On 15 April, the European Data Protection Board (\u201cEDPB\u201d) adopted its Guidelines 1\/2026, on processing of personal data for scientific research purposes, which are currently open for public consultation until 25 June. The aim of this document to establish a common interpretative framework across the European Union for the application of the specific provisions of the General Data Protection Regulation (\u201cGDPR\u201d) relating to scientific research. Although not legally binding, the Guidelines will undoubtedly influence the practice of national data protection supervisory authorities and constitute an essential reference document for any entity processing personal data for research purposes.<\/p>\n\n\n\n
The concept of \u201cscientific research\u201d<\/strong><\/p>\n\n\n\n One of the main contributions of the Guidelines is that they clarify the concept of scientific research for GDPR purposes. Aware that there is no universally accepted definition, the EDPB identifies six factors which, if cumulatively met, allow an activity to be presumed to constitute scientific research: (i) a methodical and systematic approach; (ii) adherence to ethical standards; (iii) verifiability and transparency; (iv) autonomy and independence of investigators; (v) the objective of contributing to the increase of general knowledge and the well-being of society; and (vi) the potential to contribute to existing scientific knowledge or apply it in a novel way. If not all these factors are met, it must be justified and demonstrable why the activity should nevertheless be considered scientific research.<\/p>\n\n\n\n The EDPB confirms that both privately funded research and research carried out for profit are fully covered by this concept. The Guidelines also refer to so-called \u201cresearch data infrastructures\u201d (such as biobanks, repositories and other databases) and to \u201cancillary processing operations\u201d (such as categorisation or prior pseudonymisation), recognising that all of these may also fall within the specific regime applicable to scientific research.<\/p>\n\n\n\n Broad consent and dynamic consent<\/strong><\/p>\n\n\n\n The Guidelines confirm the possibility of relying on \u201cbroad consent\u201d where, at the time of data collection, it is not possible to specify the specific purposes of the research in full. The EDPB points out, however, that this mechanism does not allow the controller to circumvent the principle of purpose specification of consent. The controller must define the area of research as precisely as possible (for example, \u201cmedical research in the field of oncology\u201d) and adopt additional safeguards to compensate for the lower degree of specificity of the purposes.<\/p>\n\n\n\n Alongside broad consent, the Guidelines also address \u201cdynamic consent\u201d, which consists of obtaining the data subject\u2019s consent for each specific research project, or parts thereof, as its purposes become more specific. This approach may be suitable for long-term projects, or in cases where there is an ongoing relationship between investigators and participants. The EDPB also accepts the combination of both forms of consent.<\/p>\n\n\n\n The EDPB also provides relevant clarifications regarding the use of legal bases other than consent for the processing of personal data for research purposes. Regarding \u201clegitimate interest\u201d, under (Article 6(1)(f) of the GDPR), the EDPB accepts that this legal basis may be relied upon even where the research is conducted for commercial purposes, given the recognition of research activity as beneficial to society. In such cases, significant weight may be given in the necessary balancing test against the interests, rights and freedoms of the data subject. As regards the so-called \u201cpublic interest\u201d under Article 6(1)(e) GDPR), the EDPB clarifies that this is not reserved to public bodies; private entities may rely on it where their activities are supported by EU or Member State law.<\/p>\n\n\n\n Further processing and data retention periods<\/strong><\/p>\n\n\n\n The EDPB confirms the presumption of compatibility of further processing for scientific research purposes with the original purposes of collection, as provided for in Article 5(1)(b) of the GDPR. Consequently, the controller is not required to carry out the compatibility test under Article 6(4) of the GDPR, although the controller must continue to assess the lawfulness of the processing in accordance with an appropriate legal basis. In many cases, the controller may rely on the same legal basis as that which supported the initial processing, but this will not be possible where the original basis was consent or a legal obligation whose scope does not cover the new research purposes.<\/p>\n\n\n\n With regard to the retention periods of personal data, Article 5(1)(e) of the GDPR allows the storage of such data for longer periods when processed for scientific research purposes, even after the original purposes of the processing have been fulfilled. The EDPB clarifies, however, that such storage cannot be justified by general research purposes. The controller must specify, at least, a specific area of research, and future activities must be reasonably foreseeable, without this entailing an obligation to draw up a complete research plan.<\/p>\n\n\n\n Transparency, data subjects\u2019 rights and derogations<\/strong><\/p>\n\n\n\n The Guidelines address in detail the information obligations under Articles 13 and 14 of the GDPR towards data subjects whose data is being processed. The EDPB recommends voluntarily collecting contact details from data subjects to facilitate future communications in long-term projects, as well using mechanisms such as websites or dedicated platforms. The Guidelines expressly accept that information obligations may be fulfilled through data processors or by a joint controller where the controller lacks direct contact with the data subjects.<\/p>\n\n\n\n As regards data subjects\u2019 rights, two aspects deserve particular attention. In relation to the right to erasure, Article 17(3)(d) of the GDPR allows the controller to refuse requests only where erasure is likely to render impossible or seriously impair the achievement of the research objectives. The EDPB notes that these situations are more likely to arise where the research involves a small number of data subjects or ongoing longitudinal studies. As for the right to object, the Guidelines confirm that Article 21(6) of the GDPR allows an objection to be rejected where the processing is necessary for the performance of a task carried out in the public interest, including cases where a legitimate interest of the controller coincides with a public interest.<\/p>\n\n\n\n Controller, processor and joint controllers<\/strong><\/strong><\/p>\n\n\n\n Through particularly useful practical examples, the Guidelines address the allocation of roles as controller, processor or joint controllers in common research scenarios, particularly for commercial clinical trials, public-private collaborations and research consortium partners, among others.<\/p>\n\n\n\n The EDPB confirms that active participation in the drafting of a research protocol, clearly defining the purposes and essential elements of the means, will normally confer controller status on the participating entity, even if it does not actually process personal data. This is typically the case of the sponsor of a clinical trial. Merely funding a project or acting as a consultant, expert or member of an ethics committee is not, however, sufficient in itself to confer such status.<\/p>\n\n\n\n Appropriate safeguards<\/strong><\/p>\n\n\n\n The Guidelines note that any processing for scientific research purposes requires the adoption of appropriate safeguards under (Article 89(1) GDPR). In accordance with the principle of data minimisation, anonymised or, subsidiarily, pseudonymised data should be used whenever this allows the purposes of the processing to be achieved. The processing of directly identifiable data is only permitted where strictly necessary and proportionate.<\/p>\n\n\n\n In addition, the Guidelines provide a non-exhaustive list of other possible safeguards: independent ethical oversight, secure processing environments, use of synthetic data, confidentiality obligations, and others. Particular attention is given to the specific safeguards required where genetic data or biometric data are processed, given the particular characteristics of these categories of data.<\/p>\n\n\n\n Next steps<\/strong><\/p>\n\n\n\n The Guidelines, which are currently open for public consultation until 25 June, will provide greater legal certainty on issues that had long required clarification. Given the significance of this document, it is highly recommended that organisations active in this field review their current procedures and the supporting documentation for their studies and other research projects in light of the EDPB\u2019s interpretative criteria, especially as regards the legal bases used, consent mechanisms, and the technical and organisational safeguards adopted.<\/p>\n","protected":false},"excerpt":{"rendered":" On 15 April, the European Data Protection Board (\u201cEDPB\u201d) adopted its Guidelines 1\/2026, on processing of personal data for scientific research purposes, which are currently open for public consultation until 25 June. The aim of this document to establish a common interpretative framework across the European Union for the application of the specific provisions of… <\/p>\n