Data marketplaces and exchange platforms regulation

Introduction

Data marketplaces and exchange platforms are digital systems that enable individuals, businesses, research institutions and government organisations to exchange, purchase, license or share data. These platforms facilitate the commercial and scientific use of information across industries such as biotechnology, healthcare, pharmaceuticals, agriculture, artificial intelligence and financial services.

In the biotechnology sector, data marketplaces may facilitate the exchange of genomic sequences, clinical trial results, medical research datasets, biological sample information and agricultural genetic data. Such exchanges can support scientific discoveries, personalised medicine and pharmaceutical development. However, they also create legal concerns relating to privacy, ownership, intellectual property, cybersecurity, consent, competition and commercial misuse.

Regulation of these platforms seeks to ensure that data is exchanged lawfully, transparently and securely. It also establishes responsibilities for marketplace operators, data providers, purchasers and third-party service providers.

Legal framework governing data marketplaces

1. Indian legal framework

India does not have one comprehensive law exclusively regulating all data marketplaces. Instead, several laws govern different aspects of data exchange and commercial data transactions.

The Digital Personal Data Protection Act, 2023 establishes obligations concerning the processing of digital personal data. Data marketplaces dealing with identifiable personal information must comply with applicable requirements relating to lawful processing, notice, consent where required, security safeguards and individual rights. Section 16 also empowers the Central Government to restrict transfers of personal data to specified countries or territories. The application of these provisions depends on their commencement and applicable rules.

The Information Technology Act, 2000 addresses unauthorised access, damage to computer systems and certain forms of unlawful disclosure. Sections 43 and 66 may become relevant where marketplace systems are accessed or manipulated unlawfully. Section 72A addresses disclosure of personal information in breach of a lawful contract, subject to its statutory requirements.

The Competition Act, 2002 regulates anti-competitive agreements and abuse of dominant position. Section 3 may apply where data marketplaces engage in collusion, restrictive data-sharing arrangements or exclusionary agreements. Section 4 may become relevant where a dominant platform uses control over valuable datasets to restrict competition.

The Indian Contract Act, 1872, governs contractual arrangements involving data access, licensing, confidentiality and commercial exchange. Intellectual-property protection may also arise under the Copyright Act, 1957, the Patents Act, 1970 and applicable trade-secret principles.

2. European Union regulatory framework

The European Union has developed a more specialised regulatory framework for data marketplaces.

The Data Governance Act, 2022 establishes requirements for certain data intermediation services and promotes trustworthy data-sharing arrangements. It introduces notification and regulatory requirements for covered data intermediaries and establishes safeguards for neutrality and transparency.

The Data Act, 2023, applicable from 12 September 2025, establishes rules concerning access to and use of data generated by connected products and related services. It also contains provisions concerning switching between data-processing services and safeguards against certain unlawful third-country governmental access.

The General Data Protection Regulation (GDPR) applies where marketplaces process personal data. Genetic and health information receive additional protection under Article 9.

These laws distinguish between personal data, non-personal data, data intermediation services and commercial data-sharing arrangements.

Major regulatory issues

1. Data ownership and licensing

One of the most important issues is determining who has the legal authority to provide data through a marketplace. Data may be generated by individuals, research institutions, laboratories, healthcare providers or commercial organisations.

However, ownership of a physical record or database does not automatically establish unrestricted ownership of every item of information contained within it.

For example, a biotechnology company may operate a genomic database containing information obtained from research participants. The company may possess database rights or contractual rights, but this does not automatically give it unrestricted authority to sell identifiable genetic information.

Marketplace agreements should clearly define:

The rights granted to purchasers.

Permitted purposes of data use.

Restrictions on onward transfers.

Duration of access and licensing.

Responsibilities for data accuracy and security.

Procedures for termination and deletion.

2. Privacy and informed consent

Data marketplaces dealing with healthcare and biotechnology information must protect personal information and respect applicable consent requirements.

Genetic datasets may reveal information about individuals and their biological relatives. Even where direct identifiers are removed, combinations of genetic information and other datasets may create re-identification risks.

Platforms should use appropriate anonymisation, pseudonymisation, encryption and access restrictions. Pseudonymised information should not automatically be treated as anonymous because re-identification may remain possible.

3. Data accuracy and quality assurance

Purchasers must be able to evaluate the accuracy, completeness and reliability of marketplace datasets.

For example, a pharmaceutical company purchasing clinical research data may rely on that information when developing a new medicine. Incorrect or incomplete information could affect research conclusions and regulatory submissions.

Marketplace operators should provide appropriate information about data provenance, collection methods, validation, limitations and update history.

4. Competition and market dominance

Large digital platforms may control extensive datasets that smaller businesses and research institutions cannot easily access. This can create competition concerns.

A dominant marketplace may impose discriminatory access conditions, restrict interoperability or favour its own services. Such conduct may attract competition-law scrutiny where the relevant statutory requirements are satisfied.

Regulators must balance protection of commercial investments with fair access and innovation.

5. Cybersecurity and intermediary responsibility

Data marketplaces store commercially valuable and potentially sensitive information. Cyberattacks, insider threats, unauthorised downloads and accidental disclosures may create serious legal consequences.

Platforms should maintain access controls, encryption, audit trails, incident-response procedures and appropriate vendor-management arrangements.

Where the Information Technology Act and applicable rules provide intermediary protections, those protections are conditional and do not create blanket immunity for every activity performed by a platform.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognised privacy as a fundamental right under Article 21. The judgment is important for data marketplaces because commercial exchange of personal information must respect privacy, informational autonomy and constitutional safeguards. It provides a foundation for protecting sensitive healthcare and genetic datasets from arbitrary collection and disclosure.

2. Competition Commission of India v. Google LLC (2023)

The Supreme Court of India declined to interfere with the National Company Law Appellate Tribunal's decision concerning Google's Android-related competition practices. The underlying competition proceedings addressed Google's market position and restrictions affecting competition in digital markets. The case is relevant by analogy to data marketplaces because control over digital ecosystems, access conditions and platform power can raise competition concerns.

3. CCI v. Google LLC (2022)

The Competition Commission of India imposed a penalty on Google concerning its conduct in the Android mobile-device ecosystem. The decision examined restrictions imposed through agreements with manufacturers and the effects of Google's market position. It demonstrates how competition law may regulate powerful digital platforms whose control over distribution channels and data-related ecosystems can affect market participants.

4. Google Spain SL v. Agencia Española de Protección de Datos (2014)

The Court of Justice of the European Union examined the responsibilities of a search engine processing personal information and recognised the possibility of individuals seeking removal of certain search results. Although the case did not directly concern data marketplaces, it demonstrates that digital platforms may have legal responsibilities when processing and making personal information accessible.

5. Asnef-Equifax v. Asociación de Usuarios de Servicios Bancarios (2006)

The Court of Justice of the European Union considered the compatibility of a credit-information system with European competition law. It examined the competitive effects of exchanging information through a credit database. The decision is relevant to data marketplaces because it illustrates that data exchange can support market efficiency but may also require competition-law scrutiny depending on the nature of the information and its effects on competition.

Regulatory responsibilities and compliance measures

Data marketplace operators should adopt clear governance policies covering the collection, storage, licensing, exchange and deletion of information.

Important compliance measures include:

Verifying the authority of data providers to share the information.

Establishing transparent data licensing agreements.

Providing accurate descriptions of datasets and their limitations.

Implementing appropriate privacy and cybersecurity safeguards.

Maintaining records of data access and onward transfers.

Preventing discriminatory or anti-competitive access practices.

Establishing procedures for complaints, disputes and data breaches.

Reviewing compliance with applicable domestic and international transfer rules.

Biotechnology marketplaces should also distinguish between personal genetic information, anonymised research datasets, commercially confidential scientific information and intellectual-property-protected material. Each category may require different legal safeguards.

Conclusion

Data marketplaces and exchange platforms play an increasingly important role in modern digital economies and biotechnology research. They facilitate commercial innovation, scientific collaboration and efficient use of information, but also create legal challenges involving privacy, licensing, competition, cybersecurity and accountability. India's regulatory approach is based on several existing laws rather than a single comprehensive marketplace statute. The European Union has introduced more specialised rules through the Data Governance Act and Data Act. Judicial decisions concerning privacy, digital competition and information exchange provide important principles for regulating these platforms. Effective regulation must ensure that data can be exchanged for legitimate purposes without compromising individual rights, commercial confidentiality or fair competition.