“Data trust” is a popular label. In English law a trust needs property for the trustee to hold. The courts have been reluctant to treat information as property, and data protection rights are personal statutory rights, not assets that can be handed to a trustee. A data trust is usually something else under that name.
Agency is the natural fit
In an agency, the individual (the principal) authorises the intermediary (the agent) to act within a defined authority. Courts understand agency. So do the organisations that receive an agent’s requests. Authority can be limited, evidenced and revoked.
Agency also brings fiduciary duties. An agent must be loyal to the principal, avoid conflicts of interest, and make no undisclosed profit from the position.
The conflict in the business model
Many intermediary models earn revenue from the use of the data they control access to. A fiduciary can profit from its position only with the principal’s fully informed consent. The remuneration model therefore has to be designed and disclosed from the start. It cannot be added later.
Regulation points the same way. The EU Data Governance Act requires neutrality and a duty to act in individuals’ best interests. California limits what an authorised agent may do with consumer data.
The company behind it
Directors of a company owe their duties to the company, not to its users. Duties to users have to come from contract, from agency law or from statute. Some founders use a purpose-driven corporate form, such as a Delaware public benefit corporation, to write the mission into the company itself.
Questions to settle first
Who owes duties to whom? What exactly is the agent authorised to do? How is authority revoked? How is the intermediary paid? What happens to the data and the mandates if the company is sold or fails?
This article is general information on the law as at October 2026. It is not legal advice and has not been updated since that date. See the terms of use.