Guidelines 1/2026 on Processing Personal Data for Scientific Research Purposes

The EDPB is consulting on updated guidelines that will clarify how GDPR provisions apply specifically to scientific research activities involving personal data processing. The consultation covers legal basis requirements, conditions for relying on consent or other grounds, and the interplay between research purposes and data subject rights. Research institutions, clinical investigators, healthcare entities conducting studies, and public health authorities will need to review the final guidelines to ensure their data processing activities comply with the updated interpretation. Organizations should consider submitting comments on any practical challenges or ambiguities they currently face in applying data protection rules to research data.

Affected parties including universities, hospitals, pharmaceutical companies, medical device manufacturers, and public health authorities conducting scientific research should monitor this consultation closely. The final guidelines will provide authoritative EDPB interpretation on key issues such as compatible use of research data, safeguards for secondary use, and the application of derogations under Article 89 GDPR. Early engagement during the consultation period allows stakeholders to shape the final guidance before it becomes the standard for assessing research data processing compliance across EU member states.