The Global Centre for Risk and Innovation (GCRI)
Data sharing arrangements let people and organizations share data for services, research and markets, ideally with consent and control. Data spaces, consent managers and data protection law shape what can be shared, by whom and under what safeguards. This page sets out how data sharing is governed, how rights are protected and measured, and what evidence serves the regulators, data stewards and people involved.
GCRI · In development · service level R0
Data spaces are frameworks of rules, standards and technology that let participants share data under agreed conditions while keeping control. Combined with data protection law, consent tools and enforcement, they decide whether data sharing serves people and respects their rights.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India; each layer is a dated NASA product.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 2
Connected activity
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Data spaces and rights · Data exchange · Quarter 3
| Benefit eligibility | 5140 | 94 | 86 |
| Credit scoring | 1327 | 63 | 226 |
| Health record share | 2719 | 62 | 65 |
Sovereign and personal data governance. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Consent is valid only when informed, specific and freely given. Long terms and take-it-or-leave-it choices undermine it.
Data spaces provide common rules, standards and trust mechanisms so participants can share data while keeping control.
Tools that show who holds data, let people grant and revoke access and see use make rights practical.
Without regulators that have the staff and powers to investigate and sanction, data rights remain on paper.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Data intermediary | An organization that facilitates data sharing between holders and users under defined rules. |
| Consent revocation | A person's withdrawal of permission for their data to be used or shared. |
| Purpose limitation | The principle that data collected for one purpose should not be used for incompatible purposes. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Countries with data protection laws | count | annual | UNCTAD tracker | OFFICIAL |
| Data protection authority enforcement actions | count | annual | Authority reports | OFFICIAL |
| Consent-based data sharing transactions | count | monthly | Consent manager records | OBSERVED |
| Data access requests by individuals | count | annual | Organization and authority records | REPORTED |
| Sectoral data spaces in operation | count | per assessment | Programme records | REPORTED |
| Public trust in data sharing | percent of respondents | per survey | Public attitude surveys | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| UNCTAD Data Protection and Privacy Legislation Worldwide | Status of laws by country | Public, UNCTAD terms |
| European Data Protection Board and national authority reports | Enforcement and guidance | Public, EU and national terms |
| EU Data Governance Act and Common European Data Spaces documentation | Rules and design for data spaces | Public, EU terms |
| International Data Spaces Association and Gaia-X specifications | Technical frameworks for data spaces | Public, terms to check |
| OECD work on data governance and trust | Policy analysis of data sharing | Public, OECD terms |
Digital Public Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Data protection authorities | Where to focus guidance and enforcement | Enforcement analyses |
| Governments and sector regulators | How to design data sharing frameworks | Governance reviews |
| Data stewards | How to give people practical control | Consent mechanism assessments |
Data held by public bodies and private firms can improve services, research and planning, but it can also be misused for surveillance, discrimination or commercial exploitation. People often have little visibility of where their data go. States worry about data held abroad or by foreign providers. Good data governance tries to unlock value while keeping control and accountability with the right parties.
Data governance combines legal rights, technical controls and institutions.
Rights to information, access, correction, objection and redress, set by law and enforced by authorities and courts.
Consent managers, access policies and audit logs that record who used which data for what. Consent alone is weak where power is unequal.
Rules on where data are stored and which laws apply. Localization can protect control but can also raise costs and fragment services.
A recurring finding is that rights on paper need infrastructure to work in practice. People cannot exercise a right to know who accessed their records if access is not logged, or a right to correct errors if there is no simple route to do so. Designing these mechanisms into data exchange from the start costs far less than adding them later.
Comparison of data protection and data sharing laws. Enforcement capacity often matters as much as the text.
Techniques such as anonymization, aggregation and secure computation reduce exposure. Re-identification risk remains for rich datasets.
Logs and reports of data access, designed with data engineering, interoperability and stewardship. They are only useful if someone independent reviews them.
Surveys and deliberation on what people consider acceptable use. Attitudes differ across contexts and change over time.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.