Data exchange Legal questions in the use of data rooms

With initiatives like Manufacturing-X, data rooms are becoming more prominent in the minds of many company and project managers. However, with all the possibilities, legal questions also arise. Two digital experts from the law firm Gleiss Lutz provide answers.

Dr. Alexander Molle is a partner at the Berlin office of Gleiss Lutz and specializes in IT law. He advises on IoT, AI, SaaS, cloud computing projects, M&A, outsourcing transactions, complex IT contracts, e-commerce, internet law, and IT-related litigation.

Dr. Benedikt Burger is an attorney at the Stuttgart office of Gleiss Lutz, focusing on complex technical litigation (in negotiations, court proceedings, and arbitration) and strategic advice on technology-driven projects.

Further editorial contributions: Dr. Hannah Bug, Dr. Marc Ruttloff, Prof. Dr. Eric Wagner, and Simon Wegmann.

With the rise of data spaces, the General Data Protection Regulation, or GDPR, is once again receiving attention. Companies must not only ensure that they meet data protection requirements but also minimize the risks of high fines and legal consequences in the event of a violation. At the same time, they face the challenge of making clear contractual arrangements to maintain the protection of sensitive information, intellectual property rights, and data usage rights.

Especially in an ever-changing legal environment that includes industry-specific requirements and international regulations, active compliance management is essential. Below, lawyers Benedikt Burger and Alexander Molle from the law firm Gleiss Lutz answer some of the most common legal questions about legally compliant work with data rooms.

How do companies ensure that they comply with the General Data Protection Regulation, the GDPR, when processing personal data in data rooms? What sanctions are threatened in case of a violation?

Data spaces vary significantly in terms of data protection requirements. Data spaces like the European Health Data Space require consent-based access to personal data and a consent management system integrated from the start. Industrial data spaces, on the other hand, can often operate without personal data. It is always important to conduct a careful and documented assessment to determine whether personal data is present.

All data rooms operate better in terms of data protection with anonymized data. Violations of data protection regulations can lead to high fines and claims for damages. Measures by competitors are also possible, such as cease-and-desists, specific cease and desist letters.

What contractual arrangements should organizations implement to ensure the confidentiality and protection of sensitive information in data rooms?

Contracts should specify which data is confidential. Confidentiality obligations should be agreed upon for such data. These include, in particular, obligations not to disclose or share confidential information without the express consent of the providing company—except for legally mandatory disclosures—as well as deletion obligations. Furthermore, technical protective measures such as data encryption and IT security audits should be included. Contractual penalties can contribute to sanctioning violations.

Who owns the intellectual property of the data and information generated or shared within the data rooms? Are clear contractual agreements necessary for this?

Individual data or information is generally not protected by intellectual property rights. Data collections can be protected by copyright as database works, provided the selection and arrangement of the data are based on a personal intellectual creation of a human being. If the selection and arrangement are exclusively done by software, only protection as a database is considered. However, the database manufacturer only has the exploitation rights to the database as a whole, not to the individual data.

Due to the insufficient legal protection of data and information in data rooms, contractual agreements, especially regarding the so-called ownership of the shared data, the generated/derived data, and any analysis results are important.

What usage rights exist for the data? Are clear contractual agreements necessary for this?

Subject to any confidentiality protection regulations, data can generally be used freely. Clear contractual agreements are therefore advisable to regulate the usage rights of the data. In particular, the permissible usage scope, the duration of the permitted use, and any authorization to share data with third parties should be regulated.

What specific requirements or legal regulations apply in which industry environments regarding the use of data rooms?

There are currently few regulations specifically for data spaces. They are to be introduced in the future, such as with the European Health Data Space. A central component of the current EU data strategy is the Data Governance Act (DGA), which creates a legal framework for data sharing.

According to current working papers from the European Commission, data holders should be entitled to grant or share access to data under their control. The reuse of data is possible for compensation, remuneration, or free of charge. The general European regulations, for instance, according to the GDPR, the Data Act, and the Directive on Network and Information Systems, must naturally also be observed when using data spaces.

How can companies ensure compliance with the requirements and legal regulations regarding the use of data rooms? What sanctions are threatened in case of a violation?

Companies must identify relevant regulations and sensitize their employees, for example, through ongoing training. A stable and efficient data compliance governance is essential. This requires clear responsibilities and practical procedures. Data Compliance Management Systems, abbreviated as DCMS, complement existing Data Protection Management Systems, also known as DSMS. Non-compliance may result in sanctions, including those under the GDPR.

How can companies minimize liability risks associated with data loss or misuse? What liability clauses should be included in contracts?

Data rooms and their data must be protected against data loss and unauthorized access through technical measures and contractual arrangements. Distinguishing between internal and external relationships is important:

Internal relationships: A functioning DCMS and technical measures such as encryption, access controls, including multi-factor authentication and role-based access controls, continuous monitoring, logging, and data backups are essential. Additionally, the risk should be reduced by training the database user extensively and creating awareness.

External relations: Preventive measures and contractual agreements are important between companies and database providers. Selecting a certified provider and having clear contractual agreements, such as terms and conditions, liability clauses, or service level agreements, for compliance with relevant standards, namely GDPR compliance and ISO/IEC 27001, are necessary to reduce risks. Data recipients should be required to implement technical protective measures themselves and to grant access to third parties only to the extent strictly necessary and only after signing a confidentiality agreement. Contractual penalties can encourage compliance with these obligations.

Are there international data protection and data transfer regulations to be considered when companies exchange data between different countries?

Many data spaces are initially designed within a specific physical territory, such as the EU or the European Economic Area, where internal data exchange does not pose particular requirements. For the transmission of personal data beyond these borders, additional compliance mechanisms are necessary. This might mean limiting the data space to countries that cooperate on data transfer restrictions, like the EU with the UK or Japan. Further expansion often requires complex contractual foundations, such as EU standard contractual clauses, to guarantee a certain level of data protection. Problems arise when data spaces collide with legal data localization requirements, as seen in Russia and partly in China.

How can organizations adapt their internal processes and policies to ensure they can respond quickly and legally in case of a data protection breach?

Handling data breaches requires good data governance and careful data minimization. Internal processes and policies must define who is responsible for which data. Once responsibility is clearly assigned, the so-called reporting chain must be documented to ensure that information about data breaches quickly reaches the appropriate authority. Through legal acts such as the NIS-2 Directive, the Digital Operational Resilience Act (DORA), and the Cyber Resilience Act, reporting obligations are continually expanding.

Secure and Compliant Authentication in Laboratories

Secure & Contactless User Authentication at GMP/GLP