In the EU, a database can be protected in two separate ways: by copyright, if the selection or arrangement of its contents is original, and by the sui generis database right, if its maker made a substantial investment in obtaining, verifying or presenting the contents. The second right needs no originality at all and lasts 15 years, renewable through substantial new investment. This guide is for data-driven companies, platforms and investors who need to know what their datasets are actually worth in law.
Key takeaways
- Copyright protects the structure of a database (its selection or arrangement), never the data itself, and only if it is the author’s own intellectual creation.
- The sui generis right protects the investment in obtaining, verifying or presenting the contents, not the effort spent creating the data.
- It lasts 15 years from 1 January after completion or first publication, and a substantial change can start a new term.
- Only makers who are EU nationals, residents or companies established in the EU can claim it.
- Since 12 September 2025, the Data Act excludes data obtained from or generated by connected products from the sui generis right.
What counts as a database under EU law?
Directive 96/9/EC on the legal protection of databases defines a database as “a collection of independent works, data or other materials arranged in a systematic or methodical way and individually accessible by electronic or other means” (Directive 96/9/EC, art. 1(2)). The definition is broad: a product catalogue, a price list, a directory of suppliers, a job board, a training dataset or a paper card index can all qualify. The software used to build or run an electronic database is excluded (art. 1(3)); it has its own copyright regime.
Spain transposed the Directive into its Consolidated Intellectual Property Law (TRLPI): article 12 covers copyright in collections and databases, and articles 133 to 137 cover the sui generis right (TRLPI, BOE).
Copyright or sui generis right: how do they differ?
The two rights can apply to the same database at the same time, but they protect different things and follow different tests.
| Point | Copyright (art. 3) | Sui generis right (art. 7) |
|---|---|---|
| Test | Selection or arrangement is the author’s own intellectual creation | Substantial investment, qualitative or quantitative, in obtaining, verification or presentation of the contents |
| What it protects | The structure, not the contents | The contents against extraction and re-utilisation of all or a substantial part |
| Who holds it | The author (or whoever acquires the rights) | The maker: the person who takes the initiative and the risk of investing (art. 133.3 TRLPI) |
| Term | Life of the author plus 70 years (art. 26 TRLPI) | 15 years, renewable by substantial new investment (art. 10) |
| Who can claim it | Authors protected under copyright rules generally | EU nationals, residents and established companies (art. 11) |
The copyright bar is higher than many companies assume. In Football Dataco v Yahoo (C-604/10, 1 March 2012), the Court of Justice of the EU (CJEU) held that a database is protected by copyright only if the selection or arrangement of the data is an original expression of the author’s creative freedom; significant labour and skill in setting it up are not enough on their own. Most commercial datasets, which aim at completeness rather than creative choice, will rely on the sui generis right instead.
How does the EU database right work in practice?
Article 7 of the Directive lets the maker prevent “extraction” (transferring all or a substantial part of the contents to another medium) and “re-utilisation” (making all or a substantial part available to the public). It also prohibits the repeated and systematic extraction of insubstantial parts when that conflicts with normal exploitation or unreasonably prejudices the maker (art. 7(5)).
What investment counts
In British Horseracing Board v William Hill (C-203/02, 9 November 2004), the CJEU drew the line that still decides most cases: investment in “obtaining” means the resources used to seek out existing materials and collect them, not the resources used to create the data. Investment in “verification” means monitoring the accuracy of the materials collected, both when the database is built and while it operates. A company that generates data as a by-product of its main business (fixtures, timetables, its own prices) may therefore struggle to show qualifying investment.
Scraping and aggregators
Making a database freely available online does not waive the right. In CV-Online Latvia v Melons (C-762/19, 3 June 2021), the CJEU held that a specialised search engine that copies and indexes a substantial part of a freely accessible database is extracting and re-utilising it, and the maker can stop it where this puts at risk the possibility of recouping its investment through normal operation of the database.
What lawful users can always do
A lawful user can extract and re-use insubstantial parts for any purpose, and any contractual clause to the contrary is void in Spain (art. 134 TRLPI). The exceptions for substantial parts are narrow: private extraction from non-electronic databases, illustration for teaching or scientific research with the source indicated, and public security or administrative and judicial proceedings (art. 135 TRLPI).
Who can claim the right, and what about Latin America?
Article 11 limits the sui generis right to makers who are nationals of a Member State or habitually resident in the EU, and to companies formed under the law of a Member State with their registered office, central administration or principal place of business in the EU. A company with only its registered office in the EU must also show operations genuinely linked to a Member State’s economy. A Mexican, Colombian or Nigerian company that builds a dataset at home does not automatically benefit, even if its customers are in Europe.
Outside the EU, the picture changes. Mexico’s Federal Copyright Law (LFDA) protects original databases as compilations (art. 107) and gives non-original databases only a right of exclusive use for five years to whoever compiled them (art. 108), according to the LFDA consolidated text (last amended 14 May 2026).
There is also a newer limit inside the EU. Article 43 of the Data Act (Regulation (EU) 2023/2854), which has applied since 12 September 2025, states that the sui generis right does not apply when data is obtained from or generated by a connected product or related service within its scope.
What this means for your business
- Map your datasets and decide for each one whether it can claim copyright, the sui generis right, both or neither.
- Document the investment as you go: staff time, licences paid for source data, collection tools, verification and cleaning processes. Keep it separate from the cost of generating the data.
- Keep version records. A substantial change, including the accumulation of successive updates, can qualify for a new 15-year term (art. 10(3)), but you need evidence of when and how much was invested.
- Check which group entity is the maker. If the investment sits in a non-EU company, consider whether an EU entity should take the initiative and the risk.
- Back the right with contracts, access terms and technical measures, and with trade secret protection where the data is not public.
If your datasets are central to a licensing deal, an investment round or an AI project, our team for copyright and database protection for digital works can review what is protected and how to evidence it.
Where companies get database protection wrong
- Counting the wrong investment. Costs of creating the data do not count; only seeking out, collecting, verifying and presenting it do.
- No paper trail. Without contemporaneous records, proving a substantial investment years later becomes very hard.
- Assuming the right travels. A non-EU maker may have no sui generis right in Europe, and a European maker may have far less in Latin America or Africa.
- Over-restrictive terms. Clauses that forbid lawful users from using insubstantial parts are void in Spain and weaken credibility in a dispute.
- Ignoring due diligence. Buyers and investors increasingly ask who owns the data and on what basis; our cross-border IP due diligence and valuation work starts precisely there.
Frequently asked questions
How long does the EU database right last?
Fifteen years from 1 January of the year after the database was completed, or, if it is made available to the public within that period, fifteen years from 1 January after it was first made available. Any substantial change, including the accumulation of successive additions or deletions that amounts to a substantial new investment, gives the resulting database its own term of protection.
Is a database protected even if it is not original?
Yes, in the EU. Copyright requires originality in the selection or arrangement, but the sui generis right only requires a substantial investment, qualitative or quantitative, in obtaining, verifying or presenting the contents. The two rights are independent, so a database with no creative structure can still be protected against extraction and re-utilisation of substantial parts.
Can a non-EU company claim the sui generis right?
Only if it meets article 11 of Directive 96/9/EC: the maker must be an EU national or resident, or a company formed under a Member State’s law with its registered office, central administration or principal place of business in the EU. Groups based in Latin America or Africa often address this by deciding which EU entity makes and owns the database.
Can IP Global Guard help protect our datasets across several countries?
Yes. We audit which rights each dataset can claim in the EU and in the Latin American and African markets where you operate, help you document the investment, draft licences and access terms, and coordinate qualified local correspondents where national steps are needed. You deal with one team for the whole portfolio.
How IP Global Guard can help you protect your data assets
IP Global Guard, the intellectual property services line of META Channel Corporation Limited, works on copyright, database rights, licensing and IP due diligence across more than 25 jurisdictions in Europe, Latin America and Africa, with one strategy and one point of contact; see our jurisdictions across the corridor. Within the same group, META Channel also advises on GDPR and the AI Act when your datasets raise regulatory questions.
Tell us which datasets matter, which entity built them and where you license them. We will set out what is protected in each market and what evidence you should start keeping. Talk to our team about your databases.
This article is general information, not legal advice, and does not replace an assessment of your specific case.
Sources
- Directive 96/9/EC on the legal protection of databases, article 7 (11 March 1996)
- Directive 96/9/EC, full text including articles 1, 3, 10 and 11 (11 March 1996)
- BOE, Royal Legislative Decree 1/1996, Consolidated Intellectual Property Law, arts. 12, 26 and 133-137 (consolidated text, last update 30 March 2022)
- CJEU, Case C-203/02, British Horseracing Board v William Hill (9 November 2004)
- CJEU, Case C-604/10, Football Dataco v Yahoo (1 March 2012)
- CJEU, Case C-762/19, CV-Online Latvia v Melons (3 June 2021)
- Regulation (EU) 2023/2854 (Data Act), articles 43 and 50 (13 December 2023)
- Chamber of Deputies of Mexico, Federal Copyright Law, arts. 107-108 (last amended 14 May 2026)
