The DSSC adopted the concept of building blocks to break data spaces into manageable smaller pieces. Building blocks are basic units or components that can be implemented and combined with other building blocks to achieve the functionality of a data space. We built on the 12 building blocks described in the Design Principles for Data Spaces | Position Paper of the EU-funded OpenDEI project and extended them to 17, that can be divided in 6 categories; ranging from business, governance, and legal to technical building blocks on data interoperability, trust, and data value. Moreover, we are not only adopting the design principles for data spaces but also continuing to improve this model based on the latest insights on data spaces.
Business Model
A well-defined business model is the foundation of a sustainable data space. Unlike traditional business models, a data space requires collaboration between multiple actors, balancing economic viability, governance, and trust. Combining concepts from collaborative business models, multi-sided business models and governance approaches, this section provides a structured approach to designing and evolving business models that ensure long-term success.
Learn more
Use Case Development
The value of a data space stems from its use cases. Data space use cases are settings where two or more participants create business, societal or environmental value from data sharing. Use case development amplifies such value of a data space.
Use case development falls into three initial steps, and continuous improvement throughout the life cycle of the use case as the overarching process model (Figure 1):
-
Identifying and monitoring use case scenarios is your starting point, where you generate new ideas.
-
Refining use case scenarios is where you spend more of your time, giving detail to the use case so that you can test its viability. This includes, at the minimum, the purpose and value of the use case, the use case participants, and the necessary data flows.
-
Implementing use cases is where you take the best ideas and move from the drawing board to putting the ideas into reality.
-
Continuous improvement process is the overarching process throughout the life cycle of a use case where you analyze its performance, identify improvement opportunities, plan and implement changes.
Use case development is particularly important for data spaces in their early phases, as use cases attract users and participants that are essential for growth. An established data space with well-functioning use cases may opt out of use case development. However, it risks becoming obsolete as its business environment evolves and competitors develop new and improved use cases. Valuable use cases attract new customers and participants to data spaces, enabling them to scale and grow.
Learn more
Data Space Offering
The data space offering consists of the set of offerings available in a data space to participants. Offerings contain data product(s), service(s), and the offering description that provides all the information needed for a potential consumer to make a decision whether to consume the data product(s) and/or the service(s) or not.
This building block provides the data space initiatives with an understanding of the offerings from a business perspective. It proposes to develop and maintain a strategy for the data space offering. The elements of a data space offering strategy are the following:
-
Identification and onboarding of priority data products and services that serve existing and future use cases
-
Development, maintenance and enforcement of the governance rules of the data space offering
-
Supporting the participants to develop and offer high-quality data products
Learn more
Intermediaries and Operators
One of the core design topics for a data space is to consider how it uses service providers to provide necessary technical services as well as business and organisational services. While the data space governance authority (DSGA) and data space participants can provide these services by themselves, there are many business and governance reasons why procurement of services provides benefits. This building block elaborates on what kind of business, governance, legal, and contractual topics the DSGA should focus while procuring enabling services from intermediaries or an operator.
Within the ecosystem of service providers, intermediaries and operators form a distinct category characterised by their focus on providing enabling services. Data space can have one (operator) or multiple enabling service providers (usually intermediaries). Whether to design a data space with a single operator or multiple intermediaries is a data space business design question where the risks and benefits of a single provider versus multiple providers must be weighed against each other.
The effectiveness and utility of intermediaries and operators is ultimately at the balance between four different dimensions: (1) by their ability to streamline and make trusted data sharing easier and more economical, (2) to improve data space accessibility and usability for different participants and so (3) contribute to their scalability, and to (4) enable interoperability both within and between data spaces in order to create larger markets for different actors across data spaces and enable network effects to arise. Risks associated with procurement of services are often related to the vendor lock-in, additional costs associated with vendor management, and potential loss of sovereignty depending on the kind of provider selected.
Developing a data space’s organisational form, its governance authority, and governance framework and rulebook are governance design questions. Decisions for application of intermediaries and operators is an essential part of this data space governance design. This building block provides tools for DSGAs to create better governance design for their data spaces with or without service providers.
Learn more
Organisational Form and Governance Authority
This building block encompasses key decision-making points for the effective establishment and operation of a data space, namely the determination of an organisation's form and the establishment of a data space, the creation of a governance authority and the creation of a data space governance framework. Organisational form (or legal form) refers to the type of legal entity a data space may assume. A data space governance framework is a set of internal rules and policies applicable to all data space participants. A governance authority refers to bodies of a data space that are composed of and by data space participants responsible for developing and maintaining as well as operating and enforcing the internal rules.
The building block describes the options of creating a data space as an unincorporated (i.e. without legal personhood) and incorporated (i.e. as a legal person) entity and discusses most important consequences of these choices in a comparative way. The choice of legal of form of a data space has implications for the type and role of a governance authority, the ability of a data space to develop, implement and enforce its internal rules and, ultimately, data space’s overall development and sustainability.
The role of a governance authority may entail various functions, such as setting internal rules and policies, ensuring compliance with internal and external rules, and resolving conflicts that may arise. A governance authority also creates mechanisms for continuous improvement of the data space, identity management, access controls and risk mitigation to build trust and quality within the data space. Overall, the governance authority maintains and operationalises the internal rules for the successful operation of the data space.
Determining the organisational form and establishing the governance authority should be completed before the data space enters the operational phase. At least in the most essential parts, a data space governance framework should be created in parallel to support the functioning of the new data space. The organisational form, type of governance authority and its role may evolve over time due to the scaling up of the data space or the assumption of new functions.
Learn more
Participation Management
The Participation Management building block outlines governance processes for managing participant engagement in data spaces. This includes identifying participants, onboarding, offboarding, and setting rules for data transactions and service provision. It addresses risks like data governance challenges and reduced collaboration. This building block provides guidelines for efficient and secure participation by integrating relationships with other governance aspects like regulatory compliance and identity management. The building block shall provide guidance for Data Space Participants for the implementation of internal Data Governance addressing Data Space specific concerns.
Learn more
Regulatory Compliance
This building block aims to guide the data space governance authority in applying legal rules to a data space's design and operation. Specifically, it helps to properly define some participant roles and responsibilities, establish internal policies, and continuously monitor the regulatory compliance of a data space. In addition, it assists data space participants in understanding their rights and obligations under regulatory frameworks that are relevant to their role in a data space or to a specific data transaction. It also provides guidance on relevant legislation to those interested in setting up or joining a data space, including developers, policymakers and others.
Key elements of this building block include:
-
Triggers: Elements, criteria or events (e.g. data type, nature of participant or domain) that have occurred in a particular context of a data space and signals that a specific legal framework must or should be applied.
-
Data space requirements: Regulatory provisions that explicitly refer to data spaces.
-
Additional legal considerations: This element highlights other important legal considerations to be aware of when setting up or operating a data space, e.g. cybersecurity law.
-
Tools enabling regulatory compliance within a data space: Technical tools or techniques designed to address certain legal requirements (such as secure processing environment, privacy-enhancing technologies etc.).
-
Regulatory Compliance Flowcharts: A step-by-step guidance helping to assess the applicability of a specific legal framework and to determine the requirements to be addressed by specific entities. The main objective of this element is to operationalise the triggers and structure the interplay of the above-mentioned elements. In the future, these flowcharts will become part of the Legal Compass which will reflect more in detail on the relationship between decisions taken in the business, technical or governance of a data space and compliance with particular legal requirements.
Learn more
Contractual Framework
The Contractual Framework building block describes the legally enforceable agreements underlying the operation of a data space by different parties entering into a relationship with the data space.
There are three categories based on the subject matter of the agreement:
-
Institutional agreements
-
Data-sharing agreements
-
Services agreements
These agreements differ in terms of the parties involved, their function, and the elements covered by the agreement.
Institutional agreements implement the governance of a data space and are an essential component of the Rulebook. They not only provide the general terms and conditions for participation in a data space but also underpin its existence and provide a legal basis for its operations. Data-sharing agreements provide the legal basis for the data transactions happening in a data space among data space participants. Services agreements refer to all agreements for the provision of services to data spaces.
These identified categories offer working concepts under which various agreements are placed, such as data product contracts. The present building block provides a selection of the most important agreements. These agreements are described in terms of their functionalities, their main elements are presented, and examples are provided. The building block also lists the most common legal issues to consider regarding the Contractual Framework, pointing to existing resources in the Further Reading section to address some of these issues.
Learn more
Data Models
Data models ensure that data is accurately and consistently interpreted when exchanged within a data space. The data model consists of metadata that provides information about semantics, helping to interpret the actual exchanged data. Such models are relevant in a data space where a data provider offers data products and data consumers want to utilise and exchange these data products. When using the same data model, semantic interoperability becomes possible and data can be exchanged among the data space participants.
Data spaces should consider shared data models, or ‘semantic standards’. These models serve as dictionaries that enable data providers and data consumers to “speak the same language” when exchanging data. Considering that participants have diverse perspectives and requirements about the meaning of data, it is essential to develop, reuse, and govern these shared data models within the data space. This is a continuous balancing act between the need for strict uniformity to keep data consistent and easy to understand, and the need to accommodate the fact that different organizations have different requirements for their data. In a data space, the governance framework should include these agreements to ensure wide consensus regarding the data models used in the data space.
Data models are located in a common repository, known as a Vocabulary Service. The data product should refer to a data model, which is in Vocabulary service. This allows both the data provider and data consumer to refer to the repository during data exchange, ensuring accurate exchange and interpretation of the data. However, this rises a challenge for federated data spaces, as each data space develops their unique data models. The first step in (re)using data models from other data space is to find and access them. Therefore, data spaces should be able to exchange their data models in a standardized manner to establish agreements on their usage.
A data model is a structured representation of data elements and relationships used to facilitate semantic interoperability within and across domains. However, there are different abstraction levels for data models. This building block distinguishes between the various types of data models and the meta-standards in which they can be expressed while also providing examples. In addition to that this building block describes how these data models can be implemented, reused, governed, by whom, and what tools can assist in this process.
Learn more
Data Exchange
The scope of this building block is the actual transmission of the data between participants of a data space:
The scope of the building blocks is to establish agreed-upon mechanisms between participants for the actual transmission of data. To achieve this, data spaces must make a strategic choice.
Note that ‘transmission’ can encompass many different types of data exchange (data sharing, messaging, streaming, algorithm-to-data, etc.).
The data exchange process involves a Transfer Process (TP), which progresses through a series of states. These are basic states, REQUESTED, STARTED, COMPLETED, SUSPENDED, TERMINATED as defined by the participants as a minimum, but their final number and complexity may vary depending on the implementation. The process has to ensure that data exchange is managed systematically, with clear transitions between states based on messages exchanged between the provider and consumer.
Learn more
Provenance & Traceability
Some use cases require additional metadata alongside the shared data for auditing and compliance purposes. Depending on the specific scenario, it may be necessary to track transactions occurring within the data space or identify who has accessed certain data.
The need for observability, traceability, and provenance tracking is particularly common in highly regulated industries or when managing high-value data.
It is essential to differentiate between two phases: the control phase, which involves transactions related to data-sharing contracts, and the actual data-sharing phase, where data is exchanged. Observability refers to the ability to monitor and manage data-sharing contracts, while data provenance tracking focuses on monitoring the sharing and usage of the actual data.
Both aspects fall within the scope of this framework and may be subject to regulatory or contractual compliance. Regardless, ensuring observability and provenance tracking is the responsibility of each participant and requires the implementation of robust data governance processes by all Data Space participants.
This building block offers guidance for supporting observability, provenance, traceability, logging, audits, and related processes in a standardized manner. Additionally, it addresses the collection, storage, and processing of these types of data.
Learn more
Identity & Attestation Management
This building block outlines the guidelines and technical mechanisms necessary for managing identities and other attestations within a data space. It focuses on enabling participants to present, verify, store, and exchange attestations in a secure, reliable, and self-sovereign manner. Identity and attestation management is foundational to onboarding participants, verifying their compliance with the Data Space Rulebook, and issuing proofs of membership that facilitate trusted data exchanges.
The primary objectives of this building block are:
-
To establish standardized methods for collecting evidence and ensuring ongoing compliance with data space rules.
-
To provide detailed examples of attestations, such as membership credentials, and explain how they can be validated within the ecosystem.
-
To detail technical standards and protocols that underpin security and data sovereignty in identity and attestation management processes, for example with regard to credential exchange.
These objectives ensure that all participants can engage in the data space with confidence in the integrity and trustworthiness of identity-related processes.
Learn more
Trust Framework
This building block defines the trust-specific elements of a trust framework within a data space. Trust is essential because the most critical processes - such as verifying participant identities, validating attestations, and ensuring data is managed in accordance with the data space rulebook - depend on it. A robust trust framework not only strengthens security but also accelerates trust decisions and facilitates data exchanges, thereby supporting the growth of the data space.
The objectives of this building block are:
-
To articulate the core components and principles of a trust framework tailored to data spaces.
-
To define the roles and responsibilities of entities that establish and maintain trust (e.g., trust anchors, trust service providers, trusted data sources, notaries).
-
To explain how existing trust frameworks can be utilized or extended to meet the data space’s needs.
Learn more
Access & Usage Policies Enforcement
This building block establishes core policies that govern data management in Data Spaces:
Access Control Policies
Determines who can access data and under what conditions.
-
Who can access data: Defining conditions for access based on roles, attributes, or other criteria.
-
How data access is granted and controlled: Defining policy-based frameworks for determining who receives access permissions, under what conditions access is allowed, and how authorization decisions are enforced.
Example: A healthcare provider can access the data usage policy only if they are a registered healthcare professional and have explicit authorization from the patient.
Usage Control Policies
Specifies what actions can be performed and which obligations are provided according to the policy once access is granted.
-
What actions can (not) be performed on data: Specifying permissible operations, such as analysis, modification, sharing, or deletion.
-
How usage is controlled: Setting rules to enforce the boundaries of allowed actions, ensuring compliance with the policy.
Example: A researcher can access patient data for analysis but cannot modify, share, or delete it without additional permissions.
Consent Management Policies
Manages consent and permissions for data usage, particularly when the data holder differs from the data subject. Determine and verifies authorized consent providers (data subjects or representatives). Establishes explicit consent processes including opt-in and opt-out mechanisms. Manages consent verification and revocation workflows and bridges relationships between data rights holders and data subjects.
Note: All policy (Access Control, Usage Control, and Consent Management) depend on policy engines that follow deterministic algorithms to calculate whether actions should be granted or denied. For the same input conditions, a policy engine will always produce the same output decision.
Learn more
Data, Services and Offerings Descriptions
A cornerstone of any data space is the precise and comprehensive description of offerings. These offering descriptions are created using machine-readable metadata, making them accessible to both humans and software systems, thus facilitating seamless interaction and automation. They encompass metadata for various elements, including data products, services, data licenses, usage terms, and additional details such as commercial terms and pricing, all systematically organised within a catalog. High-quality metadata plays a critical role in ensuring the discoverability, interoperability, and usability of data products and services, forming the foundation for an efficient data sharing ecosystem.
Learn more
Publication and Discovery
The purpose of the Publication and Discovery building block is to provision and discover offerings within a data space. The formal descriptions of these offerings are explained in more detail in Data, Services, and Offerings Descriptions. Offerings are typically created by providers of data and services and are stored within a catalogue, where the provider is responsible for managing their lifecycle, from the moment they are published until they are removed. After publication, consumers can query the available offerings in the catalogue and find (i.e. discover) the best match.
In summary, the offerings are:
-
Created by providers to showcase their data and services;
-
Typically stored within a catalogue;
-
Used by consumers to identify offerings that best match their needs.
Based on the above, the objectives of the Publication and Discovery building block are:
The Publication and Discovery building block is linked to article 33 of the European Data Act ('Essential requirements regarding interoperability of data, of data sharing mechanisms and services, as well as of common European data spaces').
Learn more
Value Creation Services
This building block addresses the technical aspects related to those services that are aimed to create value, by different means, out of the data shared in the data space. These services, called Value Creation Services, complement the Federation Services and Participant Agent Services, to compose the whole set of services available in a data space (see Services for Implementing Technical Building Blocks ).
Notice that business aspects of these services are considered in the Data Space Offering building block, while information about providers of these services is provided in the Intermediaries and Operators building block.
This building block has the following objectives:
-
To define a taxonomy for Value Creation Services, based on their role and purpose within the overall data space, and then focused on their specific functionality within it. This taxonomy ensures that services effectively cover a wide range of requirements coming from other building blocks or components of the data space, data-driven applications and initiatives, and facilitate the discovery and use by data space participants.
-
To provide an information model of a Value Creation Service, aimed to support the description, specification and implementation of these services.
-
To propose service composition of atomic services as the way to create ad-hoc value in the data space, responding to the needs of use cases
-
To provide guidelines to define and specify the technical infrastructure and required components needed to support the proper delivery of these services, and to ensure their correct management, performance, scalability, monitoring and maintenance.
Learn more
