This page sets out how the Databanking model could be tested in Estonia, by replacing one transfer of state-held data to private companies with a query to a licensed custodian of the person's choosing, on infrastructure Estonia already operates: X-Road, strong electronic identity, the consent service and the Data Tracker.
Organisations frequently do not need a copy of a person's underlying data. They need an answer derived from it. Databanking keeps the data with a regulated custodian. The organisation submits an authorised query or computation, and the Databank returns only the permitted result: an attestation, a match or no-match, an eligibility decision. The worked example follows one such transaction end to end.
Estonia has already built much of what such a model requires. X-Road lets institutions query one another's registries instead of replicating them. The once-only principle obliges the state to ask a person for any given fact a single time. Strong electronic identity is in everyday use, and the Data Tracker on the state portal shows people which institutions have accessed their records. What Estonia has not yet built is the step that keeps a record from being copied when it crosses into the private sector. When a person authorises a company to use state-held data through the consent service, the data is transferred to that company, which from then on holds its own copy.
This pilot aims to replace such transfers with queries. The record would be held by a licensed custodian of the person's choosing, the relying company would submit its computation to that custodian, and only the permitted result would be returned. On infrastructure that already works at national scale, it would test parts of the proposed Databanking model that have not been tested by any existing system: a custodian independent of both the source registry and the relying company, more than one such custodian competing for accounts, portability between them, and a share of each access fee returned to the person whose data was queried.
Estonia already operates key technical and civic foundations of the Databanking model at national scale: in-place querying, identity-bound access, citizen-visible access logs and individual-initiated data release. These established capabilities provide a strong starting point for implementing and testing the integrated Databanking architecture.
The state data-exchange layer, in production since 2001 and operated by the Information System Authority (RIA). Registries are queried where they sit, and the layer is federated with Finland's.
Strong authentication by ID card, Mobile-ID or Smart-ID is routine, and binds each transaction to the personal identification code. The once-only principle means that the state asks for a given fact a single time.
On eesti.ee since 2017, the Data Tracker shows people which institutions have accessed their data. A proposal to make it mandatory for nearly all public databases followed in 2025.
In use since 2021, the consent service lets a person authorise the release of tax, health-insurance or prescription data to a named company. By 2024 a fifth of adults had used it.
Within the state, each registry still holds and uses its own data. X-Road federates access between institutions that are both the custodians of their records and the parties that analyse them. The Databanking pilot leaves this arrangement untouched and concerns only the boundary with the private sector.
At that boundary, the consent service ends in a transfer. Once a person consents, the state-held data is released to the company, which then holds a copy under its own retention policy and its own security. A person who applies for credit with three lenders creates three copies of the same tax record. The consent service logs each transfer, but no log can follow a copy after it has left.
A custodial market does not exist yet. There is one state layer, no competing custodians, no account to move between them, and no mechanism by which part of the value of an access can be returned to the person whose data was accessed. When the consent service was launched, the Government Chief Data Officer said that people "will have the opportunity to charge a fee for the use of their data if they so wish". That fee is one of the things this pilot would explicitly test.
The pilot would introduce one new institution, a licensed custodian or Databank, and route a single class of transaction through it.
The Databank never analyses what it holds. It keeps the record, enforces the individual's permissions, executes approved computations and releases bit-scarce results under an auditable leakage budget. It earns revenue from custody and authorised access alone. The individual can move the account to the other pilot Databank at any time, on a standardised account schema, without the record passing through any relying company.
Every element of this flow, except the custodian, already exists in Estonian production infrastructure.
The value of a pilot lies in testing the assumptions most vulnerable to failure. For Databanking, these are institutional and economic: whether individuals will entrust a record to an independent custodian, whether relying organisations will accept an answer in place of the record, whether custodians can compete and accounts can move between them, and whether a custodian can sustain itself without exploiting what it holds.
In most jurisdictions, much of a pilot's budget would go into building what Estonia already runs: a data-exchange layer, identity binding, authoritative source registries, and a channel through which a person can release state-held data. In Estonia these exist, are trusted and are used daily, so the resources of a pilot there can be concentrated on the parts of the model that no existing system tests.
Estonia also brings a civic habit that elsewhere would have to be built from nothing. Its residents have been able to see on the state portal who accessed their records since 2017, and when the Chancellor of Justice found in 2025 that state agencies had queried residents' bank account information without a proper legal basis, the response was to extend that visibility. A Databank account statement listing every query and its result would extend something already familiar to Estonians.
At about 1.36 million people, with a compact set of institutions that already cooperate across the public and private sectors on X-Road, Estonia is of a scale at which a bounded infrastructure experiment is meaningful and its results legible. And as a Member State of the European Union, it would run the demonstrator directly under the GDPR, the Data Governance Act, the European Digital Identity framework and the Consumer Credit Directive, so the results would bear on EU law as it stands, and on the amendments now before the co-legislators.
The Estonian pilot would test four forms of viability, weighted towards the institutional and the economic, since X-Road and Estonian eID already settle most of the technical questions.
Largely established by X-Road and Estonian eID. What remains open is sandboxed execution of a lender's computation inside the custodian, and a leakage budget on a continuous value.
Can a custodian independent of both the source registry and the relying company hold a credible separation between custody and exploitation, and be seen to do so through the same Data Tracker that already covers the state?
Will individuals choose a custodian, and move between two? Will lenders accept a result in place of the record? Does the individual's share of the fee matter, and at what level?
Can the supervisor accept a Databank result and audit record as discharging a lender's duties? Where would a Databank sit under the Data Governance Act, and under the Digital Omnibus proposal to fold its rules into the Data Act?
The initial transaction should be selected jointly with the participating organisations and regulators. One candidate fits Estonian conditions closely enough to be proposed as the starting point.
Under the Creditors and Credit Intermediaries Act and the principle of responsible lending, Estonian lenders must verify a borrower's income before granting credit. From 20 November 2026 the revised Consumer Credit Directive requires the creditworthiness assessment across the EU to rest on "relevant and accurate information on the consumer's income and expenses" that is "necessary and proportionate" to the credit, verified where necessary against independently verifiable documentation. Today an Estonian lender can meet this duty by obtaining the applicant's tax data, through the consent service or otherwise, and deriving the affordability decision itself. In the pilot the same transaction runs inside a Databank:
The baseline already exists: the same transaction runs today through the consent service with a full transfer of the record, so the pilot can compare answer against record directly rather than against a hypothetical. The relying organisations are supervised and under a legal duty to verify, so the regulatory question is precise. Income is the standard target for leakage, since repeated affordability queries at different amounts would progressively narrow the income beneath them, and the pilot would test the leakage budget on exactly the class of query that most needs one. The transaction carries enough value to support a fee, so the economics and the individual's share can be measured on real terms. And both sides can see the benefit: the applicant discloses less, and the lender holds less personal data that it must secure, retain and eventually delete.
Other Estonian candidates remain open: age and eligibility attestations drawn from the population register, treated in general terms in the age assurance case; health-insurance and prescription data for private health providers, two datasets already offered through the consent service; and research access to health records, the most institutionally demanding of them, discussed in the health data case.
A realistic Databanking transaction involves four roles. Three are already filled in Estonia; the pilot adds the fourth, with two custodians rather than one.
Above these sits the governance layer: the Ministry of Justice and Digital Affairs for policy; RIA as operator of X-Road, eesti.ee, the consent service and the Data Tracker; Finantsinspektsioon, the Financial Supervision and Resolution Authority, for the lenders; the Data Protection Inspectorate; and an independent auditor. Which authority licenses and supervises the custodians themselves is settled in the first phase.
The whitepaper allows a Databank to be a commercial company, a non-profit or a state-backed institution, and the pilot custodians may take any of these forms, provided each is independent of both the source registry and the relying organisations. Two custodians are the minimum at which choice, switching and portability on a common schema can be observed in practice. Estonia's infrastructure keeps the cost of the second one low, since both connect to the same exchange layer, the same identity system and the same source registry.
Databanking has an inherent multi-sided network problem. Individuals have little reason to open an account until organisations accept its answers, organisations have little reason to integrate until enough individuals hold one, and data providers have little reason to build interfaces before either.
In Estonia two of the three sides are already connected. The source registry offers its data over X-Road through the consent service, and lenders already use that service in credit applications. The pilot therefore needs to add only the custodian and a closed group of participants: lenders that agree in advance to accept a defined Databank output, and a bounded cohort of applicants recruited at the point where the consent service already appears in the lender's application. An applicant at that step can be offered the choice between releasing the record to the lender and holding it with a Databank, which also gives the pilot a natural comparison group.
The demonstrator should sit alongside an interdisciplinary research programme. Estonian infrastructure settles parts of some of these questions and sharpens others, and the last is specific to Estonia. Several are already open research strands in their own right.
Affordability queries at different amounts can bisect the income beneath them. The retention-bounded leakage budget described in the whitepaper, a per-datum quota shared by all Requestors and derived from the short period for which a result may lawfully be held, would be tested on live lending traffic.
Lenders' affordability rules are proprietary. A rule has to be approved for execution without being disclosed beyond what approval requires, and without becoming a channel for extracting the record.
Tax data is authoritative but lags current income. The pilot must define how corrections flow back to the Tax and Customs Board, and who is responsible when the source is wrong.
Largely settled by the personal identification code and strong eID, which frees the pilot to concentrate elsewhere. What remains is authorisation by representatives, and the binding of a lender's application to the right account without the lender learning more than it already holds.
Responsibility has to be allocated among the source registry, the Databank, the lender's computation and the lender itself.
A lender could make a broader query a condition of credit. The Consumer Credit Directive's proportionality requirement gives the governance model a legal anchor for defining which queries a lender may request.
With two custodians, breach containment and continuity can be tested directly, including the transfer of accounts if one custodian fails.
Accounts must move between the two pilot Databanks on a common schema. In a later phase the same test can run across the Estonia–Finland X-Road federation.
The pilot should measure the cost of custody, computation, audit and support against fee income and the individual's share, and set both against what lenders spend today on holding copies: security, retention and deletion.
Can a non-state custodian's access log appear on eesti.ee through the Data Tracker protocol, and do people read it? Estonia offers an established baseline of public use against which this can be measured.
The decisive test is whether three propositions hold at the same time. Individuals are willing to entrust the relevant record to a custodian they chose. Relying organisations accept the minimal authenticated result instead of the underlying record, and their supervisor accepts that they have done so lawfully. The Databanks provide the service on economically sustainable terms while remaining strictly independent of commercial exploitation of what they hold.
Three further criteria are specific to the Estonian design: accounts move between the two custodians on the common schema without loss and without passing through any relying organisation; the individual's share of each access fee is paid and visible on their statement; and every query is visible on eesti.ee.
Secondary measures include the number of record copies that would otherwise have been transferred to lenders, accuracy, latency, dispute and correction rates, the frequency with which leakage budgets bind, integration cost for lenders, and compliance cost. Failure on any of these is itself evidence, and identifies where the model requires modification.
A Databank would provide a data intermediation service between data subjects and data users, and the Data Governance Act already requires such a service to be provided through a separate legal person and to use the data for no other purpose. The Commission's Digital Omnibus proposal of November 2025 would repeal the Act and carry its intermediation rules into the Data Act, as a voluntary label with functional rather than legal separation. The pilot would generate direct evidence on the question that change reopens: how much separation between holding data and using it is needed before individuals and relying organisations will trust an intermediary. The comparison with EU data-governance law sets out how far the Act already goes towards a Databank.
Each Member State must offer a European Digital Identity Wallet by the end of 2026, and Estonia's is in procurement. A wallet presents attestations already issued, while a Databank computes a fresh answer from the record each time a regulated question is asked. The two are complementary, and the pilot can establish how a Databank result is best carried by the wallet.
The Consumer Credit Directive's proportionality test is the legal standard against which the lead use case would be judged. And the Interoperable Europe Act allows public administrations to establish interoperability regulatory sandboxes around a clearly defined legal question, with at least three administrations taking part, ideally from different Member States. A cross-border phase linking Estonian and Finnish administrations over the federated X-Road, with a third participating administration, would fit that frame.
A successful pilot leads not automatically to scale-up but to an evidence-based decision about which parts of the model merit further development.
The only commitments needed at this stage are those that allow the first two phases, scoping and design, to begin. None involves legislation, national deployment or funding.
If the answer can be demonstrated convincingly, the resulting architecture, regulatory treatment and economic evidence would provide a basis for deciding whether Databanking should develop into a broader infrastructure industry, in Estonia and across the Union.
The model itself is set out in the Databanking whitepaper, and the FAQ addresses the objections it most often meets. Enquiries about participation in a pilot are welcome at contact@databanking.org.