The Data Governance Act (Regulation (EU) 2022/868) has applied since September 2023. It created a regulated category of business: the data intermediation service. That covers services that set up commercial relationships for sharing data between individuals or data holders and data users, including services that help individuals exercise their GDPR rights.
The rules today
A provider must notify the competent authority in its Member State before it starts. A provider based outside the EU that offers the service in the EU must appoint a legal representative there. The conditions are strict. The provider may not use the data for its own purposes. The service must be run through a separate legal person. Access must be fair, transparent and non-discriminatory. A provider serving individuals must act in their best interests. In return, a notified provider can use the EU label for recognised intermediaries.
The rewrite
In November 2025 the Commission’s Digital Omnibus proposed to repeal the Act and move its content into the Data Act. For intermediaries, registration would become voluntary, legal separation would become functional separation, and the list of obligations would be shorter. The AI part of the Omnibus became law in July 2026. The data part has not: as of September 2026 it was still at first reading, with no agreed Council position.
What this means now
The mandatory regime still applies. A proposal is not the law.
Design for both outcomes. Even a voluntary label may be commercially necessary if controllers are to trust requests from an intermediary.
The GDPR sits on top. The Act gives no legal basis for processing personal data and does not oblige a controller to respond to an intermediary. The same Omnibus also proposes changes to the GDPR right of access that would make some requests easier to refuse.
This article is general information on the law as at October 2026. It is not legal advice and has not been updated since that date. See the terms of use.