Two practical consequences follow for anyone building the pipeline behind a sharing obligation. First, the cost of serving a request has to be measurable, because a compensation figure that cannot be explained cannot be shown to be reasonable. Second, the same interface should serve every recipient class, because the cheapest way to prove non-discrimination is to have only one path to discriminate with.

The Data Act treats cloud switching as a customer right rather than a commercial favour. A customer of a data processing service, which covers cloud and edge services, must be able to move to another provider or bring the workload back in house, and the provider has duties to make that move possible within a defined process rather than obstruct it.

Charging is handled on a schedule rather than a switch. Between 11 January 2024 and 12 January 2027 a provider may impose reduced switching charges that do not exceed the costs it actually incurs and that are directly linked to the switching process concerned. From 12 January 2027 providers of data processing services must not impose switching charges for the switching process at all. This is why the fourth station on the timeline binds cloud providers rather than manufacturers.

Read the right narrowly and it is disappointing. It does not oblige a competitor to offer the same managed services, and it does not make a proprietary query engine portable. What it does remove is the part of exit cost that was never technical: the egress bill. Once the fee floor is gone, the remaining barrier is the honest one, namely how much service-specific behaviour the architecture absorbed while nobody was measuring.

The operational lesson for a data platform team is to treat exit as a rehearsed procedure. Know which formats leave cleanly, which service behaviours have no equivalent elsewhere, and how long a full extraction of the current estate actually takes. A team that has never measured its own egress time cannot tell the difference between a right it holds and a right it can use.

Regulation (EU) 2022/868, the Data Governance Act, entered into force on 23 June 2022 and has applied since 24 September 2023. It is the enabling instrument rather than the compelling one, and reading it as a mandate is the single most common error. It sets conditions for the re-use of protected data held by public sector bodies, where that data is commercially confidential, statistically confidential, covered by third party intellectual property rights, or personal. It does not create a right to obtain that data, and it does not require any public body to open anything that national law keeps closed.

Its second strand regulates the data intermediary. A provider of data intermediation services connects those who hold data with those who want to use it, and under the regulation it must notify its activity, keep the intermediation service structurally separate from any other service it runs, and refrain from using the data it passes on for its own purposes. It charges for the service, not for the data. That structural separation is what distinguishes an intermediary from a data broker, and it is a design constraint rather than a promise in a policy document.

The third strand is data altruism: people and organisations making data available voluntarily and without reward for objectives of general interest, such as medical research, environmental monitoring or improving public services. Organisations that collect on this basis may register as recognised data altruism organisations, which requires a not-for-profit character, transparency obligations and entry on a public register. The point of the register is that a public interest purpose becomes checkable rather than merely asserted.

A fourth strand creates the European Data Innovation Board to coordinate practice across member states. Taken together the four strands explain why the Data Governance Act and the Data Act are so often confused and so rarely interchangeable. One builds the plumbing and the trusted roles; the other creates the obligations that make anyone use them.

A data spaceis a sector-wide arrangement in which organisations share data under common rules, standards and infrastructure, so that participants can reuse one another's data in a trusted setting. The European strategy for data set out common European data spaces across strategic sectors, and the support figure above shows five of them: health, energy, mobility, finance and agriculture.

The geometry of that figure carries the argument. Each sector card draws on one shared interoperability core rather than inventing its own: identity and trust, vocabularies, access rules and audit. A health space and an energy space differ in what they carry and in who is allowed to see it, but they are recognisably the same kind of arrangement because the hard parts are solved once. That is the practical pay-off of the standards work covered in Stage 1. Vocabularies and identifiers stop being a modelling nicety and become the thing that lets a sector agreement scale beyond its founding members.

Health is the sector that has moved from strategy to law. Regulation (EU) 2025/327 on the European Health Data Space was adopted on 11 February 2025, published in the Official Journal on 5 March 2025 and entered into force on 26 March 2025. It separates two purposes that health systems had long muddled together. Primary use is care: a clinician treating a patient, including across a border. Secondary use is research, innovation, policymaking and regulatory activity, carried out through permitted access rather than by handing over copies.

The timetable is long and deliberate. Key parts of the regulation, including the cross-border exchange of the first priority categories of health data such as patient summaries and electronic prescriptions, apply from March 2029, with further phases after that. A sector data space is not a platform that launches; it is a set of obligations that arrive in waves, and the participants who fare best are the ones who treat the interoperability core as work to start now rather than a deadline to meet later.

Secondary use is also where the privacy techniques from Stage 5 earn their keep. A permitted analysis carried out inside a controlled environment, whether described as a data clean room or as a secure processing environment, releases the agreed outputs rather than the underlying records. The privacy claim rests on what the environment enforces at the boundary, which is why output controls and audit are the questions worth asking about any such arrangement.

The UK route runs through the smart data scheme. The Data (Use and Access) Act 2025, which received Royal Assent in June 2025, gives ministers and the Treasury the power to make regulations requiring a business to pass data about a customer, at that customer's request, to the customer or to a third party the customer has authorised. The Act creates the power; each scheme is then made sector by sector through secondary legislation.

Open Banking is the working example that the rest are measured against. It shows what a scheme needs beyond a duty to share: an authorisation model so the customer can grant and revoke access, a register of authorised third parties, common interfaces so every participant implements the same thing, and a dispute route when a transfer fails. Portability that requires the customer to download a file and forward it is portability on paper. A scheme is what makes the authorised recipient receive the data on request.

The same Act carries changes to data protection law. It amends rather than replaces the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, with the changes phased in from June 2025. Among them is a list of recognised legitimate interests on which a controller may rely without carrying out the usual balancing test. Most of these changes offer an option rather than impose a new duty, which is a distinction worth holding on to when someone describes the Act as an overhaul.

Public sector data is being approached separately through the National Data Library, a programme to build the infrastructure that lets public sector data be found and reused safely for public services, research and artificial intelligence. Whatever standards it settles on will shape what publishing to a national audience requires, which is the subject of the next module.

The contrast with the European approach is worth stating plainly, because it changes how an organisation plans. A horizontal access right lands on every connected product at once and is scheduled by date. A scheme-making power lands on nothing until a sector scheme is made, and is scheduled by political priority. A business operating in both jurisdictions therefore tracks two different clocks, and only one of them is published in advance.