The EU Data Governance Act: What It Means for Irish Businesses

The EU Data Governance Act is Regulation (EU) 2022/868. It is a framework regulation about how data is shared. According to the European Commission, it aims to increase trust in data sharing, strengthen mechanisms for data availability and overcome technical obstacles to data reuse. It matters if you want to reuse protected public sector data, operate a data sharing service, or work with organisations that do. This guide explains the main parts in plain language and how they apply in Ireland.

It also helps to see where it sits among your wider data responsibilities. If your team is already thinking about how staff tools reach company data, our guide to Microsoft 365 Copilot data governance and permissions covers a related, but separate, internal governance question.

What the Act is and when it applies

The Commission's Data Governance Act page (last updated 3 July 2026) says the Act entered into force on 23 June 2022 and, after a 15-month grace period, has applied since September 2023. The text on EUR-Lex describes the Regulation as laying down four things in Article 1:

• conditions for the re-use, within the Union, of certain categories of data held by public sector bodies;
• a notification and supervisory framework for the provision of data intermediation services;
• a framework for voluntary registration of entities which collect and process data made available for altruistic purposes; and
• a framework for the establishment of a European Data Innovation Board.

The Commission's "Data Governance Act explained" page says both personal and non-personal data are in scope, and that the GDPR governs personal data. The Regulation's own text goes further: Article 1 says that if the Regulation conflicts with Union data protection law, the relevant Union or national law on the protection of personal data prevails, and that the Regulation does not create a legal basis for processing personal data.

Reuse of public sector data

The first pillar covers data held by public sector bodies that is protected for certain reasons. Article 3 of the Regulation lists commercial confidentiality (including business, professional and company secrets), statistical confidentiality, protection of third-party intellectual property rights, and the protection of personal data insofar as it falls outside Directive (EU) 2019/1024, the Open Data Directive. The Commission's explainer says the Act covers protected data that the Open Data Directive does not address.

Three points are worth knowing if you hope to use such data:

• No automatic right. Article 1 states that the Regulation does not create an obligation on public sector bodies to allow re-use of data. It sets conditions for when they do.
• Safeguards. The Commission lists anonymisation, pseudonymisation, secure processing environments and confidentiality agreements as examples of safeguards.
• Timing and fees. The Commission says a public sector body will have up to two months to decide on a reuse request, that fees may not exceed necessary costs, and that reduced or no fees should apply to research, non-commercial purposes, SMEs and start-ups. It also says each Member State must set up a single information point.

Data intermediation services

Article 2 defines a data intermediation service as "a service which aims to establish commercial relationships for the purposes of data sharing", with a list of exclusions. The Commission's explainer describes such providers as neutral third parties. Per that page, they may charge for facilitating sharing but cannot use the intermediated data for financial profit, must be legally separated from their other services, and may use acquired data and metadata only to improve the intermediation service. They must notify the competent authority before operating, and after confirmation may use the label "data intermediation services provider recognised in the Union".

Our suggestion: if your organisation is a software or data platform business, check the Article 2 definition and its exclusions against what you actually offer before assuming either way. Our reading: a key element of the definition is a service that aims to establish commercial relationships for data sharing, and the definition continues with further conditions and a list of exclusions, so read the full text of Article 2.

Data altruism

Article 2 defines data altruism as the voluntary sharing of data on the basis of the consent of data subjects, or permissions of data holders, without seeking a reward beyond cost compensation, for objectives of general interest. The Commission says organisations that facilitate this must be not-for-profit, and that registration as a "data altruism organisation recognised in the Union" is voluntary. For ordinary commercial businesses this is unlikely to be a direct obligation, but you may be asked to take part in such schemes by a research partner or public body.

The European Data Innovation Board

The Commission says the Board shares best practice and prioritises cross-sectoral interoperability standards. Its members include Member State competent authorities, the European Data Protection Board, the European Data Protection Supervisor, ENISA, the Commission and an EU SME envoy.

How the Act is applied in Ireland

The Competition and Consumer Protection Commission (CCPC) says on its Data Governance Act page that it is the competent authority for the Act, registering, monitoring and supervising data intermediation services providers and data altruism organisations established in Ireland. The CCPC cites S.I. No. 734 of 2024, the European Union (Data Governance Act) (No. 2) Regulations 2024. The Irish Statute Book shows these were made on 19 December 2024, designate the CCPC, require a national register of recognised data altruism organisations, and provide for information notices, contravention notices, appeals and offences. This guide does not set out penalties; read the Regulations if you need them.

The CCPC page says Irish-established providers must notify before starting their service, and that a standardised declaration will be provided within one week of receiving a completed notification. It says registration as a data altruism organisation is voluntary. That page shows no publication or last-updated date, so confirm the current process with the CCPC.

Practical steps for an Irish business

These are our suggestions, not legal requirements.

• Decide whether you are in scope at all. Most organisations are not intermediaries or altruism organisations. If you are unsure, take advice.
• Know what data you hold and why. Documents such as your GDPR records of processing already map data flows and are a good starting point for any data sharing project.
• If you plan to reuse public sector data, start with the public body's information point and expect questions about anonymisation, purpose and security.
• Strengthen your own data foundations. Sharing data is only useful if the data is reliable; our guide to data quality and regulatory reporting controls covers the checks that matter.
• Check the current position. The Commission's Data Union Strategy page says it was published alongside a Digital Omnibus proposal to modernise and consolidate EU data laws. Proposals like this can change dates and rules, so check the current text before acting.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does the Data Governance Act apply to every Irish business?

No. It is mainly relevant to public sector bodies that hold protected data, providers of data intermediation services, and data altruism organisations. Other businesses may be affected indirectly, for example as users of reused data.

Is it the same as the Data Act?

No. The Data Governance Act is Regulation (EU) 2022/868. The Data Act is Regulation (EU) 2023/2854 and deals with access to data from connected products and cloud switching, among other things. The Commission describes both as part of its European data strategy.

Who supervises it in Ireland?

The CCPC describes itself as the competent authority for the Act, and S.I. No. 734 of 2024 designates it for data intermediation services and data altruism registration.

Does the Act override the GDPR?

No. Article 1 says that in a conflict, the relevant Union or national law on the protection of personal data prevails, and that the Regulation does not create a legal basis for processing personal data.

Where can I check the current rules?

Use the Commission's Data Governance Act pages, the EUR-Lex text and the CCPC's page, and take professional advice for specific cases.

In short, the Act matters most to those who share, broker or reuse protected data, so start by working out which, if any, applies to you.