Legal Building Block Questions
Applicable Legal Frameworks
Purpose: Identify and monitor all relevant EU and national laws to guarantee that operations remain legally sound.
Which EU and national regulations (e.g. GDPR, Data Act, competition law, sectoral directives) are directly relevant?
How should the governance authority keep track of evolving regulatory obligations?
Compliance Responsibilities
Purpose: Clarify which compliance duties belong to the governance authority versus individual participants to ensure accountability.
What compliance obligations should rest with the data space authority versus the individual participants?
Should there be baseline legal compliance requirements for all participants before joining the initiative?
How can legal obligations be clearly communicated to all participants?
What support is needed to help participants meet compliance effectively?
Risk and Liability
Purpose: Establish a fair distribution of liability and safeguards to minimize legal and operational risks.
How should liability be distributed in case of breaches of regulatory obligations (e.g. data protection violations, misuse of data)?
What safeguards or monitoring mechanisms are necessary to minimize compliance risks?
How can compliance checks be automated to reduce manual effort?
Which tools help monitor ongoing regulatory adherence?
Certification and Assurance
Purpose: Determine the most effective mechanisms for verifying ongoing compliance and trustworthiness of participants
Should compliance be verified through certification, attestation, or self-declaration?
How frequently should compliance checks or audits be carried out?
Sector-Specific Rules
Purpose: Integrate sectoral requirements while ensuring alignment with overarching EU legal frameworks.
Are there additional environmental or sectoral regulations that need to be explicitly incorporated into participation rules?
How should conflicts between sector-specific rules and overarching EU frameworks be managed?
Enforcement Mechanisms
Purpose: Define clear processes and authorities for addressing and resolving compliance breaches.
How should compliance breaches be addressed (warnings, sanctions, suspension, exclusion)?
What governance body or process will be responsible for handling non-compliance cases?
Last updated