Fundamentals

Is There Such a Thing as Data Ownership? Rights, Control, and Protection

By Daniel Sardá · Published on October 13, 2026

7 min read1,512 words

Calling something data ownership can conceal several different questions. The answer depends on what is protected, against whom, and under which rules.

Someone records their physical activity with a smartwatch. The manufacturer retains the measurements, one app organizes them, and another company produces an estimate of the person’s health. Who owns that data?

The short answer is: it depends on the data, the power being claimed, and the legal system in question. Owning a device, collecting a measurement, hosting a file, or being able to consult it does not automatically make someone the owner of all the information involved.

The phrase “data ownership” is appealing because it promises a simple rule. Yet it often bundles together different problems: privacy, access, use, custody, confidentiality, intellectual property, and contractual obligations. Separating them helps identify the interest that deserves protection without creating a general monopoly over information.

Key idea: The useful question is not simply “who owns it?” but “what is being protected, what power is claimed, against whom, and under which jurisdiction?”

Data are not the same as their medium or their meaning

Imagine a file stored on a server. The server is a physical asset. The file is an arrangement of digital signals. Its content may describe a transaction, include a photograph, or reveal something about a person. From that content, someone may also build a database or infer a pattern.

These are connected layers, but they are not identical:

• The medium is the device or infrastructure on which information is recorded.
• Data are a representation that can be stored or processed.
• Informational content is what that representation communicates.
• A database organizes a set of elements according to a particular structure.
• A derived result arises from analysis, combination, or inference.

Owning the phone or server does not by itself establish ownership of every item of stored content. Likewise, assembling many data points may justify protection for an organized database without granting exclusive ownership over every fact it contains. Legal doctrine has stressed these differences precisely because ordinary language tends to blur them.

Ownership, control, access, and custody do different jobs

Ownership commonly suggests an exclusive right enforceable against third parties. Control, by contrast, may be merely technical: a platform decides who can enter its systems or which operations it permits. Custody describes responsibility for keeping something safe, while access authorizes someone to consult or obtain information under specified conditions.

Consider a cloud-storage service. The company controls the infrastructure and holds the files in custody; the user may retain rights in the content; a collaborator may have read permission; and an authority may request access if it satisfies the applicable legal requirements. None of these positions necessarily amounts to owning “the data” in a general sense.

The distinction also prevents confusion between factual power and legal authority. A company may have the technical ability to copy a database without legal authorization to do so. Conversely, a person may have a right to receive certain data even though they do not control the system in which they are stored.

Personal data are protected as part of an individual sphere

When information concerns an identified or identifiable person, interests connected to autonomy, dignity, and privacy arise. In the European Union, the General Data Protection Regulation defines personal data and, subject to specific conditions, recognizes rights of access, rectification, erasure, restriction, portability, and objection.

Those powers give people control over processing, but the GDPR does not generally declare every person the civil-law owner of any data related to them. The rights come with conditions, exceptions, and limits: they may coexist with legal retention duties, third-party rights, or legitimate public interests.

For that reason, “your data belong to you” may express an understandable political demand, but it is legally imprecise. A more useful formulation asks what processing is allowed, what information must be provided, what correction may be demanded, and when data may be erased, transferred, or no longer used.

Key idea: Protecting personal data need not rest on the fiction that all information about a person functions as an item of their property.

A database can be protected without appropriating every datum

An ordered collection may require investment, judgment, and work. That activity differs from the individual elements collected. In the European Union, Directive 96/9/EC provides two limited avenues: copyright may protect an original selection or arrangement, and a sui generis right may, where its requirements are met, protect substantial investment in obtaining, verifying, or presenting the contents.

That does not mean every table or set of records is protected, nor that a database maker automatically acquires rights over every element. Structure, investment, and content must be assessed separately. A directory may have a protectable organization even though many of its entries are facts available through other means.

Content included in a database may also have its own legal regime. A photograph, text, or computer program may be subject to intellectual-property protection; an isolated figure or fact need not be. Protecting one layer does not absorb all the others.

Trade secrets and contracts protect specific relationships

Non-personal data do not exist in a legal vacuum either. An industrial formula, a confidential customer list, or certain operating parameters may qualify as trade secrets. In the European Union, Directive 2016/943 requires, among other conditions, that the information be secret, have commercial value because it is secret, and have been subject to reasonable steps to keep it secret.

Trade-secret protection addresses unlawful acquisition, use, or disclosure. It does not necessarily grant exclusivity against someone who independently reaches the same knowledge. That boundary matters: it protects investment and trust without turning every useful piece of information into closed territory.

Contracts serve a different function. Parties can agree who may access certain data, how they may use them, how long they must retain them, or which security measures they will apply. But a contractual clause binds within the framework of applicable law and the relationship between the parties. By itself, it does not establish a property right enforceable against the whole world. The difference between contractual rights and property rights is particularly important in digital services and licensing.

Derived results raise a new question

Suppose thousands of sensors record temperature, location, and consumption. A company combines those measurements and estimates when a machine will fail. The input records, the organized database, the analytical model, and the final prediction need not share the same legal regime.

The inference may embody the knowledge of its producer, but it may also reveal personal or confidential information. It is therefore not enough to ask who generated the original data. One must examine how the result was obtained, which sources it uses, whether confidentiality duties apply, and what rights of other people may be affected.

Anonymization should not be treated as a magic word either. Its effectiveness depends on the context, the possibilities of re-identification, and the applicable legal standard. An aggregated dataset may reduce risk without automatically becoming free of every restriction.

Access and circulation matter too

Absolute exclusivity can create incentives to collect and organize information, but it can also obstruct competition, research, innovation, or freedom of expression. The task is to protect investments and personal spheres without closing off more information than necessary.

Legal systems therefore use different tools. Some recognize rights of access or reuse; others protect confidentiality, databases, or original works. The European Union’s Data Act, for example, establishes rules on access to and use of certain data generated by connected products. Its use of the term “data holder” does not by itself create universal ownership of such data: it assigns roles and powers within a specific regime.

Nor does “public” always mean “without limits.” Accessible information may still be affected by privacy, copyright, legitimate conditions of access, or sector-specific rules. Once again, the general label gives way to the specific question.

Key idea: Protecting an investment does not necessarily require owning every fact; protecting a person does not require turning identity into a commodity; enabling access does not eliminate every limit.

How to ask the right question

Before claiming that someone “owns” particular data, identify five elements:

1. The object: Is the dispute about a medium, personal data, creative content, a database, a secret, or an inference?
2. The power: Is the aim to exclude, access, copy, correct, erase, transfer, publish, or reuse?
3. The relationship: Is the claim directed at a contracting party, custodian, competitor, platform, or any third party?
4. The protected interest: Privacy, investment, confidentiality, authorship, security, or free circulation?
5. The jurisdiction: Which law applies, and what conditions does it impose?

This map offers no slogan as forceful as “the data are mine” or “data belong to whoever collects them.” It offers something better: a way to avoid letting one word appear to resolve very different conflicts.

Property is a valuable institution for defining powers, responsibility, and exchange. But in an information environment it coexists with privacy, contracts, secrecy, competition, and access. The appropriate protection does not always take the form of ownership, and recognizing that can defend both individual autonomy and a society open to knowledge.