Polish Data Governance Act is already into effect
On 23 July 2026, the Polish Data Governance Act of 27 March 2026 came into effect. It complements the provisions of Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European Data Governance Act), referred to as DGA, to the extent necessary to ensure the full functioning of that Regulation in the Polish legal order.
New competences of the President of the Personal Data Protection Office
With the entry into force of the Polish Data governance Act, the President of the Personal Data Protection Office became the competent authority for:
1. data intermediation services as referred to in Article 13 DGA;
2. the registration of data altruism organisations referred to in Article 23 DGA;
3. breaches of the obligations relating to the transfer of non-personal data to third countries referred to in Article 5(14) or Article 31 DGA.
Objectives of the DGA
The primary objective of the DGA is to increase trust in data sharing by establishing mechanisms to give data subjects and data holders more control over their own data. The new legal framework aims to foster the emergence of European data spaces (e.g. in the areas of health, mobility or the environment), remove barriers in the internal market and stimulate the development of a competitive and secure data economy that benefits citizens and businesses, including SMEs and start-ups.
Notification of data intermediation service providers to the President of the Personal Data Protection Office
From 23 July 2026, any provider of data intermediation services that intends to provide data intermediation services is obliged to submit a notification to the President of the Personal Data Protection Office (Art. 11(1) DGA). The necessary elements of the notification are set out in Art. 11(6) DGA. At the request of a provider of data intermediation services, the President of the Personal Data Protection Office confirms that the provider complies with Articles 11 and 12 DGA. Upon receipt of such confirmation, the provider of data intermediation services may, in its written and oral communication, use the label ‘data intermediation services provider recognised in the Union’ and use the common logo (Article 11(9) DGA).
Upon notification, the provider of data intermediation services may start operations subject to the conditions set out in Chapter III of the DGA. The notification to the President of the Personal Data Protection Office entitles the provider of data intermediation services to provide these services in all EU Member States.
What is a data intermediation service?
Data intermediation service means an activity which aims to establish commercial relationships for the purposes of data sharing between an undetermined number of data subjects and data holders on the one hand and data users on the other, through technical, legal or other means, including for the purpose of exercising the rights of data subjects in relation to personal data, (Article 2(11) DGA).
This concept does not include:
1. services that obtain data from data holders and aggregate, enrich or transform the data for the purpose of adding substantial value to it and license the use of the resulting data to data users, without establishing a commercial relationship between data holders and data users;
2. services that focus on the intermediation of copyright-protected content;
3. services that are exclusively used by one data holder in order to enable the use of the data held by that data holder, or that are used by multiple legal persons in a closed group, including supplier or customer relationships or collaborations established by contract, in particular those that have as a main objective to ensure the functionalities of objects and devices connected to the Internet of Things;
4. data sharing services offered by public sector bodies that do not aim to establish commercial relationships;
According to Article 10 of the DGA, data intermediation services include:
1. intermediation services between data holders and potential data users, including making available the technical or other means to enable such services; those services may include bilateral or multilateral exchanges of data or the creation of platforms or databases enabling the exchange or joint use of data, as well as the establishment of other specific infrastructure for the interconnection of data holders with data users;
2. intermediation services between data subjects that seek to make their personal data available or natural persons that seek to make non-personal data available, and potential data users, including making available the technical or other means to enable such services, and in particular enabling the exercise of the data subjects’ rights provided in Regulation (EU) 2016/679;
3. services of data cooperatives
Public register of providers of data intermediation services in the Union
Upon notification to the President of the Personal Data Protection Office, the supervisory authority shall forward the relevant information to the European Commission, which shall maintain and regularly update a public register of all data intermediation services providers in the Union. It is available at:
https://digital-strategy.ec.europa.eu/pl/policies/data-intermediary-services
Voluntary registration of data altruism organisations recognised in the Union
From 23 July 2026, any data altruism organisation may submit an application to the President of the Personal Data Protection Office for registration in the public national register of recognised data altruism organisations. The DGA provides for the voluntary registration of data altruism organisations without imposing any prohibitions on non-registered entities. In accordance with Art. 19(1) DGA an application for registration in the public national register of recognised data altruism organisations may be submitted by an entity that complies with the requirements set out in Article 18 DGA. Successful registration shall entitle the data altruism organisation to use the designation ‘data altruism organisation recognised in the Union’ and to use the common logo.
In accordance with Art. 19(5) DGA, if the applicant has submitted all the necessary information as set out in Art. 19(4) after assessing the application for registration and concluding that the entity complies with the requirements provided for in Article 18 DGA, the President of the Personal Data Protection Office shall register the entity in the public national register of recognised data altruism organisations within 12 weeks of receipt of the application for registration. Registration is valid in all Member States.
What is data altruism?
According to Article 2(16) of the DGA, data altruism should be understood as the voluntary sharing of data on the basis of the consent of data subjects to process personal data pertaining to them, or permissions of data holders to allow the use of their non-personal data without seeking or receiving a reward that goes beyond compensation related to the costs that they incur where they make their data available for objectives of general interest as provided for in national law, where applicable, such as healthcare, combating climate change, improving mobility, facilitating the development, production and dissemination of official statistics, improving the provision of public services, public policy making or scientific research purposes in the general interest;
Register of data altruism organisations recognised in the Union
The President of the Personal Data Protection Office keeps the public national register of recognised data altruism organisations in electronic form. In addition, the European Commission maintains an EU register for information, which is available at:
https://digital-strategy.ec.europa.eu/pl/policies/data-altruism-organisations
Contact request
All persons and entities interested in data intermediation services and data altruism, as well as the conditions for transferring non-personal data to third countries, are encouraged to contact the Department of Innovation and Data Management at PL SA directly:
📧 E-mail: dizd@uodo.gov.pl