The Open Sports Data Alliance develops guidance and recommended practices for companies that hold sports and activity data. We help device makers, activity platforms and applications meet their obligations under the EU Data Act and the GDPR, so that athletes can access their data and share it with the services they choose.
Which data is available to the athlete, and which is the company's choice?
Heart rate as measured by the sensor.
Spikes and dropouts removed. Processing disclosed.
Calculated by the company's own algorithm.
Activity data now flows from watches, bike computers, rings and phones, through platforms and APIs, to coaching, health, research and artificial intelligence services. European legislation sets out what athletes are entitled to. It does not specify how companies should implement it for activity data.
People are entitled to receive the personal data they have provided, including data recorded by their own devices, in a structured and machine-readable format, and to have it transmitted to another service. This applies to device makers, platforms and applications alike.
Applicable since 12 September 2025. Users of connected products are entitled to access the data their products generate, continuously where relevant, and to have it shared with services of their choice. Products placed on the market from 12 September 2026 must be designed to make that data accessible.
Each company currently interprets the same obligations independently. Smaller companies often lack the resources to do so.
Developers encounter different interpretations, and different terms, at every platform they connect to.
Athletes have limited visibility of which services hold their data and for what purpose.
The Alliance publishes two complementary documents. Every statement in them is identified as either a legal requirement or a recommendation.
What the GDPR and the Data Act require of companies that hold activity data, explained in plain language.
How to meet those obligations well. Voluntary, and expressed as outcomes rather than a single prescribed API.
Short, practical material based on the Alliance's guidance, available to everyone.
Nine legal requirements that apply from the first user, and five practices that are easiest to adopt early. For founders of start-ups that collect or receive sports and activity data.
Athletes decide who may hold the data they generate, what it may be used for, including artificial intelligence, and whether it may be passed on. This applies equally to every company that holds it.
Heart rate, location, power, workouts and sleep, in raw or cleaned form, including the athlete's complete history. Available to the athlete and to any service they choose.
Proprietary metrics, algorithms, product designs and trade secrets. A company may choose to keep these to itself or to share them. European legislation protects that choice.
A proprietary metric may be offered alongside the data from which it was calculated. It should not replace that data.
We recommend no restriction on using data in competing services. Better products are the purpose of portability.
Platforms may charge other companies for access. Fees should be published, reasonable and non-discriminatory. Access for athletes themselves is free.
Membership is open to every organisation that holds or uses activity data, regardless of size. Each member has a voice in what the Alliance publishes.
Watches, bike computers, rings and sensors.
Clarity on what the Data Act and the GDPR require, protection for proprietary work, and trustworthy receiving services.
Services where athletes record, upload and share activities.
Clarity on what data portability requires, data from more sources, and trustworthy receiving services.
Aggregators, intermediaries and business APIs.
Clarity on rights and obligations as a receiving service, and a credible indication of trustworthiness.
Coaching, analytics, health and social applications.
Predictable access, clear boundaries for artificial intelligence, and a trust mark athletes recognise.
Sports science, public health and academia.
An ethical, consent-based route to data, and a voice in shaping the guidance.
Everything we publish is assessed first on whether it gives athletes control over the data they generate.
Every statement is identified as either our reading of legislation or our recommendation.
Obligations apply equally to every party that holds an athlete's data. Members follow our guidance even where legislation exempts them.
We build on legislation and established standards before writing anything new.
A company may choose to keep its proprietary metrics, algorithms and trade secrets to itself.
Certification will involve independent audits and the possibility of revocation, not self-assessment.
Drafts are reviewed by members. Final guidance is published openly.
We operate under competition law counsel. Members do not discuss pricing or commercial terms.
The Alliance does not create new rights. It helps implement existing rights for activity data, and cites the source of every requirement.
| Subject | Source |
|---|---|
| Portability of personal data to another service | Art. 20 GDPR |
| Access to data generated by connected products | Art. 3–4 Data Act |
| Sharing data with a service chosen by the user | Art. 5–6 Data Act |
| Raw and cleaned data versus derived data | Recital 15 Data Act |
| Compensation when data is shared at a user's request | Art. 8–9 Data Act |
| Unfair contractual terms between companies | Art. 13 Data Act |
| Consent and health data | Art. 7, 9 GDPR |
| Codes of conduct and certification | Art. 40–42 GDPR |
| Authorisation and data formats | OAuth 2.0, FIT, JSON |
The Alliance was initiated in October 2026 by Aart Goossens, founder of SweatStack, and is at an early stage. Its first guidance documents are in draft and will be reviewed by legal experts and founding members before publication.
Purpose, scope and principles of the Alliance.
Draft 0.1 of the Activity Data Compliance Guide and the Recommended Practices.
Review of the drafts by legal experts and founding members.
Publication of the first edition, and engagement with the European Commission.
No. The Alliance does not campaign for or against any company and does not negotiate commercial terms on behalf of its members. It publishes guidance and recommendations that any organisation may use.
No. Certification will indicate that an organisation handles activity data responsibly. Each platform continues to decide whom it works with, within the requirements of applicable legislation.
No. The guidance explains obligations under European legislation and is prepared with legal experts. It does not replace legal advice or the interpretation of regulators and courts.
Micro and small enterprises are exempt from certain obligations of data holders under the Data Act. The GDPR, including the right to data portability, continues to apply. Members of the Alliance follow its guidance regardless of their size.
Yes. A company may choose to keep its proprietary metrics, algorithms and trade secrets to itself, and the Data Act protects that choice. The Alliance's guidance concerns the data athletes generate, including their complete history.
The Data Act and the GDPR apply to every company serving users in the European Union, wherever it is established. The Recommended Practices are written to be applicable worldwide.
The Alliance welcomes device makers, activity platforms, data providers and application developers, as well as legal and research experts. Members contribute to the guidance and receive the current drafts for review.