Data Intermediaries: The Data Governance Act’s Neutral Referee

A company wants to share data with other organisations in its sector, but it does not want to rely on a major technology platform that, in addition to facilitating connections, could use that data for its own commercial purposes or to train its own products. At the same time, organisations that need the data do not want to negotiate bilateral agreements with dozens of different providers, each with their own terms and conditions. Both sides need a neutral party to connect them, without taking ownership of anything along the way.

This is the need addressed by the European Data Governance Act (DGA) through the introduction of data intermediaries. This is not an abstract concept or a marketing label: it is a legal category with specific requirements, a registration regime and neutrality obligations that any company wishing to operate as a data intermediary must meet.

For executives, legal professionals and entrepreneurs exploring business models in the data economy, understanding exactly what a data intermediary is, what it can and cannot do, and how it relates to other entities such as metadata brokers and clearing houses within a data space is the starting point for designing services that comply with regulations from the outset and build trust among organisations that need to share information.

What is a data intermediary under the Data Governance Act?

The Data Governance Act defines data intermediation services as services that establish a commercial relationship between an indeterminate number of data subjects or data holders, on the one hand, and data users, on the other, with the aim of facilitating data sharing between them. Two key elements distinguish this definition from other digital services:

Neutrality: intermediaries cannot use the data they handle for purposes other than providing intermediation services, nor can they use the information exchanged by their customers to favour their own products or services.

Separation of activities: if an organisation provides data intermediation services, that activity must be structurally separate from any other activity in which the organisation uses data for its own purposes.

This category was introduced precisely to address a risk that concerned European lawmakers: large data intermediation providers could use their privileged access to information flows to compete unfairly with their own customers or train their own products using third-party data. The DGA addresses this risk by making neutrality a condition of the activity, rather than a voluntary commercial promise.

The regulation covers both intermediaries that connect businesses with one another (business-to-business) and those that enable individuals to exercise control over their personal data, including personal data intermediation services and personal data spaces.

How these services are registered and supervised

The Data Governance Act does not require prior authorisation to operate as a data intermediary, but it does establish a mandatory notification regime. Any organisation wishing to provide these services must notify the competent authority in the Member State where it has its main establishment, providing information about its identity, corporate structure and a description of the service it intends to offer.

Once notified, the competent authority includes the provider in a public register. This allows any company or public administration to check whether a provider it intends to work with is officially recognised as a data intermediary under the regulation. In Spain, this responsibility for acting as the competent and supervisory authority lies with the bodies designated for this purpose under the regulations implementing the Act.

Supervision does not end once registration has taken place. Competent authorities may request information, investigate potential breaches of the neutrality and separation-of-activities requirements and, in cases of serious or repeated non-compliance, prohibit the provision of the service. This ongoing oversight is what gives the label "data intermediary" its credibility: it is not enough to declare yourself neutral; you must demonstrate this to an authority and maintain that neutrality over time.

For companies deciding whom to trust with their data, this public register is a practical due diligence tool. Before signing a data-sharing agreement with a third party, checking whether that provider appears as a notified data intermediary offers an additional assurance that it operates under the DGA's neutrality obligations.

How data intermediaries relate to brokers and clearing houses in a data space

When designing a modern data space, two components are particularly relevant to the DGA concept of data intermediation, although there are important distinctions.

The metadata broker as a neutral catalogue

The metadata broker, or federated catalogue, is the component that allows organisations to publish and discover datasets available within the data space. Each dataset is described using shared vocabularies and can be exported in standard formats such as DCAT-AP-ES. Its role is closely aligned with the purpose of data intermediation under the DGA: connecting data providers with those who need the data, without accessing the data content itself or acquiring rights over it. The broker does not decide which data is relevant or exploit it; it simply makes datasets visible and discoverable under common rules.

The clearing house as a trusted third party

The clearing house plays a complementary role: it is the trusted third party that records data-sharing agreements and the transfers actually carried out within the data space. It does not access the content of the data being transferred. Instead, it certifies that a transfer has taken place, between which parties and under what conditions, creating an auditable record that can serve as evidence in the event of a dispute. This technical attestation role is consistent with the spirit of neutrality that the DGA requires of data intermediaries: the clearing house does not participate in the value generated by the data; it simply guarantees the traceability of the exchange.

Neither the broker nor the clearing house replaces the notification procedure required by the DGA if the organisation operating the data space also provides data intermediation services in the strict legal sense of the regulation. However, both components are designed around the same principles of neutrality and separation of interests that the European regulation seeks to safeguard. This makes it easier for a data space to operate in alignment with the DGA from the outset, through its technical architecture.

Data altruism

In addition to data intermediaries, the Data Governance Act introduces another related concept: data altruism. This allows individuals and companies to make their data available voluntarily and without financial compensation for purposes of general interest, such as scientific research or public policy.

To facilitate this type of data sharing securely, the regulation allows organisations that support it to register as "recognised data altruism organisations". These organisations are also subject to requirements concerning transparency, non-profit purposes and the protection of the interests of those making their data available. Although this concept is more relevant to research and public administration than to commercial data sharing between businesses, it is particularly relevant to public authorities in Castile and León seeking to enable the reuse of public-sector data or encourage the voluntary sharing of private data for purposes of general interest, such as territorial studies or improvements to public services.

An example applied to the regional data economy

Consider a business association in Castile and León that wants to offer its members a market data-sharing service: aggregated information on demand, benchmark prices or sector-specific indicators, voluntarily provided by each member company. If the association wants to operate as a data intermediary under the DGA, it must notify the competent authority, ensure that it does not use the data for its own commercial benefit and keep this activity separate from any other services it provides to its members.

By relying on a data space with a metadata broker and a clearing house, the association can build this service on infrastructure that already incorporates agreement traceability and neutral access to data. This reduces the effort required to comply with regulations and provides additional safeguards for the companies that choose to participate.

Before launching an intermediation service

If your organisation is considering offering data intermediation services, it is worth checking from the outset whether the proposed business model is compatible with the neutrality and separation-of-activities obligations established by the Data Governance Act, as well as identifying the notification procedure that applies in the Member State where the organisation is established.

Data space platforms provide companies and public administrations with infrastructure aligned with these principles, including catalogue and clearing house components designed to facilitate trusted data sharing. If you want to understand how your project fits into this framework, look for a technology partner with experience in data spaces and address any questions before taking the first step.