Data exchange layers explained: X-Road, Account Aggregators, Myinfo and Europe's data spaces
Identity and payments get the headlines, but the third pillar of digital public infrastructure, data exchange, is where much of the value lies. It decides whether a person must keep photocopying the same documents, or whether systems can, lawfully and securely, ask each other. There is no single model. This guide compares the main ones.
Three families of data exchange
| Family | Basis for sharing | Typical examples |
|---|---|---|
| Law-based exchange between authorities | A legal mandate allows one public body to query another's register. | Estonia's X-Road, Finland's Suomi.fi Data Exchange Layer, the EU Once-Only Technical System. |
| Consent-based personal data sharing | The individual authorises a specific flow of their data to a specific recipient. | India's Account Aggregators, Singapore's Myinfo and SGFinDex, open banking regimes. |
| Data spaces and sector sharing | Contracts, common rules and, increasingly, legislation on access to data held by companies or the public sector. | EU data spaces under the Data Governance Act and Data Act; the European Health Data Space. |
The families overlap and can share technology, but they answer different questions: may this authority know this?, does this person want this shared?, and on what terms can organisations pool or access data?
Law-based exchange: X-Road and the once-only principle
Estonia's X-Road, in use since 2001, is the archetype: a federated layer through which registers exchange signed, logged messages. Data stays with the responsible authority. Finland adopted the same technology for its national data exchange layer in 2015, and the two were connected in 2018.
At EU level, the Single Digital Gateway Regulation (Regulation (EU) 2018/1724) requires a cross-border Once-Only Technical System, through which a citizen or business using certain online procedures in one member state can request that evidence (such as a diploma or birth certificate) be fetched directly from the competent authority in another, after previewing it. The system has been rolling out since December 2023.
Strength: people stop being couriers for their own data. Watch-out: the legal mandate defines what can be exchanged, so the quality of the law and of oversight is everything.
Consent-based sharing: Account Aggregators and Myinfo
India's Account Aggregator framework is a regulated system for sharing financial data with the individual's consent. The Reserve Bank of India created a licence category for account aggregators in 2016, and the network went live in September 2021. Account aggregators are "data blind" intermediaries: they carry encrypted data from a financial information provider (such as a bank) to a financial information user (such as a lender) according to a machine-readable consent artefact, which specifies the data, the purpose, the recipient and the duration. The approach follows the Data Empowerment and Protection Architecture (DEPA) outlined by NITI Aayog in a 2020 draft.
Singapore's Myinfo, launched in 2016, takes a more centralised route: residents consent, within the national login flow, to share government-verified data with a public or private service. SGFinDex, launched in December 2020, lets individuals consolidate financial information from banks and agencies. See the Singapore case study.
Open banking regimes, such as the United Kingdom's (live since January 2018) and the access-to-account rules of the EU's second Payment Services Directive, also belong to this family, with standardised APIs that banks must open to authorised third parties when the customer agrees.
Strength: individuals can use their own data to get credit, advice or services. Watch-out: consent can become a formality. If refusing means no loan, or if consent screens are opaque, the safeguard weakens. Recipients' data retention and reuse must also be regulated.
Data spaces: Europe's approach
The European Union has built a legal framework for wider data sharing:
- the Data Governance Act (Regulation (EU) 2022/868), applicable since September 2023, sets rules for the reuse of certain protected public-sector data, for neutral data intermediation services and for "data altruism";
- the Data Act (Regulation (EU) 2023/2854), applicable since 12 September 2025, gives users of connected products rights to access and share the data they generate, and sets rules on cloud switching;
- sector-specific common European data spaces, the first legislated being the European Health Data Space (Regulation (EU) 2025/327), which organises both patients' access to their electronic health data and the secondary use of health data for research and policy, with obligations phased in over several years.
Technically, data spaces often rely on "connectors" that enforce usage policies, with initiatives such as the International Data Spaces Association and Gaia-X working on common specifications.
Strength: a framework for sharing beyond single transactions, including industrial and research data. Watch-out: complexity. The rules, governance bodies and technical standards are still settling, and smaller organisations can struggle to participate.
Design choices that cut across all models
- Federation versus centralisation. Querying the source at the moment of need is generally safer than building a central copy.
- Logging and transparency. Every exchange should be logged, and individuals should be able to see exchanges involving their data.
- Purpose and retention. The receiving party's use and retention of data must be limited and auditable, or the exchange becomes a leak with extra steps.
- Standards. Shared schemas and vocabularies (the semantic layer) decide whether data is usable once received. See interoperability and open standards.
- Governance of participants. Who can join, how they are certified, and how they are removed when they misbehave.
Which model for which job?
Most mature systems combine models: law-based exchange for core public administration, consent-based sharing where individuals choose to use their data with private services, and data-space rules for broader sharing. The mistake is to use one model where another fits: relying on "consent" for data flows that are really mandatory, or using a broad legal mandate to justify exchanges that should require the person's agreement.
Sources
- Nordic Institute for Interoperability Solutions, History of X-Road.
- European Commission, Once-Only Technical System.
- Reserve Bank of India, Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016; Sahamati, Account Aggregator ecosystem.
- NITI Aayog, Data Empowerment and Protection Architecture (draft for discussion) (August 2020).
- EUR-Lex: Data Governance Act, Data Act, European Health Data Space Regulation.
Case studiesEstonia's X-Road
The federated data exchange layer launched in 2001, how it works, how it went open source and cross-border, and what transfers elsewhere.
GuidesInteroperability and open standards
The four levels of interoperability, what makes a standard open, and the standards that matter for ID, payments and health.
AnalysisDPI for health: India's ABDM
Health accounts, registries, consent-based record sharing and the open questions on consent, standards and data protection.