GCRI · Digital Public Infrastructure
Data spaces and rights
Data sharing arrangements let people and organisations share data for services, research and markets, ideally with consent and control. Data spaces, consent managers and data protection law shape what can be shared, by whom and under what safeguards. This page sets out how data sharing is governed, how rights are protected and measured, and what evidence serves the regulators, data stewards and people involved.
Data spaces and rights in seven parts.
- 01The questionData spaces and rights: how the risk develops
- 02Across the domainsData spaces govern sharing across domains
- 03IndicatorsWhat is measured, and how well
- 04SourcesWhere the evidence comes from
- 05DecisionsWho decides, and what the evidence serves
- 06Core questionsWhat experts ask
- 07MechanismsDrivers and processes
Data spaces and rights: how the risk develops.
Sovereign and personal data governance. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Consent must be meaningful
Consent is valid only when informed, specific and freely given. Long terms and take-it-or-leave-it choices undermine it.
Data spaces set rules for sharing
Data spaces provide common rules, standards and trust mechanisms so participants can share data while keeping control.
People need control tools
Tools that show who holds data, let people grant and revoke access and see use make rights practical.
Enforcement gives rights force
Without regulators that have the staff and powers to investigate and sanction, data rights remain on paper.
Consent and inclusion board.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Consent and inclusion board
Data spaces and rights · Data exchange · Quarter 3
Consent artefacts
| Benefit eligibility | 5140 | 94 | 86 |
| Credit scoring | 1327 | 63 | 226 |
| Health record share | 2719 | 62 | 65 |
Inclusion
Data spaces govern sharing across domains.
Findings are designed for the Evidence Brief series. The EU Data Act (2023) and data space initiatives set the frame.
- Data sharing agreements.
- Governance evaluations.
How data spaces and rights is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Datasets and provenance
The data classes behind data spaces and rights and what is recorded about each before it is used.
| Data class | Provenance recorded | Resolution stated | Licence checked |
|---|---|---|---|
| Satellite imagery, optical and radar | sensor, processing level, acquisition date | pixel size and revisit | per scene |
| Reanalysis and climate model output | model, experiment, member, version | grid and time step | per release |
| In-situ sensors and gauges | station, instrument, calibration record | point and sampling rate | per network |
| Population and asset exposure | method, vintage, input sources | cell size and unit | per release |
| Boundaries and reference geography | producer, edition, date | scale | per edition |
- Lineage
- W3C PROV record from source to figure
- Principles
- FAIR: findable, accessible, interoperable, reusable
- Gaps
- shown as missing, never filled silently
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Countries with data protection laws | count | annual | UNCTAD tracker | Published statistics |
| Data protection authority enforcement actions | count | annual | Authority reports | Published statistics |
| Consent-based data sharing transactions | count | monthly | Consent manager records | OBSERVED |
| Data access requests by individuals | count | annual | Organisation and authority records | REPORTED |
| Sectoral data spaces in operation | count | per assessment | Programme records | REPORTED |
| Public trust in data sharing | percent of respondents | per survey | Public attitude surveys | REPORTED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| UNCTAD Data Protection and Privacy Legislation Worldwide | Status of laws by country | Public, UNCTAD terms |
| European Data Protection Board and national authority reports | Enforcement and guidance | Public, EU and national terms |
| EU Data Governance Act and Common European Data Spaces documentation | Rules and design for data spaces | Public, EU terms |
| International Data Spaces Association and Gaia-X specifications | Technical frameworks for data spaces | Public, terms to check |
| OECD work on data governance and trust | Policy analysis of data sharing | Public, OECD terms |
Who decides, and what the evidence serves.
Digital Public Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Data protection authorities | Where to focus guidance and enforcement | Enforcement analyses |
| Governments and sector regulators | How to design data sharing frameworks | Governance reviews |
| Data stewards | How to give people practical control | Consent mechanism assessments |
Outputs this topic produces
- Data sharing governance reviews
- Consent and control mechanism assessments
- Enforcement capacity analyses
- Evidence notes for data strategies
What experts ask.
Data held by public bodies and private firms can improve services, research and planning, but it can also be misused for surveillance, discrimination or commercial exploitation. People often have little visibility of where their data go. States worry about data held abroad or by foreign providers. Good data governance tries to create value while keeping control and accountability with the right parties.
- Who has the right to decide how data are used: the person, the collecting institution, the state or some combination?
- How is consent obtained, recorded and withdrawn, and is it meaningful when the alternative is losing a service?
- What technical and legal measures keep data use within its stated purpose?
- How do national data rules interact with cloud hosting and cross-border data flows?
Drivers and processes.
Data governance combines legal rights, technical controls and institutions.
Personal data protection
Rights to information, access, correction, objection and redress, set by law and enforced by authorities and courts.
Consent and purpose
Consent managers, access policies and audit logs that record who used which data for what. Consent alone is weak where power is unequal.
Jurisdiction and hosting
Rules on where data are stored and which laws apply. Localisation can protect control but can also raise costs and fragment services.
A recurring finding is that rights on paper need infrastructure to work in practice. People cannot exercise a right to know who accessed their records if access is not logged, or a right to correct errors if there is no simple route to do so. Designing these mechanisms into data exchange from the start costs far less than adding them later.
How the evidence is built, and its limits.
- 01
Legal analysis
Comparison of data protection and data sharing laws. Enforcement capacity often matters as much as the text.
- 02
Privacy-enhancing technologies
Techniques such as anonymisation, aggregation and secure computation reduce exposure. Re-identification risk remains for rich datasets.
- 03
Audit and transparency
Logs and reports of data access, designed with data engineering, interoperability and stewardship. They are only useful if someone independent reviews them.
- 04
Public attitudes research
Surveys and deliberation on what people consider acceptable use. Attitudes differ across contexts and change over time.
How it is studied, and what the methods cannot say.
- 01Data engineering, interoperability and stewardshipSecure data exchange layers · Common data models · Consent-based sharingApplied here
- 02Cybersecurity and cryptographyThreat modelling DPI components · Protecting identity databasesApplied here
- 03Digital identity and public digital systemsAssurance design for services · Verifiable credentials · Exclusion error analysisApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
What is a data space?
What makes consent valid?
What is a consent manager?
Is consent enough to protect people?
Does data localisation improve security?
Does the platform process personal data for research?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.