On 18 October 2024 the National Data Administration opened the Trusted Data Space Development Action Plan (2024–2028) for public comment, with submissions due by 27 October. The targets go beyond numbers: more than 100 trusted data spaces by 2028, reusable solutions and best practice, and a system built around operation, technology, ecosystem, standards and security. For data-intensive AI companies, the significance lies in the attempt to turn data cooperation into infrastructure with settled rules.
From willingness to verifiability
Data spaces are not a new concept; they were often understood as industry alliances or platforms. The plan places them at the level of infrastructure: participants join under agreed rules, and the scope of use, manner of use and transfer records are governed by those rules rather than by bilateral trust. This responds to the practical concern — once data is handed over, how does the provider know what was done with it, for how long, and whether it was passed on. “Trusted” here means verifiable authorisation, controllable use and auditable behaviour, not a certificate on the wall.
Participants and consensus rules
A data space involves at least a data holder, a data user, an operator, and third parties providing technology, certification or audit services. Their relationship needs an executable rulebook covering admission, scope of authorisation, use control, benefit sharing and breach handling. Including “consensus rules” in the system means such arrangements move from individual contracts to space-level rules. Before joining, a company should know who writes the rules and how they are amended, and whether data can be retrieved or deleted on exit.
Security and cross-border rules are not waived
Data spaces improve circulation but do not displace existing obligations. Classification, identification of important data and personal information protection still apply. Data leaving the space for an overseas destination still follows the security assessment, standard contract or certification route. The value of a space is that it generates transfer records, which can support filings and inspections but cannot replace them. Treating “inside the space” as a compliance exemption is a common misreading.
Three ways to participate
- Join an industry space. Suited to companies with concentrated data needs but no capacity to build their own; the focus is on reviewing the rulebook and authorisation terms, including purpose, duration and limits on further provision.
- Build an enterprise space. Suited to companies with large data assets and complex supply chains; the focus is interface standards, permission design and allocation of responsibility.
- Become an operator. Requires long-term investment and neutrality; suited to entities that already act as sector data hubs, and brings obligations in rule maintenance and dispute handling.
All three start with the same groundwork: mapping data assets and the licence chain. Which data can be provided externally, on what terms, for how long and whether it can be passed on — these questions do not disappear on joining a space. Without that step, joining simply magnifies existing defects in authorisation.
Standards and contracts
The plan refers to a standards system. For companies, this means access, interface and audit requirements may become uniform, and contract terms may become templated. What can be done now is to turn internal data catalogues, authorisation ledgers and security measures into material that can be explained externally, so that alignment is quick when standards land. Prospective operators should also consider neutrality and the sustainability of their revenue model.
For authorisation and classification work before joining a data space, see our data compliance service; for access control, logs and audit arrangements, see cybersecurity compliance; for outbound transfers, see cross-border data services.
This article is based on the Trusted Data Space Development Action Plan (2024–2028) published for public comment by the National Data Administration on 18 October 2024, and on public information. It is for reference only and does not constitute legal advice.