The metaverse and Web3 pose new challenges for regulating the use and the protection of data. What legal system applies in virtual business spaces? How can data protection responsibilities be defined and basic rules such as data storage limits for blockchain applications be implemented? What impact will regulations such as the EU Data Act and the EU Data Governance Act have?