What data does the HDA handle, and what is its responsibility?

The HDA is never a data controller. The HDA can only work with metadata, open data, synthetic data, or fully anonymised data. The HDA can provide support, for example, to make the data of a data holder FAIR, but only on the explicit request of the involved data holder. It is the responsibility of the data holder and data user to have the necessary authorisations.