Who owns and manages the data in a smart district?

Usually no single party, and "ownership" is rarely the most useful way to frame the question. A district involves building owners, occupiers, an estate manager, utilities, service providers and sometimes a public authority, each generating and using different information. What actually needs settling, category by category, is who may access, use, share, retain and export each kind of data, who is responsible for its quality and protection, and what happens when one of the parties changes. Where personal data is involved, legal roles apply that no contract wording can override.

The practical tool is a district data-rights schedule, agreed between the parties and written into the relevant contracts with proper legal and data-protection input.

Rights are not the same as responsibilities

The organisation that operates a sensor may not be the one hosting the platform, and neither may be the one using the output. For each category of data, it helps to separate the rights (to access it, use it for stated purposes, share it with third parties, retain it, export it and license it onwards) from the responsibilities (for its quality, security, retention and deletion, for responding to requests and for maintaining its definitions).

Vague assurances do not cover this. A platform proposal that says "the client owns the data" may still restrict export formats, charge for historical data or limit what other suppliers can do with it. The rights that matter need to be written down explicitly.

Personal data has its own rules

Where data relates to identifiable people, as with access-control events, occupancy linked to individuals, resident accounts, licence-plate recognition or CCTV, the EU General Data Protection Regulation (GDPR) applies within its territorial scope (other jurisdictions have their own data-protection laws), and its roles follow from what each party actually does, not from what a contract calls it. The Regulation defines a controller as the body that, alone or jointly with others, determines the purposes and means of processing personal data (Article 4(7)), and a processor as one that processes personal data on behalf of a controller (Article 4(8)). Where two or more controllers jointly determine purposes and means, they are joint controllers and must set out their respective responsibilities in an arrangement between them (Article 26). The European Data Protection Board's guidelines on these concepts stress that they are functional: they allocate responsibility according to the parties' actual roles. In a district, the estate manager, a building owner and a platform supplier may each occupy different roles for different processing activities.

That is why "ownership" language in a technology contract does not settle data-protection responsibility. The roles have to be assessed with the data-protection officer or legal adviser for each processing activity, and the supporting agreements put in place.

Data from connected products

The EU Data Act, which has applied since 12 September 2025, gives users of connected products the right to access the data their use generates and to have it shared with third parties. In a district with several owners, operators and suppliers, who counts as the user of a given product may not be obvious. That is a legal question for each arrangement, and a strong reason to state data-access terms in procurement instead of leaving them to a supplier's defaults.

The data-rights schedule

The categories, purposes and periods in the table are examples; each has to be agreed for the actual district.

When parties change

Districts outlive their contracts, so the schedule must say what happens when things change. When a building is sold, which records transfer to the new owner and which access ends? When a tenant leaves, what is deleted, retained or returned? And when a service provider is replaced, how are historical data, configuration and documentation exported in usable form, within what period and at what cost?

Transition rights that exist only on paper are of little value. Test an export early in the contract, while there is still time to fix what fails.

Governance for next Tuesday

A policy document does not decide who may see a data set next Tuesday; people do. Someone has to approve new access requests and new uses, someone has to maintain the data definitions and resolve disputed values, and someone has to review the schedule when parties or services change. Data-protection requests and incidents need a named handler too.