Data Governance Act (DGA) Guide: how to achieve compliance?
·
Updated on ·
By 
Bertrand Bucelle · 6 min read
In brief
- The Data Governance Act (DGA) establishes the governance framework for data sharing in Europe. Achieving compliance is primarily relevant to those seeking to become data intermediaries, promote data altruism, or re-use public sector data: it requires adherence to rules of neutrality, trust, and transparency.
What is the Data Governance Act?
The DGA aims to establish the trust necessary for data sharing within the Union. Its premise: a great deal of data goes unshared due to the absence of a clear trust framework. The DGA creates that framework, with neutral actors and transparent rules.
It does not create a right of access to data (that is the role of the Data Act), but organises the conditions for sharing: how to reuse certain public data, how a neutral intermediary can connect data holders and data users, and how to encourage the donation of data for purposes of general interest.
It is a foundational text for the data ecosystem, particularly for actors looking to build trusted data-sharing platforms or services.
The four contributions of the DGA
The DGA rests on four complementary pillars. Identifying where your project fits among them is the first step.
| Pillar | What it governs |
|---|---|
| Re-use of public data | Re-use of protected data held by the public sector |
| Data intermediaries | Neutral services connecting data holders and data users |
| Data altruism | Voluntary sharing of data for general-interest purposes |
| Data spaces | Framework for sector-specific sharing spaces (health, mobility, etc.) |
Who is affected?
The DGA primarily concerns data sharing actors, but also organisations that wish to reuse public data or participate in data spaces.
- Data intermediation service providers: notification and neutrality obligations.
- Data altruism organisations recognised in the Union.
- Public sector bodies holding reusable data.
- Organisations reusing public data or participating in sectoral data spaces.
DGA, Data Act and GDPR
The DGA is part of a broader framework: it replaces neither the Data Act nor GDPR, but complements them.
- Data Act: creates concrete access rights; the DGA creates the governance and trust for data sharing.
- GDPR: applies whenever personal data is shared or reused.
- Neutrality: data intermediaries may not exploit data on their own behalf.
- Complementarity: DGA (framework) + Data Act (rights) + GDPR (protection) form the European data strategy.
What penalties apply in the event of non-compliance?
Penalties are set by Member States and must be effective, proportionate, and dissuasive. Infringements relating to personal data are also subject in parallel to GDPR.
| Area | Penalty | Authority |
|---|---|---|
| Intermediary infringements | National penalties, withdrawal of recognition | Authorities designated by each Member State |
| Non-compliant altruism | Loss of recognised organisation status | Competent authorities |
| Personal data | Up to €20 M or 4% of global turnover | Data protection authorities (CNIL) |
Common mistakes to avoid
- Confusing the DGA (governance and trust) with the Data Act (concrete access rights).
- Omitting the mandatory notification requirement for data intermediaries.
- Overlooking the neutrality requirement, which is at the core of the intermediation model.
- Forgetting the interplay with GDPR whenever personal data is in circulation.
- Reusing public data without complying with applicable protection conditions.
- Underestimating the importance of documentation and transparency in building trust.
Take action
Take action with Data Comply One: all-in-one compliance software and outsourced DPO/CISO experts.
Test my compliance →Request a demo →
How to achieve compliance: the 6-step roadmap
Step 1 — Positioning your project within the DGA
Determine whether you fall within the scope of the DGA and in what capacity: data intermediary, data altruism organisation, re-user of public data, participant in a data space.
This qualification determines the full scope of your obligations.
Step 2 — If acting as an intermediary: register and ensure neutrality
Data intermediation service providers must register with the competent authority and comply with strict neutrality obligations: no use of data for other purposes, guaranteed fairness and security.
Neutrality is the core of the model: it distinguishes the trusted intermediary from platforms that exploit data.
Step 3 — If acting under data altruism: structuring general-interest sharing
For data altruism, comply with the conditions for recognised-organisation status: transparency, information to individuals, security safeguards, and general-interest purposes.
This framework facilitates the donation of data for research or public policy purposes, with full confidence.
Step 4 — If re-using public-sector data
Comply with the conditions for re-using protected data held by public-sector bodies (confidentiality, intellectual property, personal data) and the technical modalities imposed.
Re-use is regulated: it must not compromise the protection of the data concerned.
Step 5 — Articulating with the GDPR and the Data Act
Whenever personal data are involved, apply the GDPR (legal basis, information, security, rights). Also coordinate your approach with the Data Act if you exercise data access rights.
The DGA never exempts you from the GDPR: it adds to it.
Step 6 — Documenting and securing
Formalise your compliance: neutrality, transparency, security, sharing conditions. Keep documentation ready for the competent authority.
Trust, which is at the heart of the DGA, rests on documented and verifiable safeguards.