5. Gaia-X Implementation of Trusted Data Transactions¶

This chapter outlines how Gaia-X Data Exchange concepts and trust mechanisms support the implementation of trusted data transactions, with particular reference to the CEN-CENELEC prEN 18235 “Trusted Data Transactions” standardisation work. Note that organisations need to complement the trust-related elements described in this chapter with additional mechanisms for controlling and performing the actual data exchange, such as those being developed by the Eclipse Dataspace Working Group.

Enabling digital transformation and developing innovative services requires timely access to relevant data, potentially aggregated from multiple sources or suitably transformed, to generate valuable insights.

Data means any digital representation of acts, facts or information and any compilation of such acts, facts or information.

However, data sharing across organisations is often hindered by stakeholder resistance, governance policies, lack of appropriate tools, and challenges in addressing regulatory constraints:

• For Data Producers, sharing personal or non-personal data may involve legal, industrial, and reputational risks, while the local benefits of sharing are often difficult to demonstrate.
• For Data Consumers, usage rights and restrictions are frequently unclear, insufficiently formalised, or expressed in legal terms that are difficult to verify and enforce automatically.
• For legal and compliance teams, data access and governance processes are often fragmented, making the verification of lawful data usage complex and resource-intensive.

As per the Gaia-X Glossary, a Consumer is a participant who searches service offerings and consumes service instances in the Gaia-X Ecosystem to enable digital offerings for end users. 

In this service-centric perspective, a Data Consumer simply is a Consumer who is consuming services pertaining to the sharing of data. CEN/CLC prEN 18235, on the other hand, places the data sharing transaction and associated roles, actors, and concepts in the center. Both viewpoints, though, are fully compatible with each other.

This complexity often results in overly risk-averse decisions, delaying data sharing and limiting opportunities for digital transformation and innovation.

Overcoming these barriers requires trustworthy mechanisms throughout the data transaction lifecycle. Data Rights Holders need to be able to define how their data may be used and have confidence that these constraints will be respected. Data Consumers require assurance that the data is authentic and that its use is authorised. Likewise, Data Providers need assurance that recipients are entitled to receive the data.

The Gaia-X Data Transaction concept and the associate models provide such mechanisms, enabling Data Rights Holders to retain control over how their data is used and by whom (data sovereignty), while supporting compliance with European data regulations, including the GDPR and the Data Act.

5.1 Data Transactions Conceptual Model¶

The Gaia-X Data Product conceptual and operational models provide the trust mechanisms required to support trusted data transactions and enable Data Rights Holders to control how their data are used and by whom (data sovereignty). They also support compliance with European data regulations, including the GDPR and the Data Act. The concepts described below are fully detailed in the Data Exchange Document and summarised here for architectural purposes.

A Data Product represents the unit of data sharing within the Gaia-X ecosystem, packaging data, metadata, and any associated licence terms. Data Products include, without being limited to, metadata describing the data product and data licence terms as defined by the Data Rights Holder, or by the Data Provider authorised to do so.

Data is furnished by Data Producers to Data Providers who compose them into a Data Product to be used by Data Consumers.

According to the concepts defined in CEN-CENELEC prEN 18235-1 “Trusted Data Transactions: Terminology, concepts and mechanisms ”, a data transaction relates to three main phases:

• Granting Rights and Publication, which is the provisioning phase leading to the publication of metadata and data policies associated with a Data Product;
• Discovery and Negotiation, which leads to an agreement between a Data Provider and a Data Consumer regarding a Data Product;
• Data Exchange and Data Usage, which operationalises the agreement through a data transaction and includes access to and usage of the Data Product by the Data Consumer.

Figure 5.1 - Data Transaction phases

The Gaia-X model relies on two complementary contractual artefacts: the Data Access Contract (DAC) and, where licensed data are involved, the Data Usage Agreement (DUA). The DAC is established between a Data Provider and a Data Consumer and governs the provision and consumption of the Data Product. It is based on the Data Product Description published by the Data Provider and incorporates the terms agreed by the parties during the negotiation process.

The DUA is established between a Data Rights Holder and a Data Consumer and defines the conditions under which the underlying data may be used. In particular, it defines the usage constraints associated with the data and the obligations accepted by the Data Consumer. When licensed data are involved, the DAC and the DUA complement each other: the DAC governs access to the Data Product, while the DUA governs the authorised use of the underlying data.

Together, these contractual artefacts provide the legal and operational foundation for trusted data transactions.

Figure 5.2 - Data Transactions conceptual model

Mapping of Gaia-X concepts with concepts used in EU data regulation

The following table maps the Gaia-X concepts with the concepts used within the different European regulations around data (GDPR and the EU acts on data – DxA):

For complete mapping of Gaia-X concepts used in EU data regulations, refer Data Exchange Document.