9 min Read Time<\/p>\n
The new German Data Governance Act (DGG) transposes EU Regulation 2022\/868 into national law. SMEs without a data strategy now risk not only fines of up to \u20ac500,000 – but also falling behind in data-driven value chains. A practical check reveals how to get started.<\/strong><\/p>\n Germany took its time. While the EU Data Governance Act (DGA) has been applicable since September 2023, the national implementation bill only entered draft form at the start of 2026. The Data Governance Act<\/a> regulates three core areas: the reuse of protected public sector data; the authorisation and supervision of data intermediation services; and the registration of data altruistic organisations.<\/p>\n For SMEs, the second point is especially relevant. Data intermediation services are platforms enabling data exchange between companies – without holding any economic interest in the data themselves. Anyone wishing to operate such a service must now register with the Federal Network Agency<\/a>. Ignoring these rules carries fines of up to \u20ac500,000.<\/p>\n The Federal Statistical Office (Statistisches Bundesamt) assumes the role of central information hub. It advises public bodies seeking to open their datasets for reuse. Yet during the Bundestag\u2019s Digital Affairs Committee hearing in January 2026, it became clear: many authorities are now reconsidering whether to publish their data at all – because administrative effort outweighs the benefits.<\/p>\n The most common misconception: \u201cThe DGG doesn\u2019t affect us – we\u2019re not a data platform.\u201d It\u2019s true that direct obligations – registration, supervision – apply only to data intermediaries and data altruistic organisations. Indirectly, however, the law reshapes the rules for all<\/em> companies working with enterprise data.<\/p>\n \u201cData governance isn\u2019t bureaucratic bloat. It\u2019s the foundation that keeps AI projects from failing due to poor data quality.\u201d<\/p>\n Boris Otto, Fraunhofer ISST, Dortmund<\/cite>\n<\/p><\/blockquote>\n Concretely: Participation in European data spaces<\/a> (Gaia-X, Catena-X, Manufacturing-X) requires demonstrable proof that your data is structured, documented, and managed under clear governance rules. No data space accepts participants who cannot answer basic questions: Which data do we hold? Who accesses it? What usage rights apply?<\/p>\n Moreover, the DGG is just one piece of an expanding regulatory web. Combined with the Data Act<\/a> (applicable from September 2025), the AI Act, and the GDPR, it forms a compliance package that simply cannot be managed without systematic data governance. Tackling each regulation in isolation leads to fragmentation. A unified data architecture resolves most requirements at once.<\/p>\n A strong example comes from Siemens AG\u2019s approach within Manufacturing-X. For its manufacturing division, Siemens introduced a central data catalogue – tagging every dataset with metadata: origin, update frequency, responsible party, and classification (public, internal, confidential). This is no multi-million-euro project. Siemens uses an open-source tool (DataHub by LinkedIn\/Acryl Data) – one equally accessible to SMEs without enterprise budgets.<\/p>\n The crucial insight: the data catalogue wasn\u2019t the end goal – it was the starting point. Only after visualising which data actually existed could governance rules be meaningfully defined. Before that, \u201cdata governance\u201d was little more than a PowerPoint slide declaring good intentions.<\/p>\n \u201cGovernance without a data catalogue is like accounting without a chart of accounts. You can write down rules – but nobody knows what they apply to.\u201d<\/p>\n Boris Otto, Director, Fraunhofer ISST, Dortmund<\/p>\n<\/div>\n Not all experts view the DGG positively. During the Bundestag hearing, specialists criticised the regulation for achieving \u201cprecisely the opposite effect in many respects.\u201d Rather than making data more accessible, the administrative burden pushes public bodies to keep datasets locked away.<\/p>\n This is a real risk for SMEs too. Overly bureaucratic governance – requiring three approval layers for every data access request – slows down internal teams. The art lies in keeping governance lean: clear roles, simple classification, automated access control. Anything beyond that creates friction – especially harmful in SMEs, where flat hierarchies demand agility.<\/p>\n The numbers speak volumes: Across the entire EU, exactly three organisations have registered as data altruistic. Three. That stark figure illustrates how limited the DGA\u2019s practical impact has been so far. Critics conclude the regulation misses reality. Supporters counter that precisely this gap demands a national implementation law offering more pragmatic incentives.<\/p>\n The most frequent mistake: thinking too big. Launching straight into an enterprise-wide data governance platform fails on complexity and budget. Better:<\/p>\n \u25cf Step 1: Build a data inventory.<\/strong> List all systems processing personal, business-critical, or regulated data: ERP, CRM, file servers, cloud services. Aim not for completeness – but capture your top 20 systems. This takes two to three weeks – not months.<\/p>\n \u25cf Step 2: Assign responsibilities.<\/strong> Name a data owner for each dataset in the inventory – the person who decides who may access the data and what quality standards apply. Not a new job title, but an added responsibility for existing managers.<\/p>\n \u25cf Step 3: Introduce classification.<\/strong> Three tiers suffice: Public, Internal, Confidential. Every new document or dataset receives a classification upon creation. Existing data is classified incrementally – starting with the top 20 systems from Step 1.<\/p>\n \u25cf Step 4: Automate access control.<\/strong> Implement role-based access control (RBAC) in your most critical systems. Most modern ERP and cloud platforms<\/a> include this functionality out of the box. Effort lies in configuration – not in acquiring new technology.<\/p>\n \u25cf Step 5: Establish a review cycle.<\/strong> Every six months, ask: Are responsibilities still accurate? Have new data sources emerged? Have regulatory requirements changed? A half-day per quarter is enough to begin.<\/p>\n The DGG arrives amid mounting regulatory pressure. DORA, the AI Act, MiCA, NIS2, the Data Act – SMEs face more simultaneous compliance demands in 2026 than ever before. Data governance isn\u2019t an extra project. It\u2019s the shared foundation. Knowing which data resides where – and who accesses it – already fulfils 80% of your compliance documentation.<\/p>\n According to its own statements, the Federal Network Agency has already begun preparations for its new supervisory role. Once the law passes, obligations take immediate effect. SMEs lacking a data inventory by then will start from behind – and scramble to catch up under time pressure. That will be expensive and chaotic.<\/p>\n The pragmatic path: Start the five steps now<\/em>, before the law enters force. Investment is modest (an internal project lead, two to three months to build the foundation); the payoff extends far beyond DGG compliance. Because clean data architecture doesn\u2019t just ensure compliance – it accelerates decision-making, replacing gut feeling with validated insights.<\/p>\n The DGG is Germany\u2019s implementing legislation for the EU Data Governance Act (DGA, EU 2022\/868). It governs the reuse of protected public sector data, supervision of data intermediation services, and registration of data altruistic organisations. The Federal Network Agency serves as the central supervisory authority.<\/p>\n<\/details>\n Only if they operate a data intermediation service or act as a data altruistic organisation. Indirectly, however, the law affects all companies seeking to join European data spaces (Gaia-X, Catena-X, Manufacturing-X) or work with public datasets.<\/p>\n<\/details>\n The draft law foresees fines of up to \u20ac500,000 per violation – primarily targeting data intermediation services that ignore registration duties or breach neutrality requirements.<\/p>\n<\/details>\n Open-source solutions like DataHub (LinkedIn\/Acryl Data) or Apache Atlas offer a cost-effective entry point for building a data catalogue. For access control, built-in RBAC features in modern ERP and cloud systems often suffice.<\/p>\n<\/details>\n Both laws form part of the EU\u2019s broader data strategy. The Data Act governs access to machine-generated data (e.g., IoT data) and contractual clauses for cloud switching. The DGG establishes the infrastructure for trustworthy data exchange. Together, they form the bedrock of the European data space.<\/p>\n<\/details>\n Header Image Source: Pexels \/ Mike van Schoonderwalt<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" The new German Data Governance Act (DGG) transposes EU Regulation 2022\/868 into national law. SMEs without a data strategy now risk not only fines of up to \u20ac500,000 – but also falling behind in data-driven value chains. A practical check reveals how to get started. The Key Takeaways The Data Governance […]<\/p>\n","protected":false},"author":205,"featured_media":89477,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_focuskw":"data governance","_yoast_wpseo_title":"Data Governance: Simple steps for SME compliance now","_yoast_wpseo_metadesc":"Digitalisierung: Master DGG compliance for SMEs. Avoid fines & secure your data strategy today! Read our guide.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_translation_lang":"","_wp_old_slug":[],"footnotes":""},"categories":[1156],"tags":[],"class_list":["post-93976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-business-future","entry"],"evm_reading_time_minutes":9,"wpml_language":"en","wpml_translation_of":89431,"acf":[],"yoast_head":"\nThe Key Takeaways<\/h2>\n
\n
What the Data Governance Act Specifically Regulates<\/h2>\n
Why SMEs Are Affected – even If They Don\u2019t Operate a Data Intermediation Service<\/h2>\n
\n
A Real-World Case: How a Manufacturing Company Built Data Governance<\/h2>\n
The Counterargument: Governance as a Brake<\/h2>\n
Five Steps to Get Started: Building Data Governance in SMEs<\/h2>\n
What This Means for RegTech Investments in 2026<\/h2>\n
Frequently Asked Questions<\/h2>\n
What is the Data Governance Act (DGG)?<\/summary>\n
Do SMEs need to register?<\/summary>\n
How high are the fines for violations?<\/summary>\n
Which tools suit a data governance starter kit?<\/summary>\n
How does the DGG relate to the Data Act?<\/summary>\n
Further Reading<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n
\n