Guiding Questions

Purpose: Define common baseline policies while allowing participants to set stricter rules within their domains.

1. Policy Scope & Governance

• Which common access and usage policies will the data space enforce platform-wide?

• What is the minimum baseline for policy enforcement (security, privacy, sustainability criteria)?

• Can participants define stricter policies within their own DUGs?

Purpose: Specify shared registries and consent points that integrate with identity and trust services.

1. Policy Information Points (PIPs)

• Which shared PIPs should the data space maintain (e.g., GDPR consent registry)?

• How will PIPs integrate with the Trust Framework and Identity Management?

• Should sector-specific consent management be centralised or left to DUGOs?

Purpose: Enable machine-readable policy agreements, revocations, and checks throughout the data lifecycle.

1. Policy Lifecycle & Negotiation

• How will machine-readable agreements be negotiated (ODRL templates, bilateral APIs)?

• At what points in the data transaction lifecycle will policy checks occur?

• How will policy revocations be propagated across participants?

Purpose: Design a distributed or centralised enforcement system using standard policy decision and enforcement points.

1. Enforcement Architecture

• Will the data space operate a central policy engine or federate enforcement to participants?

• How will the PEP/PDP/PIP/PAP architecture be implemented in multi-cloud or hybrid environments?

• What contextual data (identity, contract terms, asset metadata) will be required for decisions?

Purpose: Provide audit trails, retention rules, and real-time alerts to ensure accountable policy enforcement.

1. Compliance Tracking & Proof

• How will audit trails be generated, stored, and accessed?

• What is the retention period for enforcement proof?

• How will the data space support real-time policy breach alerts?

• Will conformance evidence (logs, proofs, certificates) be published to support audits and marketplace listing requirements?

Purpose: Align policies with trust, identity, and legal frameworks to create a coherent enforcement ecosystem.

1. Interlinkages & Dependencies

• How will Access & Usage Policies integrate with the Trust Framework?

• How will identity attestations influence policy enforcement?

• Which parts of the Legal Building Blocks must be mirrored technically here?

• How will policy outcomes be reflected in discovery/marketplace visibility (e.g., eligibility, access tiers)?