Frequently asked questions about data spaces.

Data sharing, standards, APIs, smart contracts, governance, identity, trust: most building blocks of a data space aren’t new. The concept dates back to 2005 (academic “dataspaces”) and gained industrial traction through Germany’s Industry 4.0. What’s new is the scale and the mandate: the European Commission has made data spaces a pillar of the Digital Single Market, the default model for governed data sharing across more than twenty sectors and across borders.

Data lakes centralise data; data spaces federate it. Data remains at source, and interoperation relies on shared governance, identity and trust services, catalogues and machine-readable contracts and policies.

They combine them with governance (roles, onboarding, rulebook), trust (identity, attestations, labels), semantic and technical interoperability, usage control (machine-readable policies and contracts) and collaboration tools.

The rulebook codifies, in a machine-readable format, eligibility, responsibilities, policies for data and products, assurance and dispute processes, and technical profiles for connectors and catalogues. It is the basis for onboarding and accountability across the data space lifecycle. All data-sharing contracts must comply with it: it aligns participants and reduces negotiation time.

Through a trust framework (identity, attestations, accepted trust anchors, revocation, labels and certifications) and auditable processes, such as the Gaia-X Trust Framework and labelling.

Common European Data Spaces are EU-driven sector or domain initiatives; the Commission lists 75. Many initiatives are not on that list, when launched by companies, cities or Member States, such as EONA-X. They often connect to it: EONA-X and the German Mobility Data Space are both key stakeholders of the European Mobility Data Space.

Counting both Common European Data Spaces and local initiatives, there are around 150 data spaces.

Initiatives span agriculture, energy, mobility, tourism, health, media, public administration, research, skills and more. The Commission identified 14 sectors, but initiatives exist in more than 25.

GDPR (since May 2018); the Data Governance Act (since September 2023, with a possible integration into the Data Act under the digital omnibus); the Data Act (most provisions apply since September 2025); the AI Act (in force since August 2024, with phased obligations).

Yes. Digital Europe and Horizon Europe fund many initiatives, and several Member States (France, Germany, Spain, Portugal, Luxembourg, the Netherlands…) support data spaces. The Data Spaces Support Centre (DSSC) publishes free blueprints and starter kits covering business, legal, operational and technical aspects.

The Dataspace Protocol (DSP), implemented by Eclipse Dataspace Components (EDC) among others, is the most widely used protocol for contract negotiation and data exchange. DCAT for catalogues and ODRL for policies are also very common. Key reference organisations: DSSC, IDSA, Gaia-X, FIWARE, EDC, Prometheus-X, MyData, Solid, iSHARE, Pontus-X, Simpl, BDVA, Sitra, Fraunhofer, Digital New Deal.

No. The EU promotes openness and interoperability rather than a single product. Open-source and commercial components coexist, as long as they conform to the rulebook and common protocols. There are many stacks (Simpl, EDC, Prometheus-X, Pontus-X, FIWARE, iSHARE) and integrators (Amadeus, Visions, Sovity, deltaDAO…).

No. Many data spaces rely on web standards, verifiable credentials and policy-based usage control. Distributed ledgers are optional, for notarisation or multiparty logs. Pontus-X is one of the most used blockchain-based technologies in data spaces.

Yes. Data stays where it is: you expose data products through a connector and policies that conform to the rulebook and protocol (DSP/EDC, Prometheus-X). The data lake can be seen as a single participant, or evolve into a data space by giving each participant its own connector.

By aligning trust anchors, onboarding criteria, catalogue federation, identity and semantic profiles, as documented in DSSC blueprints, and using compatible protocols such as DSP. In practice, most initiatives start with internal interoperability; federation between data spaces is emerging and maturing.

By adopting open rulebooks and interoperability profiles, recognised trust frameworks and labels, and widely adopted protocols such as DSP. You can then change components while remaining compliant.

GDPR applies, strengthened by DGA trust mechanisms and the rulebook (intermediation roles, consents and mandates, logs, audit trails). The main legal basis for sharing is consent, managed by identity and consent tools such as MyTravelConnect, based on EUDI personal wallets. The Prometheus-X stack provides dedicated personal data-sharing protocols.

Faster partnerships (shared rulebook and onboarding), lower integration costs (reusable building blocks), new services and revenues, and sovereignty: data stays at source while policies are enforced.

Often a neutral orchestrator, an association or consortium, that convenes public and private stakeholders. Members co-govern through the rulebook and shared trust services, in line with DSSC guidance.

With the AI Act and growing interest in sovereign, trustworthy AI, data spaces appear as an answer. The topic is still new, as data spaces first focused on data. Gen4Travel (EONA-X) and Gen4Legal (Legal Data Space), which Onecub contributes to, are among the first AI initiatives built natively on a data space.