On April 15, 2026, the Euro­pean Data Pro­tec­tion Board (EDPB) adopted the Gui­de­lines 1/2026 on pro­ce­s­sing of per­so­nal data for sci­en­ti­fic rese­arch pur­po­ses for public con­sul­ta­ti­on. They are aimed at tho­se respon­si­ble in uni­ver­si­ties, hos­pi­tals, public rese­arch insti­tu­ti­ons, phar­maceu­ti­cal com­pa­nies and pri­va­te rese­arch institutes.

The gui­de­lines spe­ci­fy the rese­arch-spe­ci­fic pro­vi­si­ons of the GDPR – in par­ti­cu­lar Art. 5(1)(b) and (e), Art. 9(2)(j), Art. 14(5)(b), Art. 17(3)(d), Art. 21(6) and Art. 89 GDPR – and con­tain a cor­re­spon­ding review grid. Cer­tain topics are exclu­ded, inclu­ding the pur­po­se com­pa­ti­bi­li­ty test under Art. 6(4) GDPR out­side the rese­arch con­text, auto­ma­ted indi­vi­du­al decis­i­ons and the inter­ac­tion with sec­tor-spe­ci­fic EU and Mem­ber Sta­te law. The Euro­pean Health Data Space and the Cli­ni­cal Tri­als Regu­la­ti­on are only men­tio­ned selectively.

Rese­arch concept

Only „genui­ne“ sci­en­ti­fic rese­arch should bene­fit from the rese­arch pri­vi­le­ges of the GDPR. Accor­ding to reci­tal 159, the term should be inter­pre­ted broad­ly, but „not be stret­ched bey­ond its com­mon mea­ning“. To this end, the EDPB pro­po­ses six key fac­tors (key-indi­ca­ti­ve fac­tors), which must be exami­ned cumulatively:

  • Metho­di­cal and syste­ma­tic approach: Rese­arch plan, hypo­the­sis for­ma­ti­on or – in the case of explo­ra­to­ry rese­arch – a cle­ar­ly for­mu­la­ted objective.
  • Com­pli­ance with ethi­cal stan­dards: Sec­tor-spe­ci­fic ethics, con­sent to par­ti­ci­pa­te, trans­pa­ren­cy, accountability.
  • Veri­fia­bi­li­ty and trans­pa­ren­cy: Veri­fia­ble results, peer review, publi­ca­ti­on of results (sub­ject to justi­fi­ed rest­ric­tions such as IP protection).
  • Auto­no­my and inde­pen­dence: Rese­arch free from undue pres­su­re; aca­de­mic or sci­en­ti­fic qua­li­fi­ca­ti­on of the rese­ar­chers (PhD or pro­ven exper­ti­se). Com­mer­cial imple­men­ta­ti­on is not an obs­ta­cle to this.
  • Aims of the rese­arch: Con­tri­bu­ti­on to the gene­ral know­ledge and well-being of socie­ty; com­mer­cial inte­rests are not excluded.
  • Sci­en­ti­fic added value: Poten­ti­al to expand exi­sting know­ledge or app­ly it in new ways.

If the­se fac­tors are ful­fil­led, sci­en­ti­fic rese­arch is pre­su­med. If some are miss­ing, the per­son respon­si­ble bears the bur­den of justi­fi­ca­ti­on. Mar­ke­ting ana­ly­ses do not con­sti­tu­te rese­arch. Pro­ce­s­sing ope­ra­ti­ons in the con­text of rese­arch data infras­truc­tures (bio­banks, regi­ster data­ba­ses) as well as upstream acti­vi­ties such as cont­act data coll­ec­tion or pseud­ony­mizati­on can also fall under the rese­arch pur­po­se, pro­vi­ded that the fac­tors are mir­rored accordingly.

Ease of use and storage

Accor­ding to Art. 5(1)(b) GDPR, fur­ther pro­ce­s­sing for rese­arch pur­po­ses is dee­med to be com­pa­ti­ble with the ori­gi­nal pur­po­ses com­pa­ti­ble, which is why a pur­po­se com­pa­ti­bi­li­ty check in accordance with Art. 6(4) GDPR is not requi­red. The pur­po­se com­pa­ti­bi­li­ty replaces the Lega­li­ty check but not. The legal basis of the initi­al coll­ec­tion can often be con­tin­ued, but not if the initi­al coll­ec­tion was based on con­sent or a legal obli­ga­ti­on and the new pro­ce­s­sing exce­eds the cor­re­spon­ding scope. If per­so­nal data is pas­sed on bet­ween two con­trol­lers for rese­arch pur­po­ses, neither of the two con­trol­lers must car­ry out a com­pa­ti­bi­li­ty check, but both must ensu­re a legal basis in accordance with Art. 6(1) GDPR or an excep­ti­on in accordance with Art. 9(2) GDPR.

At the Sto­rage Accor­ding to Art. 5(1)(e) GDPR, per­so­nal data may also be retai­ned bey­ond the ful­fill­ment of the ori­gi­nal pur­po­se, pro­vi­ded that future rese­arch pro­jects are suf­fi­ci­ent­ly fore­seeable. Howe­ver, a gene­ric „for rese­arch pur­po­ses“ is not suf­fi­ci­ent; a limi­ta­ti­on to a spe­ci­fic rese­arch area is required.

Legal bases: Con­sent, public and legi­ti­ma­te interest

Broad and dyna­mic consent

Whe­re spe­ci­fic rese­arch pur­po­ses are not yet known at the time of data coll­ec­tion, „Broad Con­sent„, i.e. con­sent for a spe­ci­fic area of rese­arch. Howe­ver, this requi­res pro­tec­ti­ve mea­su­res, such as detail­ed, ongo­ing infor­ma­ti­on for the per­sons con­cer­ned, e.g. via a news­let­ter, super­vi­si­on and an ethi­cal review. „Dyna­mic con­sent“ (i.e. con­sent obtai­ned on a pro­ject-by-pro­ject or step-by-step basis) may be more sui­ta­ble, par­ti­cu­lar­ly in the case of clo­se and long-term cont­act bet­ween rese­ar­chers and data sub­jects; com­bi­na­ti­ons of broad and dyna­mic con­sent are also permissible.

The EDPB then requi­res the con­trol­ler to check befo­re each use of data in an indi­vi­du­al pro­ject whe­ther the pro­ject meets the legi­ti­ma­te expec­ta­ti­ons of tho­se affec­ted cor­re­sponds. If not, a new con­sent must be obtai­ned. This addi­tio­nal expec­ta­ti­on check is not set out in Reci­tal 33 GDPR and in fact appro­xi­ma­tes broad con­sent to dyna­mic consent.

In cli­ni­cal rese­arch, which heal­th­ca­re and rese­arch at the same time a sin­gle con­sent is suf­fi­ci­ent for lin­ked pur­po­ses. If the pur­po­ses are not lin­ked, sepa­ra­te cons­ents are requi­red. Con­sent should not be requi­red for pati­ents with sever­ely impai­red judgment.

Con­sent under the rele­vant rese­arch law does not neces­s­a­ri­ly meet the requi­re­ments of the GDPR for con­sent. Data con­trol­lers must the­r­e­fo­re docu­ment con­sent under data pro­tec­tion law sepa­ra­te­ly, ide­al­ly with cle­ar­ly distin­gu­is­ha­ble con­sent forms or areas.

Public inte­rest

A public inte­rest as a legal basis can be based on also pri­va­te rese­arch insti­tu­ti­ons if the rele­vant EU or mem­ber sta­te law covers their acti­vi­ties (see reci­tal 45 GDPR). A sta­tu­to­ry rese­arch obli­ga­ti­on is not required.

Legi­ti­ma­te interest

Sci­en­ti­fic rese­arch, inclu­ding of a com­mer­cial natu­re, may con­sti­tu­te a legi­ti­ma­te inte­rest. The Rese­arch pur­po­se gene­ral­ly has to weigh up the inte­rests of. con­sidera­ble weight. Howe­ver, resi­du­al risks to the rights of data sub­jects must be miti­ga­ted in accordance with Art. 89(1) GDPR and taken into account when balan­cing interests.

In the case of medi­cal rese­arch (e.g. cli­ni­cal stu­dies), Art. 6(1)(f) GDPR alo­ne is not suf­fi­ci­ent; an excep­ti­on under Art. 9(2) GDPR is also required.

Per­so­nal data requi­ring spe­cial protection

For spe­cial cate­go­ries of per­so­nal data, expli­cit con­sent (Art. 9(2)(a)), data mani­fest­ly made public (Art. 9(2)(e)) and natio­nal rese­arch pri­vi­le­ges (Art. 9(2)(j)) are pos­si­ble legal bases. The hurd­le for mani­fest­ly making data public is high; data in social media is only cover­ed if the data sub­ject has made the data publicly acce­s­si­ble through a clear action. This is more likely to be the case for acti­ve users (influen­cers, blog­gers) than for third-par­ty posts.

When pro­ce­s­sing spe­cial cate­go­ries on a lar­ge sca­le, a data pro­tec­tion impact assess­ment must be car­ri­ed out.

Infor­ma­ti­on requirements

In the case of long-term rese­arch, the data con­trol­ler should actively offer the data sub­jects cont­act chan­nels (e‑mail, let­ter, tele­pho­ne) and inform them, for exam­p­le, about a Pri­va­cy dash­board or a web­site keep infor­med. If the risk pro­fi­le, group of reci­pi­en­ts, reten­ti­on peri­od or legal basis chan­ge signi­fi­cant­ly, the data sub­jects must be infor­med pri­or to implementation.

If a con­trol­ler wis­hes to pro­cess per­so­nal data that was ori­gi­nal­ly for ano­ther pur­po­se coll­ec­ted are later pro­ce­s­sed for rese­arch pur­po­ses, they must inform the data sub­jects in accordance with Art. 13(3) GDPR. Anyo­ne who kno­wing­ly dele­tes cont­act data even though they plan to use it for rese­arch pur­po­ses at a later date is vio­la­ting the prin­ci­ple of transparency.

If, in the cour­se of a rese­arch pro­ject New per­so­nal data gene­ra­ted (e.g. dia­gno­ses, deri­ved pseud­onyms, clas­si­fi­ca­ti­ons), the­se are not con­side­red to be coll­ec­ted direct­ly from the data sub­ject; Art. 14 GDPR applies.

The Excep­ti­ons accor­ding to Art. 14(5) GDPR when obtai­ning per­so­nal data via third par­ties must be inter­pre­ted restrictively:

  • The excep­ti­on in the case of dis­pro­por­tio­na­te effort is rele­vant in rese­arch (out­da­ted cont­act data, lar­ge data­ba­ses over 10 years, inac­ce­s­si­ble popu­la­ti­ons). Howe­ver, tho­se respon­si­ble must then pro­vi­de indi­rect infor­ma­ti­on (web­site, dis­play in hospitals/schools, media, pati­ent organizations).
  • Covert rese­arch“ (the infor­ma­ti­on thwarts the rese­arch objec­ti­ves) should only take place if it is cle­ar­ly neces­sa­ry („strict­ly neces­sa­ry“) and only with addi­tio­nal gua­ran­tees such as an ethics review.

Rights of data sub­jects: era­su­re and objection

The excep­ti­on to the right to era­su­re under Art. 17(3)(d) GDPR only applies if the era­su­re is likely to under­mi­ne the rese­arch objec­ti­ves. make it impos­si­ble or serious­ly rest­rict would. This will rare­ly be the case for lar­ge data sets with many data sub­jects; for small cohorts or lon­gi­tu­di­nal stu­dies this is more likely. If a data sub­ject with­draws their con­sent, the data must be dele­ted in accordance with Art. 17(1)(b) GDPR, unless the­re is ano­ther legal basis for con­tin­ued storage.

In the event of an objec­tion, the con­trol­ler may con­ti­n­ue the pro­ce­s­sing if it is neces­sa­ry for a task in the public inte­rest is neces­sa­ry. The EDPB extends this to Art. 6(1)(f) if the legi­ti­ma­te inte­rest coin­ci­des with a public inte­rest. Howe­ver, the par­ti­cu­lar cir­cum­stances of the data sub­ject must be taken into account (e.g. a rare dise­a­se with a high risk of re-identification).

Tho­se respon­si­ble must also check whe­ther Mem­ber Sta­te law in accordance with Art. 89(2) GDPR rest­ricts data sub­jects’ rights for rese­arch pur­po­ses; cor­re­spon­ding devia­ti­ons must be dis­c­lo­sed to the data subjects.

Dis­tri­bu­ti­on of roles with seve­ral actors

The qua­li­fi­ca­ti­on as con­trol­ler, joint con­trol­ler or pro­ces­sor must be deter­mi­ned func­tion­al­ly and docu­men­ted on a case-by-case basis. The EDPB spe­ci­fi­es as follows:

  • Anyo­ne who par­ti­ci­pa­tes in the crea­ti­on of a rese­arch pro­to­col and deter­mi­nes the pur­po­ses and essen­ti­al means is regu­lar­ly the con­trol­ler, even if they do not pro­cess any data them­sel­ves (e.g. the Spon­sor a cli­ni­cal study).
  • Pure rese­arch fun­ding or con­sul­ting (e.g. through a Ethics Com­mit­tee) is not suf­fi­ci­ent for responsibility.
  • Pro­ces­sors are, for exam­p­le, con­tract rese­arch orga­nizati­ons (CROs), pro­vi­ded that they only act in accordance with instructions.
  • At joint respon­si­bi­li­ty the respon­si­bi­li­ties must be con­trac­tual­ly regu­la­ted and the data sub­jects must be infor­med accor­din­gly (Art. 26 GDPR). It may be the case that seve­ral con­trol­lers rely on dif­fe­rent legal bases.

Appro­pria­te safe­guards pur­su­ant to Art. 89(1) GDPR

Accor­ding to the EDPB, Art. 89(1) GDPR estab­lishes an inde­pen­dent obli­ga­ti­on in addi­ti­on to the gene­ral obli­ga­ti­ons under Art. 5, 24, 25 and 32 GDPR:

  • Anony­mizati­on befo­re pseud­ony­mizati­on: If rese­arch pur­po­ses can be achie­ved with anony­mous data, per­so­nal data must be anony­mi­zed. The anony­mizati­on pro­cess its­elf can be based on the same legal basis as the upstream operations.
  • Pseud­ony­mizati­on accor­ding to the sta­te of the art; re-iden­ti­fi­ca­ti­on risks for data set com­bi­na­ti­ons must be con­ti­nuous­ly monitored.
  • Addi­tio­nal gua­ran­tees such as secu­re pro­ce­s­sing envi­ron­ments, fede­ra­ted data­ba­ses, pri­va­cy enhan­cing tech­no­lo­gies (homo­mor­phic encryp­ti­on, syn­the­tic data), con­trac­tu­al pro­hi­bi­ti­ons on re-iden­ti­fi­ca­ti­on, ethics over­sight, codes of con­duct in accordance with Art. 40 GDPR and cer­ti­fi­ca­ti­ons in accordance with Art. 42 GDPR.
  • Spe­cial care should be taken with gene­tic and bio­me­tric data becau­se gene­tic pro­files are only anony­mous in excep­tio­nal cases, fami­ly mem­bers are also affec­ted and the risks are lifelong.