Data Strategy Briefing — EDPB and EDPS joint opinion on the Data Governance Act

Executive summary. The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) adopted a joint opinion on the proposed Data Governance Act (DGA) on 10 February 2021, urging legislators to tighten neutrality rules for data-sharing intermediaries, add explicit GDPR safeguards to public-sector data reuse, and ensure data altruism schemes operate with informed consent and accountability.^[1] The opinion reframes how future European data spaces and data cooperatives will be supervised, signaling operational requirements for any organization that wants to broker industrial or public data.

What changed

Neutrality and conflict-of-interest controls for intermediaries

The watchdogs warned that data-sharing intermediaries must be structurally separated from entities that re-use data to avoid conflicts of interest. They recommended bans on combining brokerage with advertising or profiling and pushed for mandatory auditability of access logs. That guidance affects cloud marketplaces, industry data trusts, and API gateways that plan to register under the DGA’s Chapter III regime.

Public-sector data reuse safeguards

The opinion calls for GDPR-aligned bases and technical controls when public bodies permit reuse of protected datasets. It highlights pseudonymization, purpose limitation, and confidentiality obligations for data processors handling government-held health, mobility, or financial data. Member State authorities will need standardized contract terms and security baselines before granting reuse permissions.

Data altruism expectations

For data altruism organizations, the EDPB and EDPS sought transparent consent collection, clarity on withdrawal rights, and governance that prevents mission drift. They also flagged cross-border transfers, recommending that data donated for scientific research or public-interest projects stay subject to GDPR safeguards even when processed by accredited third parties.

Implications for data leaders

Compliance architecture for data spaces

Companies contributing data to EU sector data spaces will need to demonstrate separation between data brokerage and analytics arms, implement tamper-evident access logs, and document DPIAs that cover reuse scenarios. Procurement teams sourcing third-party data services must check whether vendors are prepared for DGA registration and supervisory audits.

Contracting and consent updates

The opinion foreshadows standard contractual clauses for public-sector reuse and data altruism. Legal teams should map which datasets fall under Chapter II reuse rules, pre-build consent artifacts that withstand withdrawal, and allocate security responsibilities between controllers and processors handling donated or public data.

Cross-border transfer governance

Because the opinion stresses GDPR applicability throughout reuse chains, organizations must align DGA participation with existing transfer tools (SCCs or BCRs) and monitor adequacy assessments when data altruism projects include non-EU processors.

Next steps

Track trilogue outcomes

Enterprise data offices should monitor how Parliament and Council incorporate the opinion during trilogues—especially around supervisory roles, sanctions, and certification for intermediaries. Expect binding codes of conduct to follow once the DGA text is finalized.

Prepare evidence for registration

Data intermediaries should begin assembling neutrality evidence (organizational charts, logging controls, security certifications) ahead of the formal registration schemes. Public-sector custodians can pilot standardized reuse contracts with pseudonymization requirements and breach-notification SLAs.

Coordinate with privacy teams

Privacy officers should align DGA readiness with GDPR accountability: updating records of processing, conducting DPIAs on data reuse, and validating that data altruism consents map to specific research or public-interest purposes.

Related briefings

Curated signals from the same pillar or overlapping topics.

Data Strategy · Credibility 40/100 · March 25, 2021

Data Strategy Briefing — EU Council General Approach on the Data Governance Act

The EU Council adopted its general approach on the Data Governance Act on 25 March 2021, clarifying neutrality obligations for data intermediaries, re-use rules for protected public-sector data, and governance for data…

Data Strategy · Credibility 40/100 · October 21, 2020

Data Strategy Briefing — China releases draft Personal Information Protection Law

China’s National People’s Congress published the draft Personal Information Protection Law (PIPL) on 21 October 2020, proposing GDPR-style consent rules, cross-border transfer approvals, and steep penalties that would…

Data Strategy · Credibility 40/100 · July 16, 2020

Data Strategy Briefing — Schrems II invalidates EU–US Privacy Shield

The CJEU’s Schrems II ruling on 16 July 2020 struck down the EU–US Privacy Shield and tightened scrutiny on Standard Contractual Clauses, forcing companies to add transfer assessments and supplementary safeguards for…

Data Strategy · Credibility 88/100 · June 9, 2020

Data Strategy Briefing — June 9, 2020

Council conclusions on 9 June 2020 set a roadmap for common European data spaces, high-value public data release, robust governance, and investment in cloud-to-edge infrastructure to keep the EU competitive and…

Data Strategy · Credibility 40/100 · October 22, 2021

Data Strategy Briefing — G7 Digital Trade Principles

G7 Trade Ministers adopted the Digital Trade Principles on 22 October 2021, setting commitments on open digital markets, cross-border data flows with trust, and safeguards on personal data and cybersecurity that shape…

Continue in the Data Strategy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Data Interoperability Engineering Guide — Zeph Tech

  Engineer interoperable data exchanges that satisfy the EU Data Act, Data Governance Act, European Interoperability Framework, and ISO/IEC 19941 portability requirements.

• Data Stewardship Operating Model Guide — Zeph Tech

  Establish accountable data stewardship programmes that meet U.S. Evidence Act mandates, Canada’s Directive on Service and Digital, and OECD data governance principles while…

• Data Strategy Operating Model Guide — Zeph Tech

  Design a data strategy operating model that satisfies the EU Data Act, EU Data Governance Act, U.S. Evidence Act, and Singapore Digital Government policies with measurable…