The EU Data Act obliges manufacturers of connected products and providers of related services to share data with third parties chosen by the user. It also gives them something in return: a set of obligations on those third parties, and remedies when those obligations are broken.
On paper, that’s a balanced deal. In practice, the obligations on the receiving side are only worth what you can enforce. And enforcing them one recipient at a time doesn’t scale.
This is where data spaces stop being an abstract European policy ambition and become a practical answer to a very concrete problem.
What the recipient has signed up for
Under Article 6, a third party receiving data at the user’s request may process it only for the purposes and under the conditions agreed with the user, and must erase it when it’s no longer needed. It may not pass the data on to another third party unless agreed with the user, may not hand it to a designated gatekeeper, may not use it to develop a product that competes with the connected product it came from, and may not disregard the confidentiality measures agreed to protect trade secrets.
Under Article 11, if a recipient obtained data using false information, used it for unauthorised purposes, disclosed it unlawfully or broke the agreed protection measures, the data holder can require it to erase the data and all copies, in some cases to stop producing goods or services derived from it, to inform the user, and to compensate the party harmed. Data holders may also apply technical protection measures, such as smart contracts and encryption, provided these don’t discriminate between recipients or hinder users’ rights.
That’s a meaningful toolkit. But look at what it assumes.
What enforcement actually requires
To use any of these remedies, a data holder needs to know, reliably, four things.
Who the recipient is. Not a name typed into a form, but a verified legal entity that can be held to account.
That the request is genuinely authorised. The data holder must share at the request of the user or someone acting on their behalf. It needs evidence that this user actually asked for this data to go to this recipient, for this purpose, and it may only ask for the minimum information needed to establish that.
What terms apply. The purpose agreed with the user, the confidentiality measures agreed for trade secrets, the compensation agreed under the fair, reasonable and non-discriminatory conditions of Article 8. These have to be recorded somewhere both sides can point to.
What actually happened. Which data went where, when, under which authorisation. Without that record, a claim under Article 11 is an argument, not evidence.
Now multiply. A manufacturer with 50,000 users, each able to nominate any third party they choose, is not managing a handful of data-sharing agreements. It’s managing an open-ended network of relationships with parties it has never met, many of them small, some of them in other member states, a few of them looking for gaps. Negotiating every bilateral contract from scratch, and then policing it, is not realistic. Neither, for the recipient, is negotiating a completely different set of terms with every manufacturer whose products its customers use.
The Data Act doesn’t solve this for you. It tells you what outcome is required and gives you remedies. It leaves the machinery to you.
What a data space changes
EN 18235, the European standard for trusted data transactions, defines a data space as an environment that enables trusted data sharing between participating parties, based on an agreed governance framework together with an agreed set of policies, semantic models, processes and facilitating services. Those services can be implemented by one or more infrastructures, and a data space can serve one or more use cases. In practice, participants exchange metadata, data and claims under the rules and methods set out in a data space rulebook, and it is their shared adherence to that rulebook that makes trusted data transactions possible. It’s worth being clear about what a data space is not: a giant data warehouse or data lake in shared, centralised storage. The data stays with the participants; what they share is the rulebook. The governance comes first. The infrastructure follows.
Seen through the lens of the Data Act, that addresses each of the four enforcement problems above.
Identity. Participants are onboarded, and their identity as legal entities is verified once, by the data space, rather than by every data holder separately. When a request arrives, the data holder knows who is asking and that they’ve been admitted.
Common terms, agreed once. Joining a data space typically means accepting its rulebook, an accession agreement or terms of use that every participant signs. The bilateral data-sharing contract between a data holder and a recipient doesn’t disappear: it still covers what is specific to that relationship, such as which data, for which purpose, and on what compensation. But the common part, the obligations of Article 6, the data usage policies, confidentiality commitments, liability, audit rights and a dispute resolution route, has already been agreed by both sides through the rulebook. Each bilateral contract can refer to it instead of renegotiating it, which makes those contracts short and quick to conclude. The recipient’s core obligations are no longer something the data holder has to establish one contract at a time. They exist before the first request is made.
Verifiable authorisation. The user’s instruction to share their data with a specific recipient, for a specific purpose, can be expressed as a machine-verifiable delegation or consent record rather than an email. The data holder can check it automatically, and it doubles as evidence later.
Terms that travel with the data. Usage policies (purpose, retention, onward sharing) can be attached to each data offering in machine-readable form, so both sides and their systems work from the same statement of what’s allowed. This is exactly what Article 33 of the Data Act asks of participants in data spaces, and what the EN 18235 Trusted Data Transactions standard is being written to specify.
Accountability and consequences. Transactions are logged consistently, so a breach of the usage policies can be traced and evidenced. The rulebook can also attach consequences that apply across the data space, such as sanctions or suspension, instead of leaving each data holder to pursue a recipient on its own. For data holders, that makes the usage policies something they can actually rely on. For recipients, it works as a deterrent: breaking the terms with one data holder puts their standing with every participant at risk, not just one relationship. On the access side, the logic runs the other way. For recipients, one onboarding and one set of common terms opens the door to many data holders, which is a strong reason to join in the first place. Note what exclusion does not do: it doesn’t take away a user’s right under the Data Act to have their data shared with a third party of their choice. What the recipient loses is the common terms and the trust infrastructure that make that sharing quick and low-friction.
What a data space doesn’t do
It’s worth being honest about the limits. Once data has been delivered to a recipient’s systems, no rulebook or protocol can physically stop it being misused. Technical measures narrow the risk; they don’t eliminate it.
What a data space changes is not the possibility of misuse but the economics of it: who is accountable, how quickly it’s detected, how easily it’s proven, and what it costs the party responsible. For a data holder facing Data Act obligations at scale, that shift is the difference between remedies that exist on paper and remedies that can actually be exercised.
Two more caveats. Joining a data space is optional under the Data Act, and so it should be; the obligations in Articles 3 to 5 apply either way. And joining one brings its own obligations, notably the interoperability requirements of Article 33 for participants that offer data or data services to others. That’s a fair trade for most, but it is a trade.
The practical question
If you’re a data holder under the Data Act, the question worth asking isn’t “do we need a data space?” It’s “how will we know who we’re sharing with, prove they were authorised, bind them to terms, and act if they break them, for every user and every recipient, without a legal team in the loop for each one?”
If your answer involves a growing pile of bilateral contracts, each negotiated from scratch, it’s worth looking at whether a data space in your sector already solves most of it. And if there isn’t one yet, that may be the more interesting conversation.