GDPR and health research: the rules researchers actually work with
Health research runs on personal data: medical records, biological samples, genomes, survey answers. In the European Union, the General Data Protection Regulation (GDPR) sets the rules for processing those data. It is often described as an obstacle to research. In fact it contains specific provisions for research, but they are spread across the text and interact with national law, which is why researchers find it confusing.
This explainer describes the general framework. It is not legal advice: research projects should involve their institution's data protection officer and, where required, an ethics committee.
Key definitions
- Personal data (Article 4(1) GDPR): any information relating to an identified or identifiable natural person.
- Data concerning health (Article 4(15)), genetic data (4(13)) and biometric data (4(14)) are "special categories" under Article 9, with stricter rules.
- Pseudonymisation (Article 4(5)): processing so that data can no longer be attributed to a person without additional information kept separately. Pseudonymised data are still personal data.
- Anonymous data fall outside the GDPR (recital 26), but only if identification is not reasonably likely by any means. With rich health and genetic data, true anonymisation is hard.
Two conditions, not one
Processing health data for research needs both:
- a legal basis under Article 6, and
- an exception to the general prohibition on processing special categories under Article 9(2).
| Article 6 legal bases often used in research | Article 9(2) exceptions often used |
|---|---|
| (a) consent | (a) explicit consent |
| (e) task carried out in the public interest (common for universities and public hospitals) | (i) public interest in the area of public health |
| (f) legitimate interests (not available to public authorities performing their tasks) | (j) scientific research purposes, on the basis of EU or national law, with safeguards under Article 89(1) |
Which combination applies depends on the institution and the member state. Article 9(4) allows member states to add conditions for genetic, biometric and health data, and many have done so, which explains much of the variation across Europe.
Consent under GDPR is not the same as research ethics consent
Informed consent to take part in a study is an ethical requirement under instruments such as the Declaration of Helsinki and, for clinical trials, the EU Clinical Trials Regulation (EU) No 536/2014. GDPR consent is a separate legal basis, which must be freely given, specific, informed and unambiguous, and can be withdrawn at any time. Because withdrawal would then require stopping processing, many public research institutions rely on public interest rather than consent as their GDPR legal basis, while still collecting ethical consent from participants.
Recital 33 acknowledges that the purposes of research are often not fully known at the time of data collection, and allows consent to "certain areas of scientific research" in keeping with recognised ethical standards. The European Data Protection Board has interpreted this "broad consent" restrictively.
The research regime of Article 89
Article 89 is the core research provision. It requires "appropriate safeguards", in particular technical and organisational measures to ensure data minimisation, and names pseudonymisation as one such measure. In exchange, the GDPR relaxes several rules for research:
- Purpose limitation: further processing for scientific research is not considered incompatible with the original purpose (Article 5(1)(b)).
- Storage limitation: data may be kept longer for research (Article 5(1)(e)).
- Information duties: where informing each person would be impossible or require disproportionate effort, exceptions may apply (Article 14(5)(b)).
- Data subject rights: EU or national law may provide derogations from rights of access, rectification, restriction and objection where they would seriously impair research (Article 89(2)). The right to erasure also has a research exception (Article 17(3)(d)).
These relaxations are conditional. Without the safeguards, they do not apply.
Practical obligations for a research project
- Data protection impact assessment (Article 35): usually required for large-scale processing of health or genetic data.
- Records of processing and clear allocation of roles: who is controller, joint controller or processor, especially in multi-centre and international consortia.
- Security (Article 32): access controls, encryption, secure research environments.
- Transparency: participant information that explains the legal basis, retention and rights in plain language.
- Data minimisation: collecting and sharing only what the research question needs.
International transfers
Global health research, including much of the work linked to the SDGs, involves partners outside the EU. Chapter V of the GDPR allows transfers to third countries only on the basis of an adequacy decision, appropriate safeguards such as standard contractual clauses, or specific derogations in Article 49. Transfers to public research partners in countries without an adequacy decision can be complex, and some international consortia have chosen federated analysis, where the analysis travels to the data rather than the data to the analysis.
How this connects to the SDGs
Data protection and the health goals pull in the same direction more often than it seems. Trust is a precondition for participation in research, and research gaps affect the very populations the SDGs aim to reach. The risks are real too: re-identification, discriminatory use of genetic information, or data from lower-income countries being used without fair benefit. Target 3.b (research and development of vaccines and medicines) and target 17.18 (high-quality, timely and disaggregated data) both depend on data that are shared and protected at the same time.
What is changing
The European Health Data Space Regulation creates a dedicated framework for the secondary use of electronic health data for research, through health data access bodies, permits and secure processing environments, applying in stages from 2029 for most data categories. It works alongside the GDPR rather than replacing it. The EU AI Act adds requirements for some AI systems used in health. The European Data Protection Board publishes guidance on research topics.
Related explainers: health data and the SDGs and the right to privacy at the UN.
Health and dataHealth data and the SDGs
What SDG 3 asks countries to measure, where the numbers come from, and why so many health systems still lack timely data.
Inclusion and rightsThe right to privacy at the UN
From Article 12 of the Universal Declaration to the Special Rapporteur: the texts and mechanisms that protect privacy.
Health and dataGenomics in public health
Sequencing for pathogen surveillance, rare disease diagnosis and newborn screening, and the equity questions WHO has raised.