Short answer
The EU Data Governance Act (DGA) separates roles by what an actor may do in a particular data-sharing transaction. A data holder has a legal right to grant access to or share specified data. A data user has lawful access and a right to use the data. A regulated data intermediation service connects an undetermined number of holders or data subjects with potential users to establish commercial sharing relationships, but must remain neutral and cannot exploit the shared data for another purpose. A re-user of protected public-sector data instead applies through the DGA's public-sector route and accepts safeguards set by the competent body. The DGA does not define “public-sector re-user” as a separate status.
Sectoral legislation can replace that horizontal map with a more specific one. The European Health Data Space Regulation (EHDS), for example, defines health data holders and health data users, inserts a public health data access body between them, and makes user status depend on a permit or approval. Those Chapter IV rules do not generally apply until 26 March 2029. Roles depend on the dataset and purpose, not an organisation's preferred label.
Start with the governing instrument, not the label
Regulation (EU) 2022/868, the DGA, has applied since 24 September 2023. It covers protected public-sector data re-use, regulated data intermediation services and recognised data-altruism organisations. It does not create a general right to obtain data, compel re-use or provide a personal-data legal basis.
Its two central sharing roles turn on legal entitlement:
“‘data holder’ means a legal person, including public sector bodies and international organisations, or a natural person who is not a data subject with respect to the specific data in question, which, in accordance with applicable Union or national law, has the right to grant access to or to share certain personal data or non-personal data;”
“‘data user’ means a natural or legal person who has lawful access to certain personal or non-personal data and has the right, including under Regulation (EU) 2016/679 in the case of personal data, to use that data for commercial or non-commercial purposes;” —
Possession is therefore insufficient. A hosting provider may physically store data without having authority to share them. A company may be a holder for one dataset and a user of another. For personal data, “data holder” also does not displace the General Data Protection Regulation's controller, processor and data-subject concepts.
What makes an intermediary different?
A DGA data intermediation service aims to establish commercial relationships for data sharing between an undetermined number of data subjects or holders and potential users, using technical, legal or other means. Article 2(11) excludes, among other things, a service that buys data, substantially enriches it and licenses its own resulting product without connecting holders to users; copyright-content intermediaries; services used by one holder or a contractually closed group; and non-commercial sharing services offered by public-sector bodies.
Covered services include marketplaces, exchange platforms and infrastructure linking holders to users, as well as services helping individuals make data available and data cooperatives. The provider must notify the national competent authority under Article 11. Its defining operational constraint is neutrality:
“the data intermediation services provider shall not use the data for which it provides data intermediation services for purposes other than to put them at the disposal of data users and shall provide data intermediation services through a separate legal person;” —
Article 12 adds fair and non-discriminatory access, restrictions on tying and data conversion, continuity, interoperability, security, logging and notice of unauthorised non-personal-data use. A marketplace cannot avoid this regime merely by calling itself a cloud, analytics or consent service; equally, a processor or closed supplier network is not automatically an intermediary.
Who is a re-user of protected public-sector data?
Chapter II addresses a different pathway. It covers data held by public-sector bodies and protected because of commercial or statistical confidentiality, third-party intellectual-property rights, or personal-data protection where the Open Data Directive does not apply. “Re-use” means use by a natural or legal person for a purpose other than the initial public task for which the data were produced. Exchange between public-sector bodies purely to perform their public tasks is excluded from that definition.
The public-sector body remains the decision-maker under national access law. Conditions must be non-discriminatory, transparent, proportionate and objectively justified. Depending on the data, the re-user may receive disclosure-controlled material, work only inside a secure processing environment, accept confidentiality duties, refrain from re-identification and satisfy third-country-transfer safeguards. Assistance with consent or permission does not manufacture missing authority.
This is why “public-sector re-user” needs care. It usually describes someone re-using data held by a public-sector body, not a separately defined DGA actor. The applicant can be a business, researcher, civil-society body or sometimes another public entity. If two public bodies exchange data purely within their public tasks, the transaction is outside the DGA definition of re-use.
How does the European Health Data Space change the map?
Regulation (EU) 2025/327 creates a sector-specific route for secondary use of electronic health data. It is enacted and in force, but Chapter IV—the secondary-use regime discussed here—applies from 26 March 2029. Until then, it should not be presented as an already operative permit system.
The EHDS definition of health data holder is broader and more sector-specific than the DGA definition. It can include healthcare and care bodies, reimbursement services, developers of health products or services, wellness-app manufacturers, health researchers, mortality registries and EU bodies. For personal electronic health data, it depends on a right or obligation under EU or national law to process as controller or joint controller for listed health-related purposes. For non-personal electronic health data, technical control over making the data available can suffice.
A health data applicant becomes a health data user only after lawful access is granted through the prescribed route:
“‘health data user’ means a natural or legal person, including Union institutions, bodies, offices or agencies, which has been granted lawful access to electronic health data for secondary use pursuant to a data permit, a health data request approval or an access approval by an authorised participant in HealthData@EU;” —
The health data access body is not simply a DGA intermediary. It is a public gatekeeper that assesses applications, issues or refuses permits, obtains the specified data from holders and provides access—normally anonymised where possible and otherwise pseudonymised—in a secure processing environment. Article 68 requires a permitted purpose, necessity and proportionality, GDPR Article 6(1) compliance, suitable expertise and adequate safeguards.
The holder and user then have opposite duties:
“Health data holders shall make relevant electronic health data referred to in Article 51 available upon request to the health data access body, in accordance with a data permit issued pursuant to Article 68, or upon a health data request approved pursuant to Article 69.”
“Health data users may access and process the electronic health data referred to in Article 51 for secondary use only in accordance with a data permit issued pursuant to Article 68, a health data request approved pursuant to Article 69 or, in situations referred to in Article 67(3), an access approval from the relevant authorised participant in HealthData@EU referred to in Article 75.” —
Users may not give access to unlisted third parties or attempt re-identification. Permits are purpose-bound, Article 54 prohibits uses such as advertising and certain detrimental decisions, and results must generally be made public in anonymous form. Health-data access does not suspend the GDPR: the application and permit assessment expressly require data-protection compliance.
The EHDS also shows how sectoral rules can displace horizontal details. Its Article 68 sets a specific permit deadline “[b]y way of derogation” from the DGA, and Article 62 disapplies the DGA fee rule where the health-data holder is a public-sector body. Sectoral rules therefore supplement or override particular DGA mechanics rather than merely renaming the actors.
Do not import Data Act roles into another regime
The Data Act, Regulation (EU) 2023/2854, uses adjacent but different vocabulary. Its “user” owns or has temporary contractual rights to a connected product, or receives a related service. Its “data recipient” is a business recipient other than that user. Its “data holder” has a right or obligation to use and make data available under that Regulation or other applicable law. It expressly imports the DGA definition of “data intermediation service”, but not a universal definition of every data-space role.
Before classifying an actor, ask:
- Which regulation and which dataset govern the transaction?
- What legal right, obligation, permit or approval supports access and use?
- Is the actor connecting an open-ended market, deciding access, supplying data or using it?
- Is the purpose the original public task, DGA re-use, or sectoral secondary use?
- Are personal data involved, and which GDPR controller, processor and lawful-basis analysis applies?
- Is the sectoral rule already applicable, and does it derogate from a DGA procedure?
Conclusion
EU data-space roles describe legal functions, not permanent identities. Under the DGA, holders control lawful sharing, users possess lawful access and use rights, neutral intermediaries connect an open-ended market, and public-sector re-users follow a protected-data access route. The EHDS adds a sector-specific, permit-based chain in which health data access bodies stand between broadly defined holders and authorised users, principally from March 2029. Classification should therefore begin with the applicable act, dataset, purpose and date—not the organisation's preferred label.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.