Guidelines 01/2026 on processing of personal data for scientific research purposes

Adopted on 15 April 2026

Executive Summary

Scientific research is an important objective in the EU treaties, which state that the Union has the objective of strengthening its scientific and technological bases by achieving a European research area in which researchers, scientific knowledge and technology circulate freely, and encouraging it to become more competitive.

Many fields of scientific research involve the processing of personal data and such processing has led to important scientific breakthroughs to the benefit of society, not least in the field of medical sciences. Several scientific breakthroughs have been made possible by the advent of new technologies, such as recent advances in artificial intelligence. These technological developments enable researchers to use and analyse data in ways that were not possible only a couple of years ago.

While the recent technological developments present many benefits and opportunities for scientific research, they have also revealed risks to fundamental rights and freedoms when processing personal data for scientific research purposes. These risks need to be managed properly to make sure that personal data are processed responsibly and with respect for personal integrity as well as the private life of individual data subjects.

The EU’s commitment to scientific research is reflected in the General Data Protection Regulation (the GDPR). By laying down specific rules and considerations for the processing of personal data for scientific research purposes, the GDPR provides for a framework that enables and facilitates the processing of personal data for scientific research, while safeguarding the fundamental rights and freedoms of data subjects.

The processing of personal data for scientific research purposes has given rise to a number of important and sometimes difficult questions from controllers, processors and supervisory authorities on how the GDPR should be interpreted and applied. To bring more clarity and guidance for researchers, the European Data Protection Board (the EDPB) decided that it was necessary to issue the present guidelines. This is also in line with the EDPB’s commitment in the Helsinki statement, where the EDPB set out to facilitate easier GDPR compliance.

The most important questions addressed in the present guidelines are listed below:

Concept of scientific research: Only research that is genuinely scientific benefits from the specific rules applying to processing of personal data for scientific research purposes in the GDPR. To help determine if the processing of personal data is carried out for scientific research within the meaning of the GDPR, the guidelines present six key-indicative factors that should be considered, in addition to the nature, scope, context and purposes of processing. If the research activities meet these six factors, they can be presumed to constitute scientific research. If the research activities do not meet all factors, the controller needs to justify and be able to demonstrate why the activities should be considered scientific research, within the meaning of the GDPR (section 2).

Presumption of compatibility: Further processing for scientific research purposes is presumed to be compatible with the initial purpose for collecting the personal data. Therefore, a controller that further processes personal data for scientific research purposes does not have to do the purpose compatibility test under the GDPR. However, the controller must still check if the processing is lawful. When doing this check, it is often possible to rely on the same legal basis that applied for the initial processing (section 3.1).

Storage limitation: controllers can store personal data for scientific research purposes for longer periods of time, even if the original purposes for processing the data have been fulfilled. For example, if the initial research results give rise to future research projects that require additional processing of personal data, it may be permitted to store the personal data for such projects (section 3.2).

consent: Where the purposes of research are not fully known at the time of collecting the personal data, it is possible for controllers to rely on the consent of a data subject to collect and process personal data in a certain area of scientific research (so-called broad consent). To rely on broad consent, the controller should process personal data in accordance with ethical standards for scientific research and put additional safeguards in place to compensate for the lack of purpose specification. controllers can also ask data subjects to consent to different individual research projects, or parts thereof, separately, as soon as the purposes of those projects become known (so-called dynamic consent). A combination of both approaches to consent is also possible (section 4.1.2).

Public interest or exercise of official authority: Relying on performance of a task carried out in the public interest, or exercise of official authority, as a legal basis is not limited to public entities conducting scientific research. Private entities may also rely on that legal basis, if the legal act in question covers their activities (section 4.2).

Legitimate interest: Scientific research can be a legitimate interest under the GDPR, regardless of whether the research is undertaken on a non-profit or commercial basis. A controller that intends to process personal data for scientific research purposes on the basis of legitimate interest can often attribute significant weight to the processing of personal data for scientific research purposes when applying the balancing test. This is because genuine scientific research is considered to be an important activity that is beneficial for the whole of society (section 4.3).

special categories of personal data: Union or Member State law can authorise the processing of special categories of personal data. The legal act must provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject. Member State law may also impose further conditions or limitations for the processing of genetic, biometric, or health data. Such laws may be relevant for controllers when processing personal data for scientific research purposes (section 4.4.3).

If no Union or MS law permits the processing of special categories of personal data for a given scientific research purpose, then controllers can instead ask for the explicit consent of data subjects. consent to processing of special categories of personal data can be broad or dynamic (section 4.4.1).

It can also be possible to process special categories of personal data that were manifestly made public by the data subject, for example on social media (section 4.4.2).

Transparency: If controllers process personal data for long periods of time for scientific research purposes, then they should adopt appropriate measures to ensure transparency during the entire processing period. controllers should also provide updates to data subjects if there are changes to the processing. The obligation to provide transparency also applies if the controller does not have access to any personal data or any contact with the data subject, for example if the processing is done by a processor. In such cases, the processor may be the one that gives information to the data subjects or replies to information requests on the controller’s behalf, if requested to do so by the controller (section 5).

Right to erasure: data subjects have a right to have their personal data erased, but the GDPR provides for exceptions from this right. There is a specific exception for situations where the processing is necessary for scientific research purposes. This exception only applies if the right to erasure is likely to render impossible or seriously impair the objective of conducting scientific research and if the controller has adopted appropriate safeguards (section 6.2.2).

Right to object: data subjects have the right to object to the processing of their personal data, but there are limitations to this right when personal data are processed for scientific research purposes. controllers may reject an objection, if the processing is necessary for the performance of a task carried out for reasons of public interest under Union or Member State law. This includes cases where a legitimate interest pursued by the controller or a third party coincides with a public interest (section 6.3).

Attribution of responsibility: Where several entities are involved in the processing of personal data for scientific research purposes, it is necessary to assess and document how responsibility is allocated among the entities. This is particularly relevant when multiple actors are involved in the drafting of a scientific research protocol or in the case of a public-private partnership. The determination of roles is important to ensure accountability and compliance of the entities involved in the processing of personal data and to determine towards which entity data subjects can exercise their data protection rights (section 7).

Appropriate safeguards: controllers must adopt appropriate safeguards for the rights and freedoms of data subjects when they process personal data for scientific research purposes. In line with the principle of data minimisation, anonymised — or alternatively pseudonymised data — should be used for scientific research, as long as the purposes of processing can be fulfilled using such data. The processing of personal data that can be used to directly identify a person is only allowed where it is strictly necessary and proportionate to achieve the purposes of the scientific research. Depending on the nature, scope, context and purposes of processing, it may be necessary to also apply other safeguards than anonymisation or pseudonymisation of personal data. Such safeguards can be independent or ethical oversight, secure processing environments, privacy enhancing technologies, protective measures for publication of research results, confidentiality arrangements, conditions for further use, etc. (section 8.3–8.5).

1 Introduction

Scientific advancement, promotion of scientific research and the establishment of a European research area are objectives laid down in the EU’s founding treaties¹. Furthermore, Article 13 of the Charter of Fundamental Rights of the European Union (the CFREU)² provides that scientific research shall be free of constraint and academic freedom shall be respected. The EU’s commitment to scientific research is also reflected in both the provisions and recitals of the General Data Protection Regulation (the GDPR), that apply when processing personal data for scientific research purposes³.
The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU⁴.
The EDPB recognises that the processing of personal data in the area of scientific research is diverse and complex, not least as there are many different actors, fields of research, types of data and categories of data subjects involved, as well as different technologies and methods used to collect and process data. Accordingly, the EDPB decided to issue these guidelines on the interpretation and application of the provisions in the GDPR that are specific to or of particular relevance when processing personal data for scientific research purposes.
The GDPR does not exhaustively harmonise the requirements for the processing of personal data for scientific research purposes. Accordingly, the EDPB underlines that there is ample room left to, and consequently a need for, complementary Union and Member State (MS) law. The application of such laws is not addressed in the current guidelines⁵.

2 The scope of the concept ‘processing of personal data for scientific research purposes’

As stated in the previous section, conducting scientific research is a fundamental freedom under EU law and the GDPR includes several provisions that apply specifically to the processing of personal data for scientific research purposes. If a controller intends to apply those provisions, then it must substantiate and be able to demonstrate that the purpose for processing personal data is to carry out scientific research⁶.
While the EDPB is aware that no universally agreed definition of scientific research exists, it is nonetheless necessary to clarify the concept of processing of personal data for scientific research purposes, in the meaning of the GDPR⁷.
Recital 159 GDPR provides that: “[for] the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research. In addition, it should take into account the Union’s objective under Article 179(1) TFEU of achieving a European Research Area. Scientific research purposes should also include studies conducted in the public interest in the area of public health.”
Furthermore, the GDPR recognises that research using personal data in registries can provide knowledge and results that can “improve the quality of life for a number of people and improve the efficiency of social services”⁸.
While the concept of scientific research should be interpreted in a broad manner, it “may not be stretched beyond its common meaning”. Therefore, the EDPB has previously stated that: “‘scientific research’ […] means a research project set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice”⁹. In other words, the concept of scientific research purposes in the GDPR covers processing of personal data in research activities that are genuinely scientific.
Other sources describing scientific research activities emphasise different elements, such as the aim to acquire new knowledge, systematic and methodical research, the role of the entities and the qualifications of persons involved in research, adherence to scientific methodology and ethical standards and dissemination of research results¹⁰. Like the GDPR, other sources underline that scientific research can be conducted by both public and private entities and that it may be conducted for profit¹¹.

2.1 Key-indicative factors for determining whether processing of personal data is motivated by scientific research purposes

While neither the GDPR nor the sources referred to above reveal a unitary or finite definition of scientific research, they present some common elements which can serve as key-indicative factors. controllers should give particular importance to these key-indicative factors, as listed below, when determining whether processing of personal data is motivated by scientific purposes or not, taking into account the nature, scope and context of processing:

i. Methodical and systematic approach

The research activities, including formulation and testing of a hypothesis¹², are conducted following a methodical and systematic approach of the relevant research field, for example in accordance with a comprehensive research plan. If the research is exploratory or in a preliminary stage, the research may have a stated objective as opposed to a hypothesis.

ii. Adherence to ethical standards

The research activities are conducted in adherence to ethical standards in the relevant research field¹³. Ethical standards are intended to prevent individuals from being subjected to harm or other adverse effects due to participating in scientific research and include — among other things — the respect for human autonomy and the concept of consent to participate in research¹⁴, transparency, accountability and oversight¹⁵.

iii. Verifiability and transparency

The research activities aim to achieve verifiable results and the conduct of research allows the hypotheses, methods, data and conclusions to be open to criticism, normally following peer review.¹⁶ The results of the research are shared with other parties, for example by publication, or will be shared in the future, with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets.

iv. Autonomy and independence

The research activities are conducted autonomously and independently in relation to the prejudices of the scientific community and other external parties, as well as the researcher’s own prejudices, in an environment free from undue pressures¹⁷. This means that the research team has the freedom to define research questions, identify methods by which problems are solved, choose and develop scientific theories, as well as the freedom to disseminate and publish the results of their research¹⁸. The researchers processing the personal data have academic (e.g. a PhD title) or scientific qualifications (e.g. proven experience or recognition) in the relevant field of research¹⁹. This applies regardless of whether the research activities are carried out by an academic institution, non-profit organisation, public institution or a for-profit organisation (such as a commercial company or a start-up). The research can also be conducted under the supervision of qualified researchers. The research team is transparent about any assumptions or values that may influence their research and the robustness of scientific evidence, including any remaining uncertainties and knowledge gaps.

v. Objectives of the research

The research activities are carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing²⁰. This does not exclude that the research may also aim to further commercial interests.

vi. Potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways

The research activities are merited, as they have the potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways²¹. The scientific merits of the research can be subject to assessment, review or approval by independent experts or committees²², for example when applying for a research grant or when applying for authorisation to market certain products that involve elements of scientific evaluation²³.

If the research activities under assessment meet all of the factors in para. 11, they can be presumed to constitute scientific research. If the research activities do not meet all factors, the controller needs to justify and be able to demonstrate why the activities should nonetheless be considered scientific research, within the meaning of the GDPR. When doing such an assessment, the more key-indicative factors are present, the more likely it is that the activities constitute scientific research within the meaning of the GDPR.

Example 1: Processing of personal data for scientific research purposes

A pharmaceutical company is developing a new pharmaceutical intended to combat a rare disease. To explore the potential side effects, the pharmaceutical company initiates a clinical trial. While the pharmaceutical is developed by a commercial company, the purpose of the clinical trial is also to further the scientific knowledge of the rare disease in question and improve the quality of life of patient suffering from the disease. To this end, the research activities carried out within the scope of the clinical trial correspond to factor v (objectives of the research).

The pharmaceutical company hires a team of academically qualified and vetted researchers to carry out the scientific research activities necessary to conduct the trial. This corresponds to factor iv (independence and autonomy).

The research team selects a number of patients suffering from the disease in question to participate in the trial as research participants. These patients’ personal data will be processed during the course of the trial. To conduct the trial, the researchers draw up a research plan, following the rules of good clinical practice (GCP) that will be reviewed by an ethical committee. In so far as the clinical trial will be conducted in accordance with the research plan, this indicates that researchers are following a methodical and systematic approach in adherence to ethical standards, corresponding to factors i and ii.

The research activities are expected to generate new scientific knowledge, and the results of the trial will be published in a scientific journal. Accordingly, the research activities correspond to factors iii (verifiability and transparency) and vi (potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways).

For these reasons, the clinical trial and the associated processing of the research participants’ personal data can be deemed to be conducted for scientific research purposes under the GDPR.

Example 2: Processing of personal data for scientific research purposes

GSPM AI GmbH is a start-up company that conducts research and development in the field of generative AI and is looking to conduct research on the topic of bias in generative AI models. To do so, GSPM AI intends to apply for funding for its research from a foundation which provides funding in various fields of technological research. The conditions for funding include that research projects must use established scientific methods, be subject to ethical review and the results of the research must be made publicly available. The choice of scientific method, formulation of hypotheses etc. is to be determined by the researchers applying for sponsorship. In so far as the intended research fulfils the conditions for funding, the research activities will correspond to factor i (methodical and systematic approach) as well as factor iv (autonomy and independence).

GSPM AI partners with a university faculty that conducts research in the field of robotics and AI and that is looking to get involved in research concerning bias in generative AI models. By doing so, the research project will include qualified researchers, in line with factor iv (autonomy and transparency).

The company and the university set up a joint research group that starts to plan for the research project, applies for sponsorship and submits to review by the university’s ethical board, which is composed of independent experts. Subjecting the research project to ethical review corresponds to factor ii (adherence to ethical standards).

The joint research group is granted sponsorship. Having successfully completed the project, GSPM AI and the university faculty publish a peer-reviewed paper, in line with factor iii (verifiability and transparency). By sharing the research results through publication, the research projects benefit the larger research community, while not excluding commercial use of the results by GSPM AI. Therefore, the research activities correspond to factor v (objectives of the research).

In sum, the processing of personal data within the scope of the research project takes place for scientific research purposes, in the meaning of the GDPR.

Example 3: Processing of personal data not considered as motivated for scientific research purposes

A retail company analyses their sales data of online customers, to get insight in the different categories of customers (target groups), what purchases they make, their frequency of website visits and how many customers are returning to their webpage on more than one occasion. The company intends to use the analysis to inform their marketing strategy.

The research does not aim to achieve verifiable results and the results are not shared with any other parties. The results of the analysis do not have any apparent potential to contribute to existing scientific knowledge or apply such knowledge in novel ways. It is also not carried out by independent and autonomous researchers, but by marketing experts within the company. The aim of the research is solely concerned with furthering the commercial interests of the company and is not carried out with the aim of contributing to the growth of society’s collective knowledge and wellbeing. Nor is the research subject to independent review.

Considering that the research does not trigger the key-indicative factors, it does not qualify as scientific research in the meaning of the GDPR and the associated processing of personal data cannot be considered to be conducted for scientific research purposes.

2.2 Research data infrastructures

personal data may be processed in a research data infrastructure²⁴ (also referred to as a research repository or database) for the purposes of making the data available for future research projects within a specific area of research²⁵. The processing of personal data within the scope of a research infrastructure may be motivated by scientific research purposes, within the meaning of the GDPR. To determine whether this is the case, a controller should assess the relevant processing operations that are necessary for operating the research infrastructure in light of the factors listed at para. 11. For example, the entity that decides on the operation of the infrastructure, or a legislator, may establish criteria that determine which research data should be collected and for which types of research projects access to the data should be granted. Access to research data will typically be limited to projects in certain fields of research. Moreover, conditions on access to data could require that researchers have fulfilled certain academic or scientific qualifications, or that researchers that request access to special categories of data should adhere to ethical standards, relevant to the concerned field of research.

Example 4: Processing of personal data for scientific research purposes in a research infrastructure

A public agency responsible for monitoring the quality of education has a statutory task to make personal data on pupils available for scientific research projects. Data can be disclosed to support the agency’s tasks, but also for research projects being undertaken by external researchers.

The law determines which types of personal data can be disclosed, namely personal data such as grades and gender. The public agency also has access to and can disclose individual diaries on the behaviour and well-being of pupils, noted down by teachers and other staff (such as school nurses) for the stated purposes. Public and private schools submit data in a pseudonymised format to the agency and the data is also stored in this format in a secure environment with access controls.

The law also provides the conditions for access of the pseudonymised data in a secure processing environment. Accordingly, a researcher can apply with an individual research project for approval to get access to the personal data stored in the database kept by the public agency. To be approved, the research project must have a sufficiently detailed research plan outlining which data is to be used and for what purposes. This fulfils factors i (methodical and systematic approach) and v (objectives of the research). Moreover, the research must be conducted by qualified researchers, in line with factor iv (autonomy and independence). In addition, the results of the research must be made available to the general public, fulfilling factor iii (verifiability and transparency).

To protect data subjects, the staff working for approved research projects must commit to confidentiality agreements and can only access the data remotely, through a secure processing environment without the possibility to download personal data from that environment. It is, however, possible to download aggregated data that does not contain any personal data. If a researcher wants to access special categories of personal data for a research project, such as data on the health or mental well-being of pupils — pursuant to Article 9(2) of the GDPR — then it also needs ethical approval, in line with factor ii (adherence to ethical standards).

Considering that the conditions for accessing the database trigger several of the factors listed above, the processing of personal data related to the management and provision of research data can be deemed to be conducted for scientific research purposes, in the meaning of the GDPR.

2.3 Ancillary processing operations

Not only processing operations undertaken within the scope of research projects or research infrastructures may be motivated by scientific research purposes, but also other processing operations that are ancillary to scientific research projects. Ancillary processing operations can be processing operations in the preparatory step of research, for example processing contact details of individuals in order to identify potential research subjects (e.g. patients, pupils, persons receiving social welfare etc.). Other potential ancillary processing operations relate to the management of the research data as such and include (but are not limited to) identification of relevant data, data extraction, filtering, grouping, curation and categorisation of personal data²⁶. Anonymisation or pseudonymisation of personal data prior to the processing of personal data in individual research projects may also be motivated by scientific research purposes²⁷.
Ancillary processing operations should have a clear scientific research objective, which must be assessed on a case-to-case basis in light of the factors listed at para. 11, in order for those processing operations to be considered motivated by scientific research purposes.

Example 5: Ancillary processing operation for scientific research purposes

A research institute intends to create a panel of respondents whose answers will reflect the opinions on current events of the general population. The purpose of creating the panel is to enable scientific research projects, that would be considered motivated by scientific research purposes under the GDPR, in a number of academic fields of social sciences, where the opinions of data subjects is a necessary data point.

The institute has access to certain geographical and population data via a registry maintained by a public body tasked by national law with statistical research and provision of aggregated as well as non-aggregated statistical data for, inter alia, scientific research. Via this registry, the research institute can enter queries to get a random representative selection of potential respondents in different geographical areas, on the basis of certain pre-established criteria (e.g. number of residents per household, income levels in the different geographical areas, types of buildings).

The research institute sends out invitation letters to the potential members of the panel, using the addresses to the households it has received from the public body. data subjects can decide to participate in the panel by answering the letter or by filling out a form on the webpage of the research institute. personal data of data subjects who do not respond will be deleted after a predetermined period of time.

To protect the personal data of panellists, the research institute provides a platform through which individual researchers can construct surveys and pose questions to the panellists, provided that their research projects fulfil certain conditions. While the identities of the panellists are known to the research institute, their personal data — in the form of answers to surveys — is pseudonymised when provided to the researchers, who also do not get any contact details to the panellists. Moreover, data subjects can at any time stop their participation in the panel, and request to have their data erased.

When access to personal data from the panellists is provided or when researchers utilise the panel and process personal data for the conduct of scientific research projects, the processing operations associated with the use of the panel can be considered to be for scientific research purposes, within the meaning of the GDPR.

Section 3 firstly addresses the distinction between the processing of personal data for scientific research purposes as the primary purpose of processing, and the further processing of personal data that was initially collected for another purpose than scientific research (or for another scientific research purpose). Secondly, section 3 addresses the presumption of purpose compatibility contained in Article 5(1)(b) of the GDPR, when further processing of personal data is carried out for scientific research purposes. Thirdly, section 3 addresses the principle of storage limitation, and how it applies when personal data is processed for scientific research purposes.

If a controller collects personal data to process it for a specific scientific research purpose, then the research purpose is considered to be the primary purpose of processing. If a controller subsequently wants to process that personal data for another scientific research purpose that is not covered by the primary purpose, such processing is considered to be further processing for another purpose. If a controller initially collects and processes personal data for non-scientific purposes, but later on decides to process the personal data for scientific research purposes, this is considered further processing for scientific research purposes.
personal data can also be collected for several purposes, amongst which one of the purposes can be scientific research. In such situations, the scientific research purpose is also considered to be a primary purpose of processing.

3.1.1 Presumption of purpose compatibility

Under (Article 5(1)(b) GDPR, further processing for scientific research purposes is presumed to be compatible with the initial purpose(s) of the processing²⁸. Therefore, when further processing personal data for scientific research purposes it is not necessary to undertake the compatibility test, pursuant to Article 6(4) GDPR²⁹. However, the compatibility test should be undertaken if the primary purpose of processing is scientific research, but the further processing of personal data is done in pursuit of another purpose than scientific research³⁰.
While (Article 5(1)(b) GDPR only refers to the purposes of processing, recital 50 also addresses the lawfulness of processing and states that: ”[…] the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no separate legal basis from that which allowed the collection of the personal data is required […] Further processing for […] scientific research purposes […] should be considered to be lawful processing operations.”
In this regard, the EDPB has previously stated that under certain conditions, and provided that appropriate safeguards have been adopted pursuant to Article 89(1) GDPR, a controller may be able to rely on the legal basis for the initial processing operations when further processing personal data for scientific research purposes³¹. However, the EDPB and the EDPS have also stated that the question of compatibility of purposes should not be confused with principle of lawfulness³². Therefore, the possibility to rely on the legal basis that the initial processing was based on requires an assessment of lawfulness to determine that this legal basis is also suitable to rely on for the further processing of personal data for scientific research purposes.
In many cases controllers will be able to rely on the same legal basis, for example where a controller initially processed personal data on the basis of public or legitimate interest³³. It is, however, not always possible to rely on the same legal basis when further processing personal data for scientific research purposes. This applies in particular if the initial legal basis for the primary processing is consent or a legal obligation³⁴.
If a controller considers that further processing for scientific research purposes could be based on Article 6(1)(f) GDPR, the significant societal interest of conducting scientific research, as also reflected by the presumed compatibility of processing for scientific research purposes, carries significant weight in the balancing test in relation to the data subjects’ interests or fundamental rights or freedoms³⁵.

Example 6: Further processing of personal data for scientific research purposes³⁶

A private research institute collects publicly accessible personal data from social media and uses this data in a scientific research project to analyse the use of a particular dialect in written language. Following a risk analysis and having implemented appropriate safeguards, the research institute determines that it can rely on a legitimate interest, pursuant to Article 6(1)(f) GDPR, to collect the data.

Having concluded the research project, the research institute wishes to further use the collected data to develop an app for use in another research project. The purpose of the app is to support individuals speaking the dialect with improving their spelling when writing in dialect, and then for the research institute to use that data to conduct research on the improvement of writing skills over time.

The research institute does not have to undertake the compatibility test, pursuant to Article 6(4) GDPR, as the further processing of the personal data gathered in the first research project is presumed to be compatible with the original purposes of processing, in line with Article 5(1)(b).

The research institute assesses the lawfulness, pursuant to Article 6(1)(f) GDPR, for the further processing of the collected personal data. When doing so, the institute considers the societal interest of the research and the presumed compatibility of the further processing in the balancing test and concludes that it can use the data to develop the app in question.

If a controller further processes special categories of personal data, pursuant to Article 9(1) GDPR, for scientific research purposes, it may also rely on the presumption of compatibility of purposes, pursuant to Article 5(1)(b). Nevertheless, the controller must still assess which derogation to the prohibition to process special categories of personal data, pursuant to Article 9(2) GDPR, that applies when further processing such data for scientific research purposes³⁷. Accordingly, if the controller intends to rely on the same derogation, pursuant to Article 9(2) GDPR, that it relied on for the initial processing operation, then the controller must assess whether that derogation is also suitable for the further processing of personal data for scientific research purposes³⁸.
When the controller further processes personal data concerning health, genetic or biometric data, it should also consider that there may be additional conditions or limitations imposed by MS law on the processing, pursuant to Article 9(4) of GDPR, also in cases of further processing for scientific research purposes.

3.1.2 Further processing when providing personal data to another controller for scientific research purposes

If a controller (controller A) wishes to, or is obliged by Union or MS law, to provide personal data to another controller (controller B), and controller B intends to process the data for its own scientific research purposes, the provision of personal data by controller A will be considered further processing if it was not one of the primary processing purposes when the personal data was collected. When providing personal data to another controller for scientific research purposes, neither the providing (controller A) nor receiving controller (controller B) needs to undertake a compatibility assessment, pursuant to Article 6(4) GDPR³⁹.

Under the principle of storage limitation⁴⁰, a controller collecting personal data for scientific research purposes must determine for how long the personal data will be processed or, if that is not possible, the criteria used to determine that period. The controller must also inform the data subjects on this matter⁴¹. Storage of personal data following the conclusion of a research project will typically be justified as long as it is necessary to retain the data in order to verify or scrutinise research results, for example within the scope of a peer review process or in accordance with scientific standards for retention. The storage period must be determined by the controller before the personal data are processed⁴². In this regard, controllers should consider and inform data subjects about possible uncertainties regarding the exact duration of the scientific research activities, for example when undertaking longitudinal research projects.
Article 5(1)(e) lit 2 GDPR permits controllers to store personal data if the data is intended to be further processed for specific scientific research purposes, even if the original purposes for processing the data have been fulfilled and regardless of whether the original purposes were scientific research or not. For example, if research results give rise to future research projects that require additional processing of personal data in future research projects, it may be permissible to store the personal data for such projects.
If it is not possible to specify the purposes of a future research project at the time of storage, specifying potential research in a certain area of research can suffice⁴³. However, in line with the principle of purpose limitation that requires the purpose of processing to be specific, storage for generic scientific research purposes without any specification of purpose cannot be justified with reference to Article 5(1)(e) GDPR. Moreover, the future scientific research activities should be reasonably foreseeable in relation to the relevant scientific field of research, taking the nature, scope, context and purposes of the envisaged processing operations into account. This means that the controller should substantiate how it intends to use the personal data in future scientific research projects, although it should not be required to draft a complete research plan.
Furthermore, controllers storing personal data for scientific research purposes must evaluate which categories of personal data are necessary to retain for presumptive future research projects, in line with the principles of purpose limitation and data minimisation, pursuant to (Article 5(1)(b) and (c) GDPR⁴⁴. When doing the necessity assessment as part of this evaluation, controllers should take due regard to elements that may give rise to risks to data subjects, such as processing of special categories of personal data, pursuant to Article 9(2) GDPR⁴⁵.
controllers storing data in accordance with Article 5(1)(e) lit 2 GDPR must also adopt appropriate safeguards, pursuant to Article 89(1) GDPR⁴⁶. In particular, when controllers store personal data for prolonged periods of time, they must regularly review the necessity of storing personal data — including in which format the data should be retained (i.e. whether the personal data should be anonymised or pseudonymised) — in light of the envisaged further processing for scientific research purposes.

Before a controller starts processing personal data, it must determine which is the appropriate lawful basis for the envisaged processing⁴⁷. The main legal bases that are relevant for the processing of personal data for scientific research purposes are consent (Article 6(1)(a)⁴⁸), legal obligation (Article 6(1)(c)), public interest (Article 6(1)(e)) and legitimate interest (Article 6(1)(f) GDPR)⁴⁹.
If a controller intends to process special categories of personal data for scientific research purposes, then it needs to determine which derogation under Article 9(2) GDPR applies⁵⁰. Similarly, if a controller processes personal data relating to criminal convictions and offences for scientific research purposes, it has to ensure that it can do so under the control of official authority or authorisation by Union or MS Law⁵¹.
In the following section, the considerations relating to lawfulness that are of particular interest when processing personal data for scientific research purposes are elaborated upon.

The EDPB’s Guidelines 5/2020 on consent under Regulation 2016/679 (hereafter Guidelines on consent) provide general guidance on the legal basis consent, pursuant to Article 6(1)(a) GDPR. The following sub-section provides additional guidance relevant to the processing of personal data for scientific research purposes when relying on Article 6(1)(a) GDPR.

controllers must consider the condition that consent must be freely given, in particular if they intend to process personal data of data subjects that are in a vulnerable or disadvantaged position, i.e. if there is a situation of imbalance in power in the relationship between the data subject and the controller⁵². In the field of scientific research this could, for example, be the case when a research project involves processing of personal data of convicted persons, pupils, unemployed or disenfranchised persons. If there are any doubts in this respect, controllers should refrain from relying on consent as a legal basis.
If personal data is processed in the field of medical research involving patients, such as clinical trials, then the controller should consider the mental or physical condition of the patient. If a patient’s capacity to provide consent is severely affected by his or her mental or physical medical condition, then the controller should refrain from relying on consent for the processing of personal data⁵³. Conversely, the fact that a data subject is a patient receiving health care does not in itself affect the data subject’s capacity to freely provide consent, in so far as the data subject is not severely affected by a mental or physical medical condition⁵⁴.
A controller can obtain a single consent for clinical research that involves the processing of personal data which are necessary both for the purposes of providing healthcare and conducting scientific research, since those purposes are interrelated. However, a controller cannot ask a data subject to consent to the processing of personal data for scientific research purposes as a condition for providing healthcare or other services, if those purposes for processing are not necessary for and interrelated with the conduct of scientific research⁵⁵. In such a case, the controller should ask data subjects to consent to the processing of personal data for scientific research purposes separately, as it may otherwise not be considered to have been freely given.

Example 7: Freely given consent

A private research institute is undertaking a study on how persons with a particular neurological disease are treated in their contact with public authorities and entities. There is no legal provision in Union or MS law that the institute can base the processing of personal data for its research on and it therefore explores whether it would be possible to rely on the explicit consent of the data subjects involved in the study, pursuant to Article 9(2)(a) GDPR. In order to ensure that data subjects with the particular neurological disease are in a position to give their consent, the institute consults with a non-profit organisation that represents patients and their relatives. The non-profit organisation gives the advice that most of the potential research subject should be in a position to give their consent but that some, given the severity of their disease, will not be able to do so. On the basis of this advice, the institute conducting the study decides to proceed on the basis of consent, but will exclude data subjects that it determines are not in a position to give free consent.

If data subjects receive any kind of reimbursement or other benefit for participating in a research project, which may be regulated by Union or MS law, then controllers must determine whether the reimbursement or other forms of incentives affect the choice made by the data subjects as to whether or not they agree to the processing of their personal data. In this regard, remuneration intended to cover the income that data subjects might lose for participating in a research project, for example because they may miss out from work, would normally not affect whether consent is freely given. Conversely, if the remuneration would constitute a significant part of the data subject’s regular income, it is more likely that it would affect whether consent was freely given or not.

4.1.2 Specificity

In the field of scientific research, it is possible for controllers to rely on the consent of a data subject to collect and process personal data in a certain area of scientific research when the purposes of research are not fully known at the time of collection of the data. This requires that certain conditions are met, most notably that additional safeguards should be adopted⁵⁶, in line with recognised ethical standards relevant to the particular field of scientific research⁵⁷. In the scientific research community, this way of obtaining consent is commonly referred to as broad consent, which is the term that will be used henceforth in the current guidelines.
Another way to obtain consent is for controllers to ask data subjects to consent to each different individual research project — or part thereof — separately, as soon as the purposes for processing personal data in those projects become known. This way of obtaining consent is commonly referred to as dynamic consent.
The determination of how to obtain consent must be made before personal data is processed. controllers should opt for a mechanism of obtaining consent that provides data subjects with sufficient specificity of the purposes of processing and a high level of data protection over time, as described in this section. The choice for the type of consent should, in line with the accountability principle⁵⁸, be appropriately documented, e.g. in a risk analysis or — where required — the data protection impact assessment (DPIA)⁵⁹. The following sub-sections describe important considerations for controllers when they determine which way of obtaining consent is appropriate when processing personal data for scientific research purposes.

A controller can obtain broad consent from data subjects when collecting and storing personal data for processing in future research projects within certain areas of scientific research. In certain cases, several controllers can rely on the same broad consent⁶⁰. This is possible when it has not yet been decided how to use the data in individual research projects at the time of collection and when the precise processing purposes are clearly determined at a later stage, for example when a research plan that details the processing of personal data is drafted or finalised.
With regard to broad consent, the EDPB has stated that the GDPR cannot be interpreted in a way that allows controllers to navigate around the key principle of specifying the purposes for which consent of the data subjects is asked⁶¹. Accordingly, controllers cannot ask data subjects to consent to the processing of their personal data without any specification of the purposes for which the data will or may be processed and it is not sufficient to only state that personal data will be used for scientific research purposes⁶². Therefore, controllers intending to process personal data for scientific research purposes on the basis of broad consent should define the purposes of future research as clearly as possible⁶³.
The delimitation of the purpose should enable controllers to determine what personal data are necessary to process⁶⁴ and make it possible for data subjects to understand what purposes of processing they are consenting to⁶⁵. The purpose for processing can be delimited to a certain field of research, for example medical research in the field of oncology, or sociological research in the field of criminology. However, the purpose can also be delimited in view of expected outcomes of the research, for example conducting genetic research to find better medical treatment methods.
When controllers obtain broad consent, they should ensure that data subjects understand the consequence of their choice that their personal data will be processed in research projects within the area of scientific research that was communicated to them. Thereafter, when the purposes of processing for individual research projects (or stages thereof) become known and before the processing is initiated, the controller should consider if the processing of personal data in those projects will be undertaken inside the boundaries of the broad consent. When doing so, controllers should evaluate if the processing of personal data correlates with the reasonable expectations of the data subjects, in line with the principle of fairness and the autonomy of data subjects⁶⁶. If possible, controllers should consult with groups representing the data subjects to get a better understanding of the data subjects’ wishes and expectations. If a controller determines that the processing of personal data in an individual research project (or part thereof) would fall outside the scope of a broad consent, then it should ask the data subjects to consent to that individual research project (or stage thereof) — i.e. rely on dynamic consent⁶⁷.
Broad consent can be relied on for the processing operations of — inter alia — collection, curation, storage and provision of data (e.g. by way of transmission or giving access through a secure processing environment), as well as subsequent processing operations in individual research projects or parts thereof, as long as the processing of personal data remains within the relevant research area and the reasonable expectations of the data subjects. For example, patients that have had their genome sequenced as part of personalised medical treatment can consent to making their personal data available for the purposes of scientific research in the field of medical genetics for multiple research projects. Broad consent can also be relied on if a research project progresses towards a direction that was not anticipated or expected at the time when the personal data was collected, as long as it remains within the relevant research area.
If a controller asks for broad consent, then it should adopt specific safeguards that give data subjects sufficient control over the use of their personal data to offset for the lack of purpose specification⁶⁸. In particular, controllers should make detailed information available to data subjects (for example on a webpage) on how their personal data are being processed, as the research progresses in individual research projects. This allows data subjects to consider whether or not they want to exercise their rights, e.g. the right to withdraw consent⁶⁹. In addition, controllers should adopt measures that enable data subjects to receive information about the processing of their personal data, for example by subscribing to a newsletter. The modality for receiving information and its regularity should be determined in line with the wishes of the data subject, as well as legal requirements or ethical considerations for communication with participants in research projects.
controllers should also assess whether they should implement safeguards to compensate for the lack of purpose specification. Safeguards may include, among others, measures for use and access controls (such as an independent data trustee)⁷⁰, time-limited validity of consent or an independent oversight body⁷¹. An oversight body may include a representative of the research participants, experts in the respective scientific research field, experts in data protection, as well as the data protection officer (DPO) (when a DPO has been designated⁷²). The oversight body may in particular be tasked to review proposed new research projects and to give an opinion on the processing of personal data for those projects. If the research activities are already covered by an existing oversight mechanism, such as an ethical review board, the controller can review whether that mechanism provides sufficient oversight of the processing of personal data as a safeguard.
Finally, controllers should assess if it may be useful to provide an effective technical tool, or other measure, that empowers data subjects in the exercise of their choice regarding consent to the processing of their personal data for individual research projects⁷³. Such a tool should not cause a digital divide, over- or underrepresentation of certain groups of individuals.

Example 8: Processing of personal data for scientific research purposes on the basis of broad consent

Various university hospitals work together in a research network in order to make personal data from the treatment of patients available for scientific research through a federated database. The envisaged storage and further processing of pseudonymised personal data will be based on broad consent from each patient, as the specific research projects and the relevant purposes are not foreseeable at the time of medical treatment when consent is obtained.

In order to meet the requirements of a comprehensive medical research infrastructure, and to include inter-disciplinary issues as well as questions of multimorbidity, the purposes covered by the given consent are not limited to any specific disease. Instead, the given consent covers a broad range of specified medical disciplines. When additional medical disciplines that are not covered by the original consent are added, data subjects are informed about this. The data subjects are also asked whether they want to consent to the processing of their personal data in research projects covered by the additional purposes.

The research network requires the adoption of mandatory safeguards for each participating hospital, including independent review of individual research projects and strict terms of use for researchers. The use of patient data for a specific research project also requires prior review and approval by an independent ethics committee. General information about the research network and the use of personal data is provided in flyers and brochures that are available in each hospital, as well as in the media and online. Furthermore, information about every future research project is published on a website and provided individually to data subjects who have subscribed to a newsletter.

The personal data are collected by the university hospitals when treating data for a period of five years. During this time period, the personal data are collected and made available for scientific research purposes, as long as the data subject does not withdraw their consent. The collected personal data can be processed for scientific research purposes for a specified period of time, that spans beyond the time period for consent. However, no new personal data collected from the treatment of the data subjects are made available for scientific research after the five-year period has expired. If a data subject visits a university hospital after the five-year period has expired, they are asked again if they want to consent to making their personal data available for scientific research purposes for five more years.

Relying on dynamic consent means that controllers initially obtain data subjects’ consent to the processing of their personal data for a research project in a certain area of research, or for specific stages of a research project that are already known at the time of collection of their personal data. For processing of personal data for purposes related to subsequent research projects that were not known at the time of collection of consent, or stages within a project that were introduced after the initial consent had been obtained, a separate consent is obtained. If a controller relied on broad consent when it collected the personal data, there are circumstances where it should rely on dynamic consent when further processing the personal data for scientific research purposes. This includes situations where the further processing of personal data for individual scientific research projects (or parts thereof) would fall outside the reasonable expectations of data subjects, or if those projects would not fall within the specific research area that a data subject has consented to.
Dynamic consent enables the controller to address changes in both the researchers’ scientific needs and the data subjects’ interests, when processing personal data for scientific research purposes over extended periods of time. To that end, dynamic consent can facilitate the conduct of long-term scientific research activities, as it allows controllers to continuously communicate with research participants, as well as manage the research. For example, if the researchers are in a close and prolonged relationship with the data subjects, as may be the case in fields of research where researchers interact with research participants on a regular basis in long-term research projects, dynamic consent is often the appropriate way of obtaining consent.

There can be ethical or legal requirements to obtain the consent of data subjects⁷⁴, expressing their willingness to participate in scientific research as research participants, as a prerequisite for carrying out certain types of research⁷⁵. An individual’s consent to participate in research pursuant to ethical or legal requirements is typically intended to ensure the protection of the right to human dignity and the right to integrity of data subjects as individuals, under Article 1 and 3 of the CFREU⁷⁶. Such consent is not required by the GDPR, but may be considered as an additional safeguard according to Article 89 GDPR⁷⁷.
It is important to underline that consent to participate in scientific research, which stems from ethical or legal requirements, should be distinguished from consent to the processing of personal data as a legal basis pursuant to the GDPR⁷⁸. This is because requirements of consent that fulfil an ethical standard or legal obligation typically goes beyond the processing of personal data and do not always fulfil the requirements of a valid consent pursuant to the GDPR, in particular explicit consent that is necessary for the processing of special categories of data, pursuant to Article 9(2)(a) of the GDPR. Therefore, if a controller that asks for consent to participate in scientific research, following ethical or legal requirements, also intends to rely on consent as legal basis for processing of personal data — pursuant to Article 6(1)(a) (and Article 9(2)(a), if applicable) of the GDPR — then the controller needs to determine and be able to demonstrate⁷⁹ whether the consent given fulfils the conditions of the GDPR to provide a valid legal basis for the processing of personal data.
A controller that asks data subjects to consent to the participation in a research project and to the processing of personal data at the same point in time must ensure that the request for consent, pursuant to the GDPR, is clearly distinguishable⁸⁰. For many research projects, it will be possible to request data subjects to consent to both the participation in the research project as such and the processing of personal in the same interface or consent form. As long as the different requests for consent are sufficiently distinguishable, it may even be preferrable to provide a common interface or consent form, as information on the processing of personal data provided to data subjects under the GDPR should be as concise as possible⁸¹. However, for research projects that involve particularly complex or sensitive processing of personal data, it may be necessary for the controller to provide a separate interface or form that only addresses consent pursuant to the GDPR⁸².

Where scientific research is recognised as a societal good that contributes to the general knowledge and the wellbeing of society, there is significant public interest in conducting scientific research activities. Accordingly, processing of personal data in the public interest, pursuant to Article 6(1)(e) GDPR, is a legal basis of particular importance for scientific research⁸³.
Pursuant to Article 6(3) GDPR, processing of personal data in the public interest or in the exercise of official authority⁸⁴ must be based on a legal basis laid down by Union or MS law to which a controller is subjected⁸⁵. In contrast to Article 6(1)(c) GDPR, Union and MS law in the scope of Article 6(1)(e) does not always determine precise obligations for a controller, but rather authorises controllers to process personal data when necessary to fulfil a task of public interest or in the exercise of official authority vested in the controller. For example, Union and MS law may authorise a controller to conduct scientific research in a certain field in the public interest, without necessarily specifying how the research is to be undertaken.
Relying on performance of a task carried out in the public interest, or exercise of official authority, as a legal basis is not limited to public entities conducting scientific research. Private entities may also rely on that legal basis, if the legal act covers their activities⁸⁶. controllers that are not authorised to process personal data on the basis of Article 6(1)(e) GDPR can instead assess whether they can rely on consent (Article 6(1)(a)⁸⁷) or legitimate interest (Article 6(1)(f) GDPR⁸⁸).
Finally, Union or MS law providing for processing of personal data pursuant to Article 6(1)(e) GDPR, and any processing of personal data reliant upon such laws, must comply with the principles of necessity and proportionality⁸⁹.

The EDPB’s Guidelines 1/2024 on legitimate interest based on Article 6(1)(f) GDPR (hereafter Guidelines on legitimate interests⁹⁰) provide general guidance on the legal basis legitimate interest. The following sub-section provides additional guidance relevant to the processing of personal data for scientific research purposes when relying on Article 6(1)(f) GDPR.
Scientific research and the accompanying processing of personal data can be a legitimate interest under Article 6(1)(f) GDPR⁹¹, regardless of whether it is undertaken on a non-profit or commercial basis⁹². Moreover, scientific research is generally attributed with special importance as an activity that is beneficial for society⁹³. Accordingly, a controller that intends to process personal data for scientific research purposes on the basis of legitimate interest can, when applying the balancing test pursuant to Article 6(1)(f) GDPR, often attribute significant weight to the processing of personal data for scientific research purposes, in relation to the data subjects’ interests or fundamental rights or freedoms.
The controller must consider the reasonable expectations of the data subject⁹⁴. In certain areas of activities, there may be a more apparent expectation of the data subjects that their personal data will be processed for scientific research purposes. The expectations of data subjects may, for example, be determined following a consultation with organisations that represent categories of data subjects⁹⁵.
Finally, when assessing if the legitimate interest for a scientific research purpose overrides the data subjects’ interests or fundamental rights or freedoms, the controller should also take the requirement to provide appropriate safeguards, pursuant to Article 89(1) of the GDPR, into account. In this regard, the controller must assess the appropriateness of such safeguards in order to avoid, reduce or mitigate the impact on the rights and freedoms of data subjects as much as possible⁹⁶. Any remaining risks of a negative impact on the rights and freedom of data subjects should then be weighed in the balancing test, in order to determine whether the risks are of such a nature or extent as to outweigh the legitimate interests of the controller or a third party⁹⁷. If a controller determines that the adopted safeguards are not sufficient to address the identified risks, then additional mitigating safeguards should be adopted and the controller should undertake the balancing test anew⁹⁸. If the controller considers that no sufficient mitigating measures can be taken, then the processing cannot be based on Article 6(1)(f) GDPR and the controller should consider whether another legal basis is applicable⁹⁹.

If special categories of personal data, pursuant to Article 9(1) GDPR, are processed for scientific research purposes, then a controller must assess which of the derogations under Article 9(2) GDPR it can rely upon to process such data¹⁰⁰. The notion of special categories of personal data covers not only data that directly reveal sensitive information about a data subject, but also personal data that can be used to collate or deduce such information, and sensitive information inferred from the data processed¹⁰¹.
The risks associated with processing of special categories of personal data must be mitigated by implementing appropriate and effective safeguards, in line with Article 89(1) GDPR¹⁰². If controllers process special categories of personal data on a large scale, they must assess and mitigate the risks associated with such processing through a DPIA¹⁰³.
MS law regulating the processing of genetic, biometric, or health data may impose further conditions, including limitations on controllers¹⁰⁴. While such Union or MS law is outside the scope of the present guidelines, those exceptions may be of particular importance for controllers when processing those categories of personal data for scientific research purposes.

Controllers may also assess if they can rely on the explicit consent of data subjects, including broad¹⁰⁵ or dynamic consent¹⁰⁶, pursuant to Article 9(2)(a) GDPR, to process special categories of personal data for scientific research purposes. The considerations outlined in section 4.1 are also relevant when a controller considers relying on Article 9(2)(a) GDPR, as a derogation from the prohibition of processing to special categories of personal data.

If a data subject has manifestly made special categories of personal data public, a controller may assess whether it can rely on Article 9(2)(e) GDPR to process that data for scientific research purposes. In this regard, the word manifestly implies that there is a high threshold for relying on the exemption, pursuant to Article 9(2)(e) GDPR¹⁰⁷.
In order to assess whether personal data has been made manifestly public, the controller needs to “ascertain whether the data subject had intended, explicitly and by a clear affirmative action, to make the personal data in question accessible to the general public”¹⁰⁸. A clear affirmative action may, for example, consist of participating in a public event that is broadcasted online¹⁰⁹.
A controller that wants to process special categories of personal data in individual posts on social media for scientific research purposes should make sure that the data was posted following an active choice by the data subject. The controller should check the settings available to users on the social media platform. The controller should also verify that users who post public content can only do so after having adjusted the necessary settings, with knowledge that their data will be made public¹¹⁰.
controllers should also consider the context in which the special categories of data are made public and by whom¹¹¹. In that respect, special categories of personal data that are actively posted by data subjects themselves (for example by an influencer or a video blogger) can indicate that the data has been manifestly made public, which would not be the case if the data was posted by a third party (e.g. a photo published by a friend or relative which reveals special categories of data)¹¹².
Finally, the EDPB reiterates that the fact that a data subject has made special categories of personal data public at a certain point in time and in a certain context, does not mean that the data subject has also made other personal data — within the same category of data — public¹¹³.

Example 9: personal data which are manifestly made public by the data subject

A private research institute for psychology is conducting a study on the impact of frequent use of social media platforms on the psychological well-being of young adults. The research team investigates the possibility of collecting personal data concerning health from data subjects’ profiles that are public on a social media platform, on the basis of legitimate interest, pursuant to Article 6(1)(f) GDPR, and the derogation for special categories of data manifestly made public, pursuant to Article 9(2)(e). To inform itself of the possibility to use the data, the research team reviews the privacy policy and the individual settings available to users on the social media platform. Following this review, the research team can determine that users’ personal data is not made public by default, but only following an active choice in the platform settings by the individual user. Therefore, the researchers determine that it is possible to process the personal data on the basis of Article 6(1)(f) GDPR, and the derogation pursuant to Article 9(2)(e). In order to enhance the privacy of data subjects whose personal data will be processed in the research project, all data collected from the social media platform is pseudonymised before it is entered into the data set. Furthermore, data subjects are informed by the research institute through the social media platform, in accordance with Article 14(1) GDPR, and given the opportunity to object to the processing of personal data.

Example 10: personal data which are manifestly made public by the data subject

Researchers at a public university undertake research in the field of political science where they are processing personal data on political opinions that have been made public on social media or other media outlets by politicians. As the political orientations are manifestly made public by the data subject on publicly accessible social media profiles and through media outlets, the derogation — pursuant to Article 9(2)(e) of the GDPR — applies to the processing of this special category of personal data.

controllers may rely on derogations to the prohibition of processing of special categories of data provided for by Union or MS law, pursuant to Article 9(2)(g), (i) and (j) of the GDPR, when processing personal data for scientific research purposes.¹¹⁴ Such laws must “respect the essence of the fundamental rights and observe the principle of proportionality”¹¹⁵. To fulfil the principle of proportionality, the laws must — inter alia — provide for suitable and specific measures, to safeguard the fundamental rights and interests of the data subject, to be adopted by the controller¹¹⁶.
A controller that intends to rely on a derogation pursuant to Article 9(2)(g), (i) or (j) GDPR should consider and be able to demonstrate that the law in question applies to the intended processing for scientific research purposes. Moreover, the controller should assess and be able to demonstrate that it has implemented suitable and specific measures required by the concerned Union or MS law. In this regard, controllers might have to adopt appropriate safeguards, pursuant to Article 89(1) GDPR¹¹⁷, in addition to measures mandated by law. This will be relevant when the processing operation in question gives rise to data protection risks that were not anticipated by the law providing an exemption under Article 9(2) GDPR. The need to adopt such safeguards will depend on the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons.
Finally, the EDPB notes that reliance on Article 6(1)(f) GDPR in the context of medical research (such as clinical trials) also requires the application of a derogation, pursuant to Article 9(2) GDPR. One example of a provision in Union law that provides for a derogation pursuant to Article 9(2) GDPR is Article 53(1)(e) in the European Health Data Space Regulation (EHDS). This provision can be relied upon for controllers intending to process health data for the purposes of conducting scientific research on the basis of Article 6(1)(f)¹¹⁸.

The EDPB’s Guidelines on transparency under Regulation 2016/679 (hereafter Guidelines on transparency¹¹⁹) provide general guidance on the obligations to inform, pursuant to Article 12-14 GDPR. The following section provides additional guidance relevant to the processing of personal data for scientific research purposes.

5.1 General

When a controller intends to or anticipates that it will process personal data for scientific research purposes over longer periods of time, then it should give data subjects an opportunity to voluntarily provide contact details. This will make it possible for data subjects to get necessary updates on the processing of their personal data. data subjects should get this opportunity, even if the purposes for processing personal data do not require the processing of contact details.
Examples of when it might be relevant to gather contact details are generational studies or when the research is based on data contained in a research infrastructure (such as a biobank or a data repository). In such cases, the data subjects should be given a choice of how to be contacted, for example by e-mail. To overcome the digital divide, data subjects should also be given an opportunity to be contacted by mail or telephone¹²⁰.
controllers should consider setting up a webpage or providing an application through which data subjects can stay informed on the processing of their personal data, if relevant using a layered approach, as detailed in the Guidelines on transparency¹²¹. If several controllers participate in the processing of personal data in scientific research activities, the setting up of webpages or applications should be co-ordinated. In this regard, it should be noted that for certain types of research, or if the research project only concerns a limited number of participants, it might not be necessary to provide a webpage or application, as the controller may have more direct ways of informing the data subjects, for example via calls, text messages, e-mail or regular mail.
controllers should also consider providing a privacy dashboard, as described in the Guidelines on transparency¹²², and in case consent is relied on as a legal basis, provide the data subject with consent receipts, i.e. a digital record on the consent statement¹²³. A privacy dashboard can also enable data subjects to exercise their rights¹²⁴, give or withdraw their consent (where applicable) in an easy and accessible manner¹²⁵, or be used to ask questions about the processing of their personal data to the controller.
Moreover, controllers should consider setting up a contact point, either digital or analogue — but preferably both — through which data subjects can pose questions, get information or exercise their data protection rights. This will allow data subjects to adequately and consciously make decisions regarding the use of their personal data. In this regard, the EDPB underlines that it follows from the general obligations of the GDPR that data subjects must have efficient ways of contacting controllers¹²⁶.

When personal data are collected directly from the data subject, then the controller must provide information on processing of personal data at the time of collection. The following sub-section provide examples on how information should best be provided to data subjects in some situations where personal data is collected for scientific research purposes.

Example 11: Information to data subjects whose personal data is directly collected from the data subject through a clinical trial

A pharmaceutical company is conducting a clinical trial for a new pharmaceutical product in co-operation with a healthcare facility. In accordance with Article 28(1)(c) of the Clinical trials regulation (CTR), the informed consent of the research participants to participate in the clinical trial is required. When the research participants sign up for the trial, they are informed during an interview and given a folder that includes a form for informed consent and information about the trial, possible side effects of the pharmaceutical product, how the research data will be processed and the objectives of the trial. The folder also contains a separate section which informs about the central elements of processing of personal data, which is clearly indicated in a table of contents in the folder. In addition, data subjects are informed about the possibility of getting more detailed information through a dedicated webpage and a contact point (with an email address and a phone number) through which data subjects can pose questions, receive information or exercise their data protection rights.

Example 12: Information to data subjects whose personal data is directly collected from the data subject through interviews

A university faculty of labour studies is conducting a study on participation when making decisions in the work place. The researchers are gathering data by phone calls or in-person interviews with data subjects who are recruited by phone from a statistically randomised cohort of research participants. The faculty adopts a layered approach when providing information. Therefore, the researchers inform the data subjects orally about the central elements of processing of personal data before the interview starts¹²⁷. The researchers also inform that more detailed information can be found on the webpage of the university, or be obtained by calling the university’s central number.

Example 13: Information to data subjects whose personal data is directly collected from the data subject through an application

A university faculty for arts and music is researching preferences and listening habits for fans of folk music. To gather research data, the researchers have created an extension application to a music platform that contains a survey. Advertisement for the research appears in the news feed of the music platform, whereby data subjects can download the extension application.

The faculty adopts a layered approach when providing information. Therefore, data subjects are provided with the information about the central elements of processing directly in the app before the download starts and their personal data is processed. The app also provides a link to the faculty’s webpage with more detailed information. Since the legal basis for processing is the consent of the research participants, data subjects are also asked to consent to the processing of their personal data, by clicking a clearly distinguished checkbox, before downloading the extension application.

The obligation to provide information pursuant to Article 13 of the GDPR applies also if the controller does not itself process or has access to any personal data, nor has any direct or indirect contact with the data subject¹²⁸. One such case is if the processing of personal data for scientific research is undertaken by a processor on behalf of the controller, or a joint controller. In such situations, the processor or the other controller may provide information to data subjects on the controller’s behalf¹²⁹. If a controller is contacted by a data subject that requests information, pursuant to Article 15 GDPR, the controller must fulfil the request for information by the data subject, for example by requesting the processor or other controller to reply to the request on their behalf.

Example 14: Provision of information when a controller does not have any contact details or direct contact with data subjects

A retail analytics company operates a nationwide loyalty card program. The company lawfully collects and stores purchase data from customers who have signed up to the program, on the basis of consent. data subjects can also consent to the use of the data for scientific research purposes.

A university business school wants to conduct scientific research on consumer purchasing behaviour. It decides on the purposes and methodology for the research, and determines what data it needs to conduct the research.

The university contracts the retail analytics company to process loyalty card data on its behalf. Even though the university does not hold or process the personal data, it is the controller under Article 4(7) GDPR.

A customer wants to know more about how their individual personal data are processed for the scientific research project conducted by the university and contacts the university’s DPO. Since the university cannot identify the data subject, the DPO informs the university which in turn instructs the retail analytics company to provide the necessary information to the DPO. Having received the information, the DPO informs the data subject about the processing of their personal data at the retail analytics company.

If a controller that collected personal data for another purpose than scientific research at a later point in time decides to further process the personal data for scientific research purposes, then the controller must inform the data subjects accordingly¹³⁰. In line with the principle of purpose limitation, this also applies if the controller intends to process the personal data for a new scientific research purpose that is different from an initial scientific research purpose¹³¹.
The controller must inform the data subjects in advance of the further processing operations. Provision of information within a sufficient period before the processing starts should allow the data subjects to consider the impact of the further processing of their personal data. Several factors should be taken into account to determine such period, such as the intrusiveness of the processing into the private life, its impact on the protection of personal data, the processing of special categories of data or other types of sensitive personal data, the reasonable expectations of the data subject, or the fact that data subjects are in a vulnerable position¹³². This also allows data subjects to exercise their rights under the GDPR, not least to withdraw their consent in case the processing operations concerns a certain area of scientific research to which the data subject has given broad consent,¹³³ or to object to the further processing¹³⁴, when applicable.
It may be challenging for controllers to inform data subjects of further processing for scientific research purposes if they have not retained the contact details of the data subjects, for example due to pseudonymisation of the personal data where identifiers or a table of correspondence are not accessible for the controller. To that end, if the controller knows at the time of collection (or when contact details are deleted because they are not necessary to process) that the personal data will be processed for scientific purposes at a later stage, then the controller should make sure that data subjects can stay informed, in accordance with Articles 12 and 13 GDPR¹³⁵.
controllers should not knowingly delete contact details if they intend to or anticipate that they will further process personal data for scientific research purposes. If a controller knowingly deletes contact details and then fails to inform data subjects directly when further processing personal data for scientific research purposes, this may lead to a breach of the principle of transparency, pursuant to Article 5(1)(a) GDPR, as well as Article 13(3).
If the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, it may not have contact details of the data subjects. If the controller has identifiers, such as a name or administrative identification number¹³⁶, it should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort¹³⁷.
If public registries or other viable means are not available, if their use would require a disproportionate effort,¹³⁸ or if a data subject is not listed in any of the available sources, then the controller should inform data subjects indirectly¹³⁹. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available, which need to be adjusted depending on the context of the research project and the data subjects involved, include:

Providing information on a website, as detailed above¹⁴⁰;
Posting information in localities where the relevant data subjects are present regularly (e.g. schools, universities, correctional facilities, medical care facilities, pharmacies, etc);
Advertising in public spaces, on the television or radio, in newspapers — in particular local media or online; and
Providing information through associations representing research subjects (e.g. patient organisations, trade unions, non-profit organisations etc).

5.4.1 General

When a controller receives personal data from another controller and intends to process it for scientific research purposes, the obligation to inform pursuant to Article 14 GDPR applies. This means that the receiving controller must make sure that the data subjects receive all mandatory information about the processing of personal data.
New personal data generated in the course of a research project will fall within the scope of Article 14 of the GDPR and are not considered as collected directly from data subjects¹⁴¹. For example, a controller may in the course of scientific research undertake data analysis which generates new personal data that is derived from the personal data provided by data subjects. This could occur where a researcher diagnoses a data subject with a psychological condition, on the basis of personal data provided by the data subject. Other situations could be where researchers generate a pseudonym or derive a data point from an identification or social security number, or add additional information about data subjects, such as their gender.
When a controller provides personal data to another controller for scientific research purposes, it is a good practice for the providing and receiving controllers to cooperate and adopt measures that enable the receiving controller to fulfil its obligations to inform. For example, the receiving controller may ask the providing controller to share the necessary information to the data subjects. An alternative can be that the initial controller may refer data subjects to information provided in accordance with Article 14 GDPR on the webpage of the receiving controller or another webpage.
If personal data is provided by intermediaries for scientific research purposes, for example where a provider of a research database collects personal data from several controllers that is thereafter provided to researchers conducting individual research projects, the EDPB considers it a good practice for all involved parties to agree on how to comply collectively with their transparency obligations¹⁴².
If a controller or processor receives pseudonymised data from another controller to be processed for scientific research, then the data subjects should be informed about how they can exercise their rights, for example by providing the pseudonym relating to their personal data¹⁴³.

Example 15: Two controllers liaising in order to fulfil their transparency obligations

A university wishes to study the mental and physical health and well-being of patients with symptoms of post-covid conditions. For this purpose, the university (being the controller for the data processing related to the research) wishes to use personal data retained by specialised health centres (being controllers for the data processing related to the provision of health care), that was originally collected for the purposes of providing health care.

In this case, the health centre must provide information to the patients, i.e. the data subjects, about the transmission of their retained personal data in pseudonymised format to the university. The university must inform the patients of the processing of their personal data for the research.

A good practice in this situation is for the university to liaise with the health centres, and provide the latter with information about their processing of personal data, where relevant with a reference to e.g. a webpage where all information can be found, that can be provided to the patients, as the health centres hold the contact details of data subjects.

Pursuant to Article 14(5) GDPR, a controller that did not collect personal data directly from the data subjects is in certain situations exempt from providing information. Circumstances relevant in the field of scientific research are detailed in the subsections below.
The exceptions in Article 14(5) GDPR must be interpreted restrictively and should not be relied on routinely¹⁴⁴.

As further explained in section 5.5, it is not necessary to inform data subjects if they already have all the relevant information on the processing of personal data. In this respect, the same considerations apply regardless of whether a controller collects the personal data directly from the data subject or not. The receiving controller should determine whether the data subject was sufficiently informed when it receives the personal data.

There will be very few situations in which a data controller can demonstrate that it is actually impossible to provide the information to data subjects¹⁴⁵. However, such situations may arise in the context of scientific research, for example when the controller, despite reasonable efforts, cannot obtain contact details of data subjects.
Even if a controller may be exempt from providing information to data subjects directly, the controller should still endeavour to provide information by other means, for example via a website or by advertising in relevant channels¹⁴⁶.

If a controller can demonstrate that it would require a disproportionate effort to inform the data subjects individually, it is exempt from doing so, pursuant to Article 14(5)(b) GDPR. In the field of scientific research, the following situations may in particular be associated with a disproportionate effort:

A high number of data subjects to inform¹⁴⁷, for example large registries with patient data, population data or data on pupils accumulated nation-wide, while many contact details are outdated due to the age of the dataset. This exemption cannot be relied on if the controller can lawfully obtain a high number of contact details easily, for example through the use public registers¹⁴⁸;
Difficulties of finding the contact details of the data subject, for example if the contact details were collected a long time ago and might no longer be accurate and there are no reasonable means available to the controller to obtain current contact details; or
The age of the personal data¹⁴⁹, e.g. if the data set is older than 10 years.

When assessing the effort involved to provide the information to data subjects against the impact and effects on the data subject if they are not provided with the information directly¹⁵⁰, the controller should consider the safeguards that it has adopted pursuant to Article 89(1) of the GDPR, as well as measures to provide information indirectly.

There are certain types of research where the provision of individual information would render impossible or seriously impair the achievement of the objectives of a scientific research project. For example, the provision of information to data subjects may introduce bias to the research or otherwise negatively affect the quality of the personal data that is collected. In such circumstances, it may be justified to carry out so-called covert research, where it is allowed to not inform data subjects individually, pursuant to Article 14(5)(b) GDPR.
It should be noted that processing of personal data for scientific research without individually informing the data subjects should only occur where it is strictly necessary, as it constitutes a serious interference with the fundamental rights and freedoms of data subjects. Accordingly, when controllers conduct covert research, they should adopt appropriate safeguards, pursuant to Article 89(1) GDPR, to counter-act that interference. Such safeguards may include ethical review or monitoring of the processing of personal data, to ensure that it is conducted with due respect to the fundamental rights and freedoms of data subjects. While the provision of individual information during the course of research may render impossible or seriously impair the achievement of the objectives of a scientific research project, controllers should nonetheless provide public information on the processing, as outlined above¹⁵¹. Alternatively, data subjects could be individually informed as soon as provision of information would no longer render impossible or seriously impair the scientific research objectives.

Example 16: Individual information which is likely to render impossible or seriously impair the achievement of a research project

Researchers at a university faculty in the field of social sciences are carrying out research on public servants, such as medical staff, teachers and police officers, who report suspected parental child abuse to social services. The reports that are examined by the researchers contain highly sensitive data, including alleged physical and sexual misconduct and assault, information about sexuality, potentially criminal actions etc. that involves children as well as parents or guardians that are alleged or suspected perpetrators.

Under Article 14(1) GDPR, the researchers would normally be obliged to inform both the children and parents or guardians of the processing of personal data. However, the provision of such information would inevitably lead to the persons being alleged of abuse to object to the processing of their personal data. This would in turn render the research impossible or at the very least seriously impair the research. Therefore, the researchers determine that they can rely on the exception provided for in Article 14(5)(b) GDPR, in order to not inform the persons whose personal data is processed for the scientific research project.

The researchers adopt safeguards to preserve the integrity of data subjects, including ethical approval, pseudonymisation of research data, storage of research data in secure storage facilities with strict data controls, as well as limited retention of research data following peer review and external scrutiny of research results.

If, pursuant to Union or MS law, a controller must obtain or disclose personal data for scientific research purposes, and that law “imposes on the controller a sufficiently comprehensive and binding obligation to provide to the data subject information relating to obtaining or disclosure of personal data”,¹⁵² then there is no separate obligation to inform the data subjects about the processing, at the condition that the information provided to data subjects is at least equivalent to that required by Articles 14(1) to (4) GDPR¹⁵³.

In the field of scientific research, the exception from providing information on processing of personal data due to obligations of secrecy might be more prevalent than in other fields of activity. This is because there may be statutory requirements that prohibit researchers from disclosing information on the processing of personal data to preserve the integrity of the research subject¹⁵⁴. Such requirements are particularly important in situations where a research subject discloses sensitive personal data about a third person, the disclosure of which could render the relationship between the research subject and the third person problematic, or even endanger the research subject¹⁵⁵.

Example 17: Confidentiality of information on processing of personal data due to statutory obligation of secrecy

A research project is carried out on domestic violence and abuse in relationships. The method for gathering data is conducting interviews with potential victims. During such interviews, personal data is gathered on data subjects who might be alleged perpetrators of domestic violence and abuse.

While the GDPR would normally require the controller to inform the data subjects who are alleged perpetrators, doing so could endanger the research participants who are being interviewed, i.e. the potential victims. For this reason, the researchers carrying out the interviews are bound by a statutory obligation of secrecy, which the research participants are informed about before the interview.

In turn, the rights and freedoms of the alleged perpetrators are also protected by mandatory safeguards provided for by the relevant law in question. These safeguards include pseudonymisation of all personal data, as well as a strict secrecy obligation that prohibits the researchers from disclosing the personal data to other parties, such as law enforcement authorities.

Another situation where a controller may be justified in not informing data subjects on the processing of their personal data is when a data subject has provided personal data for medical research and has requested, in line with national law, to not be informed about discoveries about their health or wellbeing¹⁵⁶. While this may exclude a controller from disclosing information to data subjects about their medical conditions, they must still be informed about the fact that their personal data are being processed for scientific research purposes.

If a controller makes changes to its processing operations that renders the information previously provided to data subjects obsolete or incomplete, then it must inform the data subjects about those changes, pursuant to Article 13(4) and 14(5)(a) GDPR¹⁵⁷. When determining whether it is necessary to inform data subjects about changes to processing operations, controllers should consider that a main objective of the principle of transparency is to ensure that the reasonable expectations of the data subjects are met. Conversely, there is no need to inform data subjects if they have already been sufficiently informed and if the changes would not go beyond the reasonable expectations of the data subjects¹⁵⁸.
In the field of scientific research, changes to the processing of personal data that would require additional information include:

Making substantial changes to the objectives of a research project, leading to a change of the purposes of processing of personal data;
Determining that the personal data will be processed on the basis of a different legal basis than the initial one¹⁵⁹;
Changes to the identity of the controller — for example if a research laboratory merges with another laboratory, forming a new entity;
Engaging with new research partners that are not reasonably expected by a data subject and that will receive personal data, in particular if research partners outside the EEA are engaged resulting in transfer to third countries, or international organisations¹⁶⁰;
Extending the period of processing personal data, including storage, depending on how substantial the change is and what information on the period of retention that has been communicated to the data subject;

Example 18: Extending the period of processing personal data, including storage

When the sponsor of a research project collects personal data concerning health, it informs the data subjects that their personal data will be stored for a period of 7 years after the completion of the project. The participants are also informed that if additional funding for research is made available, the storage period may be extended for another period of time to continue the project. In the information notice, it is specified that the data subjects will be notified about that extension, if the further storage will last for a significant period of time.

Before the completion of the project, participants are informed that their data will be stored for an additional period of 7 years after the end of the storage period originally envisaged.

Changes to the risk profile for the processing of personal data, for example because of changes to the scientific methods or the use of novel or untested technology;
Adding categories of personal data to the data set used in a research project, that have not been communicated to the data subject previously; and
Changes to the interface for data subjects to be able to exercise their rights, such as introducing a dedicated platform for the purpose¹⁶¹.

In line with what is stated at para. 85, information on upcoming changes should be provided to the data subjects in a timely manner before the changes are implemented, in order to enable the data subjects to exercise their rights under the GDPR¹⁶².
Conversely, changes that would normally not require any additional information to the data subjects include:

Regularly re-occurring studies that remain the same from time to time, such as annual surveys;
Inclusion of new research partners that belong to a category of recipients of personal data that has already been communicated to the data subject; and
Including processing of additional types of personal data belonging to a category of personal data that was previously communicated to the data subject.

Chapter III of the GDPR, on data subjects’ rights, includes two specific provisions that are of particular importance when controllers process personal data for scientific research purposes. These two provisions are Article 17(3)(d) GDPR that contains an exception from the right to erasure under certain circumstances, and Article 21(6) that provides for specific rules for the right to object when processing personal data for scientific research purposes. These two specific provisions, as well as other provisions on data subjects’ rights in Chapter III of the GDPR that are relevant when personal data is processed for scientific research purposes, are addressed in the following section¹⁶³.

6.1 General

While the GDPR establishes a general framework for data subjects’ rights, Union or MS law may provide for restrictions of Articles 12-22 GDPR pursuant to one of the objectives listed in Article 23(1)¹⁶⁴. Moreover, Article 89(2) of the GDPR permits derogations — In Union or MS law — from the rights in Articles 15, 16, 18, 19 and 21, subject to the conditions and safeguards referred to in Article 89(1)¹⁶⁵, in so far as the exercise of such rights are likely to render impossible or seriously impair the achievement of the specific scientific research purposes, and only if the derogations are necessary for the fulfilment of those purposes¹⁶⁶. Therefore, controllers should determine if there are any restrictions or derogations under Union or MS law that limit the exercise of data subjects’ rights and inform data subjects of such restrictions or derogations when fulfilling their transparency obligations. Conversely, if Union or MS law provide for additional rights in accordance with the GDPR, for example an unconditional right to object to processing of personal data for certain scientific research purposes¹⁶⁷, then controllers should adopt measures to be able to fulfil those extensions and inform data subjects thereof.

If a data subject requests erasure of their personal data that are being processed for scientific research purposes, the controller should first establish whether any of grounds for erasure listed in Article 17(1) GDPR apply and, subsequently, whether an exception to the right to erasure in accordance with Article 17(3) applies¹⁶⁸. The grounds for erasure for personal data that are of particular interest in the field of scientific research are delineated in the following sub-section.

Article 17(1)(a) GDPR provides that personal data shall, on request of a data subject, be erased when it is no longer necessary in relation to the purpose for which they were collected or otherwise processed. In this regard, it may be relevant to continue processing personal data for scientific research purposes after finalisation of a research project, for example if it is necessary for reproducibility of research results. It may also be necessary to retain personal data for scientific research purposes if that data is used in multiple research projects. Moreover, if a data subject had previously objected to the processing of personal data for scientific research purposes, pursuant to Article 21(6) GDPR, then the data subject can also request the controller to delete the data, pursuant to Article 17(1)(a).
Article 17(1)(b) GDPR provides that if the data subject withdraws the consent on which the processing is based, according to Article 6(1)(a) (and Article 9(2)(a) GDPR, when special categories of data are processed), then the personal data shall be erased at the request of the data subject. Unless there is another legal basis that justifies continued retention of the data, personal data must be erased following withdrawal of consent.
Pursuant to Article 17(1)(c) GDPR, data subjects have the right to have their personal data erased if they objected to the processing pursuant to Article 21(1) and no overriding legitimate grounds for the processing apply. Thus, the exercise of the right to request erasure on the basis of Article (17(1)(c) is dependent on a preceding exercise of the right to object, which is explained further below¹⁶⁹. When applying Article 17(1)(c), controllers should consider relevant guidance from the Guidelines on legitimate interest: ”[…] the criteria to determine whether an objection or an erasure request should be granted are essentially the same under Article 21 and Article 17 (i.e., the request should be granted unless one can demonstrate ‘overriding legitimate grounds’). This implies that, as a rule, if an objection under Article 21(1) GDPR is granted, a related erasure request under Article 17(1)(c) GDPR should also be granted”¹⁷⁰.
Article 17(1)(e) of the GDPR provides that personal data have to be erased for compliance with a legal obligation in Union or MS law. This ground for erasure may, for example, be relevant if Union or MS law sets up specific data retention periods for personal data that is processed for scientific research purposes.

According to Article 17(3) GDPR, a controller can reject a request for erasure if the processing of personal data is necessary for any of the grounds listed in that provision¹⁷¹. These grounds may also apply to processing of personal data for scientific research purposes¹⁷².
Necessity, in the first sub-sentence of Article 17(3) GDPR, must be interpreted restrictively. Accordingly, a controller must be able to show that the processing of the personal data involved is strictly necessary for the application of any of the exception grounds under Article 17(3) GDPR¹⁷³.
Article 17(3)(d) GDPR provides for a specific exception from the right to erasure if the processing is necessary for scientific research purposes, in accordance with Article 89(1) GDPR. In addition to assessing the strict necessity of processing of personal data in relation to the scientific research purpose, the controller must also assess the individual circumstances in each request of a data subject when applying Article 17(1)(d) GDPR. To that end, Article 17(3)(d) GDPR should only be applied in limited circumstances, as it is only when erasure is likely to render impossible or seriously impair the achievement of the scientific research purposes that it is possible for a controller to reject a request for erasure¹⁷⁴. For example, if a controller processes personal data from a large number of data subjects, requests of data subjects for erasure of their personal data may not make it impossible or seriously impair the achievement of the scientific research purposes. However, if a controller uses personal data from a small number of data subjects, where the personal data of each data subject is of significant importance for the outcome of a research project, then it is more likely that the controller is justified in relying on Article 17(3)(d) of the GDPR and reject a request for erasure. A request for erasure of personal data may also make it impossible or seriously impair the achievement of the scientific research purposes if the controller researches developments or trends over a longer period of time and the request is received while the research is still in progress.

Example 19: Rejecting a request of erasure on the basis of Article 17(3)(d) of the GDPR

A private research institute is conducting scientific research on the historical development of a software that is publicly available in an open-source format in the shape of a merkle tree, which displays the development history of the software. When searching the merkle tree, it is possible to see the names of the developers of the software at any given point in time.

The research institute receives a request from a software developer to delete an entry in which he is cited as a co-author, because the developer has changed his first name and considers that retaining his old first name for such a long time violates his right to private life. However, as the research needs to reflect the historical facts of the development of the software at any given point in time, including which individual software developers were involved, the research institute avails itself of the derogation provided for in Article 17(3)(d) of the GDPR and rejects the request, on the basis that erasure is likely to seriously impair the achievement of the objectives of the research project.

If a controller anticipates that it will apply one of the exceptions from the obligation to erase personal data upon request, pursuant to Article 17(3) GDPR, then the controller should inform data subjects when fulfilling its transparency obligations¹⁷⁵.

According to Article 21(1) GDPR, a data subject may at any time object to the processing of personal data, on grounds relating to their particular situation¹⁷⁶, insofar as the processing is based on either Articles 6(1)(e) or (f).
If a data subject exercises his or her right to object under Article 21(1) GDPR, then the controller must grant such a request, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. The EDPB underlines that it is the controller that has the burden to prove the existence of compelling legitimate grounds and balance these grounds in relation to the particular situation of the data subject¹⁷⁷.
Article 21(6) GDPR specifies the provisions of Article 21(1) for objections directed towards processing of personal data for scientific research purposes, thus limiting the right to object to processing operations based on Article 6(1)(e) or (f). Pursuant to Article 21(6) GDPR, a controller may reject a data subject’s objection to the processing of their personal data for scientific research purposes if the processing is necessary for the performance of a task carried out for reasons of public interest. Moreover, controllers should consider any specific provisions in Union or MS law that may complement the provisions of Article 21(6) GDPR.
The possibility to reject an objection, pursuant to Article 21(6) GDPR, is not limited to public interest in the meaning of Article (6)(1)(e). A controller relying on legitimate interest, pursuant to Article 6(1)(f) GDPR, can also reject an objection under Article 21(6) if the controller can demonstrate that the processing of personal data for scientific research purposes is a legitimate interest that coincides with a public interest¹⁷⁸.
Necessity must be interpreted restrictively¹⁷⁹. Accordingly, a controller must be able to show that the processing of the personal data involved is strictly necessary for performing a task carried out for reasons of public interest, entailing scientific research purposes, and that the task cannot be carried out, or not be carried out as efficiently¹⁸⁰, unless that data is processed¹⁸¹. In this regard, the context and nature of the scientific research activities and the reasons of public interest pursued will be determinative for the assessment of necessity. Similar as under the right to erasure, the number of data subjects is relevant when assessing necessity of processing¹⁸².
Moreover, the controller should verify whether the processing of personal data related to the specific objection remains necessary for the performance of a task carried out for reasons of public interest at the time when the request is made¹⁸³. In this regard, the controller should, among other things, consider the data protection principles — in particular data minimisation¹⁸⁴ — and the progress of the scientific research activities since the start of the processing operations.
If a controller determines that it is necessary to process the personal data in question for scientific research purposes, it should nonetheless consider the particular situation of the data subject who objected to the processing¹⁸⁵. To that end, data subjects should be enabled to present their particular situation, including personal, social or professional circumstances, which distinguishes them from other data subjects. Such circumstances could, for example, be suffering from a rare disease, which may render a data subject identifiable even if their data are pseudonymised, or being in a family relation with a researcher, which could enable unwarranted identification of the data subject¹⁸⁶. However, the fact that a data subject did not elaborate much on their particular situation in the objection is not sufficient for a controller to dismiss an objection per se and sometimes the particular situation may be obvious from the context of processing. If the controller has doubts as to the particular situation of a data subject, it may ask the data subject to further specify their request¹⁸⁷.

7 Attribution of responsibility (controller and processor)

The EDPB’s Guidelines 7/2020 on the concepts of controller and processor in the GDPR provide general guidance on the attribution of responsibility when processing personal data. The following section provides additional guidance and examples relevant to the processing of personal data for scientific research purposes¹⁸⁸.
The roles of controller, joint controller and processor are crucial in the application of the GDPR, since the attribution of roles determines which entity is responsible for compliance with the different provisions of the GDPR and how data subjects can exercise their rights in practice¹⁸⁹. The EDPB underlines that the determination of roles is functional and aims to allocate responsibilities according to the actual roles of the entities¹⁹⁰. Therefore, while the Guidelines provide examples and guidance to help entities determine their responsibilities under the GDPR when processing personal data for scientific research purposes, each entity must still assess and be able to demonstrate¹⁹¹ their own responsibility for the particular processing operations in which they are involved¹⁹².
Where personal data is processed for scientific research purposes involving several entities, it is necessary to assess and document how responsibility is allocated among the entities. The determination may be particularly relevant where multiple actors are involved in drafting scientific research protocols, such as sponsors, hospitals, private companies etc., or in the case of public-private partnerships (PPPs).

7.1 Controller

The controller is the entity that decides on the purpose and the essential elements of the means of the processing¹⁹³, i.e. the reasons of and the ways in which processing of personal data is carried out. However, the non-essential means of the processing, including certain practical aspects of implementation (such as the choice of the software to be used, etc.) may be left to a processor¹⁹⁴.
Where Union or MS law designates a controller, such designation is determinative for attributing responsibility¹⁹⁵. The determination of the purposes and means of processing must not be explicit in the law but can be implicit. If implicit, the determination must be sufficiently certain from the role, task and powers conferred on the controller¹⁹⁶. That condition is met if the purposes and means arise, in essence, from the provisions of the law governing the activity of the controller¹⁹⁷.
If the processing of personal data is to be undertaken in the framework of a scientific research protocol, the EDPB notes that active participation in the determination and the definition of a scientific research protocol, by clearly determining the purpose and essential elements of the means to achieve the objectives pursued, would normally qualify an entity as a controller for the processing of personal data within the meaning of the GDPR. However, the EDPB highlights that the fact that an organisation provides research funding or is consulted in the process of drafting a research protocol (e.g. as an independent consultant, expert, ethical committee etc.) is not in itself sufficient to attribute the role of a controller (or joint controller¹⁹⁸).
It is not necessary for the attribution of responsibility for an entity or an individual to actually process personal data¹⁹⁹. Therefore, an entity or an individual may be qualified as a controller even though it does not process personal data at all, only process personal data to a limited extent, or only process pseudonymised data.
One example in this regard is clinical trials, where most of the processing of directly identifiable personal data takes place at a clinical trial site, such as a health care facility. The sponsor, which mainly process pseudonymised data, is nonetheless still regarded as a controller (or a joint-controller) because it determines purposes and means of processing personal data in a clinical trial, in particular in relation to the drafting of the trial protocol.²⁰⁰ Another example is if a trusted data holder processes personal data on behalf of one (or several) controllers²⁰¹. The use of a trusted data holder may be relevant in scientific research activities as a safeguard, to ensure the security of personal data and for maintaining efficient access controls²⁰².
Typically, it is a legal person that determines the purposes and essential means of processing. When processing personal data for scientific research purposes, this could be a research institute, a hospital, a university a commercial company or a non-profit research organisation. This means that individual researchers, such as researching healthcare staff, laboratory technicians or other persons involved in scientific research are generally not considered controllers, but rather acting under the authority of a controller²⁰³. Exceptionally, there may be circumstances where researchers as natural persons are considered controllers for the processing of personal data in their own right. This may be the case when the research is carried out at a small healthcare facility or by a researcher that is conducting research in full independence with no affiliation to any research organisation.

Example 20: A controller processing personal data for scientific research purposes — Survey services

Rapid Survey is a private company that offers research and survey services. One of the services that the company offers is providing contact details to potential respondents of surveys. When Rapid Survey’s services are procured, a notification is sent out to respondents who can choose to participate or not in the survey at hand.

A private research institute is conducting a research project in the field of political sciences concerning the political views of citizens. To complete the project, it needs to gather various data points from data subjects, including their preferences in current political issues, as well as demographical data. The research institute procures the services of Rapid Survey, but wants to design the survey and manage all the contacts with the respondents. Therefore, they pay a fee to get access to contact details of Rapid Survey’s respondents, which are provided by the company.

In this situation, the private research institute and Rapid Survey are separate controllers. Rapid Survey is the controller for managing and providing the list of contact details to its respondents. When the research institute has gotten access to this list, it becomes the controller for all the subsequent processing operations.

Example 21: A controller processing personal data for scientific research purposes — Commercial entity

When data subjects sign up for membership to a large chain of fitness studios, they are asked a question whether they provide broad consent to provide their personal data (following pseudonymisation) for certain research projects in the research field of sports medicine. consenting to provision of data is not a condition for membership and data subjects can at any time withdraw their consent, either online through a membership portal, or by contacting their local fitness studio. The consent covers a certain area of research (sports medicine) and all research projects within that area. All research projects must be approved by an internal committee that has been set up by the fitness studio chain and is advised by consultants with academic qualifications. Additionally, consent must be renewed every three years.

When the fitness studio chain provides personal data from their members to individual research projects, it is acting as a controller and responsible for that provision of data, for scientific research purposes. After the personal data has been provided, however, it is the entity that requests the data and conducts the research that becomes the controller.

7.2 Processor

A processor is an entity that is separate from a controller and that processes personal data on behalf of a controller²⁰⁴. A processor may only process personal data in line with an agreement, or other legal act under EU or MS law, between the controller and the processor²⁰⁵. It may not process the personal data covered by the agreement beyond the controller’s instructions, but a processor may still have a certain margin of discretion with regards to adopting the most suitable technical and organisational means (non-essential²⁰⁶) to best serve the controller’s interests²⁰⁷. If a processor goes beyond the controller’s explicit instructions, by determining its own purposes and essential elements of the means, a GDPR infringement would occur and the processor would then be considered as a controller in respect of that processing²⁰⁸, potentially being subject to corrective measures or liability for infringing the GDPR.
In the context of processing of personal data for scientific research, different entities can act as processors, e.g. a research institution, a hospital, a software service provider, a contract research organisation (CRO) or an individual researcher (external to the controller). While several entities are often co-operatively involved in the processing of personal data for scientific research purposes, this does not necessarily mean that any of the entities involved are to be regarded as processors as they can, depending on the circumstances, instead be joint controllers²⁰⁹.

Example 23: A processor processing personal data for scientific research purposes — contract research organisation (CRO)

A specialised contract research organisation (CRO) provides different services to a sponsor of a clinical trial on a new vaccine. These services include monitoring of the study, translation of study documents, statistical analysis and maintaining the trial master file, including curation of relevant research data and deletion of unnecessary data.

The sponsor defines the purpose and the essential means of the clinical trial in the research protocol and therefore acts as controller. The CRO provides the services on the basis of a service contract and processes personal data only as instructed by the sponsor, although the CRO has certain leeway in terms of non-essential means, for example deleting obtained research data that is not necessary for performing clinical trial. As a result, the CRO processes the personal data in the capacity as a processor on behalf of the sponsor.

Example 24: A processor processing personal data for scientific research purposes — Survey services

A research team in a university faculty wants to use a service offered by Rapid Surveys, a private company that offers research and survey services. The service in question consists of recruitment of respondents to a survey for a research project. For this purpose, Rapid Surveys has recruited persons who answer surveys on regular basis, in exchange for a small fee.

The research team designs a survey for a research project and procures the services of Rapid Surveys. Rapid Surveys gives the research team advice on which questions it could pose to the respondents, but it is ultimately the research team that decides on which questions to ask and therefore which personal data that needs to be collected. Rapid Surveys uses its own software and conducts the survey with data subjects who have signed up as respondents. When the survey is completed, Rapid Surveys transmits the results of the completed survey, including pseudonymised meta-data that enables the research team to correlate the answer to different categories of data subjects (such as gender, socio-economic conditions, area of residence, etc.).

In this situation, the university faculty is a controller and Rapid Surveys is a processor. This is because even though Rapid Surveys decide on certain aspects of the processing of personal data (such as choice of it-system and offers a set of standardised technical security measures), it is ultimately the research team operating at the university faculty that decides the purposes and essential means, including which personal data are to be processed.

7.3 Joint controllers

Joint controllership occurs when two or more entities participate jointly in the determination of the purposes and essential elements of the means of processing.²¹⁰ An essential criterion for joint controllership is that the processing of personal data would not be possible without the entities’ concurrent involvement, meaning that the respective entities’ processing is inextricably linked. One way to identify converging decisions is to determine whether the processing would not be possible without both (or more) entities’ participation in the purposes and essential elements of the means of one or more processing operations, in the sense that the processing by each party is somehow inseparable²¹¹. Several entities can also be explicitly or implicitly designated as joint controllers by Union or MS law²¹².
If several parties participate jointly in the drafting of a research protocol that determines the purposes and essential means of processing of personal data, this may suffice for all the entities involved to be considered joint controllers, even if the actual research and the processing of personal data is only carried out by one or some of the entities involved²¹³. In such a context of processing, it is not necessary for all the entities involved to have an equally active participation in the determination of the purpose and essential elements of the means in order to qualify as joint controllers²¹⁴.
Agreeing to and consequently adhering to an already established research protocol or study, without participating in the determination of the purposes and means of processing, is not always sufficient to create a situation of joint controllership within the meaning of Article 26(1) GDPR. Instead, this situation may be indicative of a relationship between a controller and processor.
If several parties carrying out the research are joint controllers, they can generally rely on the same legal basis. However, the GDPR does not preclude that different joint controllers rely on different legal bases, depending on their applicability to a given processing operation²¹⁵.
The allocation of responsibilities must be laid down in an agreement between the joint controllers²¹⁶, that must be made available to data subjects²¹⁷. When multiple stakeholders involved in a research project within the scope of a common research protocol, the roles and responsibilities of the various entities should be clearly defined and clarified through an arrangement that reflect each entity’s different responsibility. In this regard, the CJEU has clarified that various entities may be involved at different stages of processing, and to different degrees, so that the level of responsibility of each entity must be assessed with regard to all the relevant circumstances of the particular case²¹⁸. If there are differing levels of responsibility, this must be reflected in the agreement, pursuant to Article 26(2) GDPR, and transparently communicated to the data subjects. In addition, even though controllers’ individual responsibilities under the GDPR may differ, data subjects retain their right to exercise their rights²¹⁹, or claim compensation for any damage caused by the processing of personal data²²⁰, towards any joint controller.
If any of the joint controllers intends to procure a processor to process personal data on their behalf, procurement should be done in line with conditions agreed upon by the joint controllers in their agreement, pursuant to Article 28(1) GDPR²²¹.

Example 25: Joint controllers processing personal data in the context of a non-interventional observational clinical study — Research consortium

A research consortium pursues a joint research project on the quality and efficacy of an oncological treatment scheme, that is the prescribed method for treating lymphoma in a Member State. The research consortium involves a commercial pharmaceutical company, several university hospitals and a private research institute.

The research consortium sets out its research activities in a research protocol which includes the setting up of a jointly-operated database and a non-interventional observational study to be conducted at the different university hospitals. The research activities also include several sub-projects to be undertaken following the conclusion of the observational study. The research protocol, which was drafted and approved jointly by all consortium partners, sets out the common purposes and methodology for the study, which research data (including personal data) that is to be collected and processed, criteria for inclusion/exclusion of research participants, permitted further use of the data for future research, etc.

The university hospitals provide staff and facilities for conducting the observational study. They also collect personal data (e.g. medical history, demographics, and health status) from the patients that participate in the research project. The research data is not gathered in a central database, but is instead made available through a database that has a unified interface to access data from several independent databases, without consolidating or transferring the data. The database is jointly operated by a steering committee with representatives from all partners to the research consortium, who are equal in terms of decision-making.

Because the observational study is conducted in accordance with the same research protocol and methodology, all parties to the research consortium should be considered as joint controllers for the processing of personal data for scientific research purposes within the scope of the study. Furthermore, because the processing of personal data in the database is decided on and operated jointly by all partners of the research consortium, and since all data retained in that database are inseparable for the purposes of conducting further research, all partners to the research consortium are joint controllers for the processing of personal data in the federated database that is necessary to make personal data available to the consortium partners for future research activities. The respective university hospitals are independent controllers for the processing of personal data that is necessary for the purpose of providing healthcare, under national law and outside the scope of the observational study.

Following the conclusion of the observational study, a number of sub-projects are initiated, using data stored in the federated database, as well as data from other sources. The sub-projects are undertaken in different constellations, involving co-operation between the different parties to research individual questions related to medical treatment of lymphoma. The partners to the research consortium are joint controllers when undertaking research in sub-projects subsequent to the conclusion of the observational study, but they are so only in their respective constellations.

After the research consortium has finalised the research to be undertaken within the scope of the research protocol, the pharmaceutical company initiates a project to develop a pharmaceutical product to treat side-effects associated with medical treatment of lymphoma. This project is undertaken unilaterally by the pharmaceutical company without the involvement of the research consortium partners. Accordingly, the pharmaceutical company is responsible for processing of personal data for this purpose as an independent controller.

In so far as any partner to the research consortium has sub-contracted any external IT service providers to process personal data on their behalf, those service providers are regarded as processors, in line with Article 28(1) GDPR, and may only be procured in line with the conditions set out in the agreement between the entities, pursuant to Article 26(1) GDPR.

Article 89(1) GDPR requires controllers to adopt of appropriate safeguards to ensure the rights and freedoms of data subjects. How controllers should apply Article 89(1) GDPR when processing personal data for scientific research purposes is explained in the current section.
Safeguards pursuant to Article 89(1) GDPR entail that technical and organisational measures are in place, in particular to ensure respect for the principle of data minimisation, when personal data is processed for scientific research purposes²²². While Article 89(1) GDPR provides that personal data should be anonymised or pseudonymised, as long as the scientific research purposes can be achieved if the data is processed in that manner²²³, that provision also requires the adoption of other types of appropriate safeguards, adapted to the specific scientific research purposes for which personal data are processed. This applies irrespective of the legal basis that the processing of personal data is based upon. Moreover, if personal data is further processed for scientific research purposes, controllers should assess whether the safeguards applied to the initial processing are adequate for the further processing.

8.1 General

Safeguards adopted under Article 89(1) GDPR must be assessed in relation to the nature, scope, context, purposes and risks of the scientific research activities. The safeguards should contribute to the fulfilment of the data protection principles, the requirements of data protection by design and default, as well as ensure that the rights and freedoms of data subjects are guaranteed. While it is the responsibility of the controller to determine and implement appropriate safeguards, Union or MS law may provide for specific safeguards to be adopted by controllers, when processing personal data for scientific research purposes²²⁴.
Apart from the adoption of safeguards pursuant to Article 89(1) GDPR, controllers processing personal data for scientific research purposes must always adopt the general safeguards and measures required by the GDPR to minimise any negative impact of processing, in line with — inter alia — Articles 5, 24, 25 and 32 of the GDPR. Such measures include, amongst others:

assessing the risks of the processing or carrying out a data protection impact assessment (DPIA) when required²²⁵;
appointing a data protection officer (DPO) when required;
implementing technical and organisational measures for data security, including the establishment of procedures and policies to regularly assess the effectiveness of those measures; and
defining the distribution of tasks in the processing of personal data between organisational units and employees, etc.

General measures and safeguards adopted by the controller may, depending on how they are designed and implemented, in some cases overlap with and satisfy both the provisions mentioned in para. 149 and Article 89(1) GDPR. For example, access controls that limit access to personal data used in scientific research to researching staff only, may satisfy the requirements under both Articles 32 and 89(1) of the GDPR.

8.2 Risk analysis and data protection impact assessment (DPIA)

The starting point for adopting appropriate safeguards, pursuant to Article 89(1) GDPR, is conducting a risk analysis or — when required — a DPIA²²⁶. When assessing risks to rights and freedoms of data subjects and determining appropriate safeguards, it is important that controllers look beyond the scope of the right to private life and protection of personal data²²⁷. Risks to other fundamental rights and freedoms should also be considered²²⁸. In particular in the field of medical research, if the processing of personal data for scientific research purposes impacts or may impact the provision of health care to a data subject (e.g. if a medical condition is identified), controllers should consider implementing measures for informing data subjects, taking into account the wishes of data subjects not to be informed about findings that are relevant for their health, in accordance with applicable Union or MS law²²⁹.
When identifying data protection risks, controllers should in particular pay attention to the amount of personal data processed, the type of personal data²³⁰, whether the collected personal data is combined with other data sets, if the personal data will be retained following a research project, potential risks of re-identification of data subjects — including when providing data to research partners or other recipients — risks associated with publishing or sharing research results, as well as the controller’s relationship with the data subjects, in particular if the data subject is in a disadvantaged position in relation to the controller.
Potential consequences of the scientific research, such as adverse outcomes for the data subjects, should also be considered. If possible, the controller should consider the impact on individual data subjects, in particular individuals belonging to vulnerable or disenfranchised categories or groups of data subjects. The controller should also consider if the processing of personal data may affect persons related to the data subject, such as family members or friends. Adverse outcomes could be exclusion or discrimination against individuals, defamation, stigmatisation, loss of confidentiality of personal data or damage to reputation²³¹.

8.3 Anonymisation and pseudonymisation of personal data

A basic data protection principle of the GDPR is data minimisation, pursuant to Article 5(1)(c) GDPR. According to the principle of data minimisation, personal data shall be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”. Thus, when processing personal data for scientific research purposes, controllers must determine which data are strictly necessary to process²³².
Data minimisation is emphasised in Article 89(1) GDPR, which states that where the scientific research purposes ”[…] can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.” Article 89(1) GDPR also states that the technical or organisational measures to be adopted for data minimisation ”[…] may include pseudonymisation provided that those purposes can be fulfilled in that manner.”
Consequently, personal data processed for scientific research should in the first place be anonymised, as long as the purposes of processing can be fulfilled using anonymised data. Information that is considered anonymised data, within the meaning of the GDPR, is information that does not (or no longer) relate to an identified or identifiable natural person or is rendered anonymous in such a manner that the data subject is not or no longer identifiable²³³, which brings any subsequent processing of the data outside the scope of the GDPR. The anonymisation process itself, however, is a processing operation under the GDPR that must comply with the provisions of the GDPR, including the data protection principles and the requirements of lawfulness. With regards to lawfulness, a controller may be able to rely on the same legal basis for the process of anonymisation and for the preceding processing operations, if those processing operations form part of a set of operations that are undertaken for the same scientific research purposes²³⁴.
Where the scientific research purposes cannot be fulfilled using anonymised data, for example because controllers aim to analyse developments related to an individual over time, requiring the need for an identifier, or where anonymisation is not achievable, the personal data should instead be pseudonymised²³⁵.
pseudonymisation²³⁶ is a technical and organisational measure that allows controllers and processors to reduce the risks to data subjects and meet their data protection obligations, for example under Articles 25, 32 and 89 of the GDPR. If a controller processes personal data for scientific research purposes and applies pseudonymisation, then the legal basis for the processing of the personal data extends to all processing operations needed to apply the pseudonymising transformation²³⁷.
The processing of personal data for scientific research purposes that can be used to directly identify a person should only be done where it has been deemed strictly necessary and proportionate in order to achieve the purposes of the scientific research. Thus, the controller should always opt for using anonymised data or pseudonymised personal data if the purpose of the scientific research does not require the use of personal data that can be used to directly identify data subjects.
Consideration of which format of data is necessary and justifiable to process for scientific research purposes should take place when a controller draws up a plan for the processing of personal data, for example when a database is set up or when a research plan is drafted. The assessment should be undertaken as part of a risk analysis or, where relevant, a DPIA.
To ensure the proper effectiveness of anonymisation or pseudonymisation, controllers must use state-of-the-art anonymisation or pseudonymisation methods, taking into account the most current assessment of effectiveness, risks of re-identification, threats to security, etc. The EDPB’s guidelines on pseudonymisation provide further guidance on how to assess effectiveness²³⁸. There should also be an ongoing process of verification that the measures implemented to ensure anonymisation or pseudonymisation are effective over the course of a research project, or as long as the data is otherwise retained, in particular if data sets are combined, which may increase the risk for re-identification.
Processing operations for scientific research purposes may entail processing of personal data in different formats. For example, if the research activities of a controller receiving data from another controller do not require processing of personal data that can be used to directly or indirectly identify data subjects, the personal data must be anonymised before transmission. At the same time, the controller providing the anonymised data may itself retain the personal data in a pseudonymised or directly identifiable form if there are purposes that justify such processing, such as reproducibility of research results or review of research data.
Legal or contractual obligations that prohibit the re-identification of individuals can, as organisational measures, complement technical anonymisation or pseudonymisation, in particular when data sets are shared between research partners or other recipients. Contractual obligations should also facilitate requests from data subjects exercising their rights in relation to pseudonymised personal data²³⁹. Therefore, contractual obligations should ensure that — following a request from a data subject that exercises his or her rights — the controller that pseudonymised the personal data can provide the information that is necessary to re-identify a data subject to controllers or processors that process the pseudonymised data for scientific research purposes.²⁴⁰ Alternatively, contractual obligations could ensure that the original controller enables the practical exercise of data subjects’ rights.
Finally, data subjects should be informed about the extent to which their personal data is processed for research purposes in a form that permits identification and, if personal data is made available to other recipients, to whom. In particular, data subjects should not be given the impression that their personal data will be anonymised if the data in fact will be processed in a pseudonymised form and the data subjects will still be identifiable, albeit indirectly. Moreover, data subjects should — prior to the processing — be informed that it will not be possible to retrieve their personal data from an aggregated dataset or as part of the research results after the anonymisation of the personal data. Hence, after anonymisation, data subjects will not receive any further individual information on the processing of their data, such as for instance results of clinical examinations, as it will no longer constitute personal data. This is without prejudice to the possibility for data subjects to receive general and aggregated information on the development of research projects or their results.

8.4 Safeguards when processing genetic or biometric data

Genetic data is personal data retrieved from analysis of biological samples of human origin that is related to the inherited or acquired genetic characteristics of an individual, such as a complete genome sequence or certain genetic markers that are unique to an individual²⁴¹. Genetic data profiles are considered to be personal data by default and can only be considered anonymous in exceptional circumstances, following a thorough analysis that takes the specific genetic configuration, and how common it is in the population, into account²⁴².
Biometric data²⁴³ is, similarly to genetic data, unique to individuals²⁴⁴ and can — inter alia and depending on the type of data — reveal family relationships.
Particular caution must be exercised in any research project where genetic or biometric data are processed. This is due to the specific nature and risks with such processing operations, not only for data subjects that participate in scientific research, but also other data subjects who are related to the research participant. For example, genetic data can be used to obtain information about health predispositions, health risks and inherited diseases, as well as consanguineal kinship. The fact that genetic data cannot be changed by data subjects, but remains with them for the rest of their lives and beyond increases the risks. Such risks may also be present when processing biometric data, depending on the type of data concerned (e.g. fingerprints).
Appropriate safeguards that may be particularly important when processing genetic or biometric data include, but are not limited to, pseudonymisation, ethical approval, particularly restrictive purpose limitations, federated storage with access through secure processing environments, as well as rigid and role-based access controls.
Genetic research on isolated population groups should be accompanied by information campaigns directed towards the community involved. Such information campaigns should, in addition to the mandatory information pursuant to Articles 12-14 GDPR, describe the nature and methods of the research, the objectives pursued and the expected risks or benefits for the population groups involved. Any risks of discrimination or stigmatisation of members of the population group involved, as well as risks of unexpected findings, should be clearly and transparently communicated and mitigated²⁴⁵.

8.5 Determination of other types of appropriate safeguards

As Article 89(1) of the GDPR covers a wide variety of processing operations that are motivated by scientific research purposes using different methods and technology, it is necessary to adopt different types of safeguards for different types of processing operations. This is due to the different risks posed by the nature of research or research methods used. Accordingly, when processing personal data for scientific research purposes, it may be necessary to adopt other types of safeguards beyond anonymisation or pseudonymisation. Examples of such safeguards are:

Governance structures for oversight of the processing of personal data, such as internal or external review boards or other oversight committees, including representation by data subjects, when applicable;
Enhanced transparency, beyond the requirements of Articles 12-14 GDPR, towards data subjects about the use of their personal data, e.g. by providing information via an online platform, through which participants can be informed about ongoing and future research projects, their nature and methods, as well as provision of information on the outcome of research projects that have used personal data²⁴⁶;
consent, if not relied upon as a legal basis, as a safeguard²⁴⁷;
Strict purpose-limitation, for example contractually limiting any further processing of personal data by a receiving controller;
An unconditional right to object to the processing of personal data;
Providing guarantees to data subjects, e.g. contractually or by unilateral commitments, that the research results will not be used to directly or indirectly influence or affect the research participants²⁴⁸;
Adherence to ethical rules in the relevant field of science, including ethical approval, when applicable, or advice or oversight by ethics committees or boards;
Procedures for review of personal data that is continuously stored for scientific research purposes in order to determine the necessity of continued storage and in which format it is appropriate to store the personal data (i.e. whether it remains necessary to store the personal data in a pseudonymised or directly identifiable format);
Privacy enhancing technologies (PETs), such as homomorphic encryption or use of synthetic data;
Adherence to relevant standards or professional conduct in the relevant field of science;
Setting up a secure processing environment²⁴⁹ or an access point through which researchers can gain access to research data without any need for local storage;
Rules and measures when providing personal data to other researchers, including contractual arrangements to prevent unauthorised transmissions to third parties, or use of federated databases;
Managing pseudonymisation and creating barriers between contact data or other identifiers of research participants and research data, for example through internal organisational firewalls or by entrusting pseudonymisation to a trusted third party;
Complementary measures to prevent re-identification of data subjects, such as statutory, administrative or contractual penalties for unauthorised attempts of re-identification;
Qualification requirements for researchers, as well as proper training in data protection for persons authorised to process the research data;
Measures to protect personal data, such as anonymisation of personal data, when publishing or disseminating research results; and
Confidentiality obligations for researchers and other staff members with access to the personal data (e.g. IT staff).

Codes of conduct²⁵⁰ and certification²⁵¹ can be useful tools that provide more concrete guidance on how to identify risks and adopt mitigating measures, tailored to the specifics of a particular field or type of scientific research and the application of the specific provisions for scientific research in the GDPR. Accordingly, controllers or processors may adopt particular safeguards, and measures to manage them, when adhering to a relevant code of conduct or in the process of certification.

For the European Data Protection Board The Chair Anu Talus

Footnotes

References to ‘Member States’ (MS) made throughout this document should be understood as references to ‘European Economic Area (EEA) Member States’. Cf. Article 2(3) Consolidated version of the Treaty on European Union (TEU) (OJ C 326, 26.10.2012, p. 13); Article 179 Consolidated version of the Treaty on the Functioning of the European Union (TFEU) (OJ C 326, 26.10.2012, p. 47). ↩
Charter of Fundamental Rights of the European Union (CFREU) (OJ C 326, 26.10.2012, p. 391). ↩
Recitals 33, 50, 52, 53, 62, 65, 113, 156, 157, 159, 160, 161 and 162 and Articles 5(1)(b) and (e), Article 9(2)(j) and (4), 14(5)(b), 17(3), 21(6) and 89 GDPR. ↩
Recital 4 GDPR; Recital 32 in Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus) (COM(2025) 837 final). ↩
In so far as Union or MS laws provide for legal bases for the processing of personal data for scientific research purposes, under Article 6(1)(e) GDPR, see further in section 4.2. On derogations under Article 9(2)(g), (i) or (j) GDPR, see further in section 4.4.3. ↩
In accordance with the principle of accountability, pursuant to Articles 5(2) and 24(1) GDPR. ↩
The EDPB underlines that the term scientific research purposes in the GDPR should be given an autonomous and uniform interpretation in EU law. Cf.: Judgement of 6 February 2003, Stichting ter Exploitatie van Naburige Rechten (SENA) v Nederlandse Omroep Stichting (NOS), C-245/00, EU:C:2002:543, para. 23. ↩
Recital 157 GDPR. Such registries can for example be data sets with patient records, in the field of medical research, or databases with information about welfare payments in the field of social sciences. ↩
EDPB Guidelines 05/2020 on consent under Regulation 2016/679 (Guidelines on consent) (Version 1.1, 04.05.2020) para. 153. ↩
See, inter alia: Recital 25 of Regulation (EU) 2024/1689 (Artificial Intelligence Act); Annex I of Regulation (EU) 2021/821; Article 2(1) of Directive (EU) 2019/790; Article 3(1)(b) Digital Omnibus; ALLEA, The European Code of Conduct for Research Integrity (ECCRI) (Revised Edition 2023); UN Special Rapporteur on the Right to Privacy, Recommendation on the protection and use of health-related data (05.12.2019) p. 7-8; Frascati Manual 2015 paras. 2.26, 2.6 and 2.7; Explanatory Report to Protocol CETS No. 223 para. 50; Council Recommendation of 18 December 2023 (OJ C, C/2023/1640) paras. 1-2. ↩
UN Recommendation on the protection and use of health-related data, p. 9; OJ C, C/2023/1640, para. 2; Preamble to ECCRI, page 4. ↩
ECCRI, p. 2.2; Frascati Manual 2015, p. 2.26. ↩
Guidelines on consent, para. 153; ECCRI, p. 2.2 and 2.4. ↩
See: WMA Declaration of Helsinki (October 2024) p. 25; Article 5 Convention on Human Rights and Biomedicine (ETS No. 164, Oviedo 4.4.1997); See further in section 4.1.3. ↩
EDPS, A Preliminary Opinion on data protection and scientific research (6.1.2020) p. 13. ↩
ECCRI, p. 2.3; EDPS, A Preliminary Opinion on data protection and scientific research, p. 10. ↩
ECCRI, p. 2.1. ↩
ECCRI, p. 2.1 and 2.3; Cf. also: Pillar 1 Point 2 of the European Charter for Researchers (Annex II OJ C, C/2023/1640). ↩
ECCRI, p. 2.2. ↩
When assessing the contribution to the growth of society’s collective knowledge and wellbeing, controllers should consider reviews of the scientific merit of their research projects that, for example, can have been undertaken by independent review bodies. ↩
To assess this factor, controllers should have recourse to the goal of the research, as stated in the research or project plan. ↩
ECCRI, p. 2.8. ↩
An example is Annex 1 Module 5 p. 5.2 of Directive 2001/83/EC. ↩
See, for example: Article 2(1) Regulation (EU) 2021/695 (Horizon Europe) and Article 2(a) Council Regulation (EC) No 723/2009 on the Community legal framework for a European Research Infrastructure Consortium (ERIC). ↩
On the concept of a specific area of research, see further in section 4.1.2.1. ↩
Curation and categorisation refer to the ordering of data contained in datasets that are to be used for scientific research purposes, including sorting and labelling data as well as deleting categories of personal data that are not necessary for the scientific research purposes. ↩
See further in section 8.3. ↩
(Article 5(1)(b) GDPR: “personal data shall be […] collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for […] scientific […] research purposes […] shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes.” See also proposed Recital 29 and Article 3(2) Digital Omnibus. ↩
Nonetheless, the controller must still adopt appropriate safeguards, in line with Article 89(1) GDPR. See further in section 8 below. ↩
Unless the purpose for further processing is archiving in the public interest, historical research or statistical purposes, which also benefit from the presumption of purpose compatibility. ↩
EDPB, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70.1.b)) (23.1.2019) para. 31. ↩
EDPB-EDPS Joint Opinion 2/2026 On the Proposal for a Regulation as regards the simplification of the digital legislative framework (10.02.2026) para. 32. ↩
Articles 6(1)(e) and (f) GDPR respectively. See further in sections 4.2 and 4.3. ↩
A change of purpose could be contradictory to the specificity of consent or the scope of the legal obligation. See further in section 4.1.2.1. ↩
See further at para. 61. ↩
See also the Example 10, where a controller relies on performance of a contract (Article 6(1)(b) GDPR) for the initial processing, but legitimate interest (Article 6(1)(f) GDPR) for the processing of personal data for scientific research purposes. ↩
See further in section 4.4. ↩
EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research (2.2.2021) para. 22. ↩
Both controllers must still comply with all relevant obligations of the GDPR including, inter alia, determining an appropriate legal basis under Article 6(1) GDPR and, when applicable, which derogation under Article 9(2) GDPR that it can rely on to process special categories of personal data, as well as if any additional conditions or limitations pursuant to Article 9(4) GDPR apply. ↩
Article 5(1)(e) GDPR: “personal data shall be […] kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for […] scientific […] research purposes […] in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject […]” ↩
Article 13(2)(a) and 14(2)(a) GDPR. ↩
Article 25(1) GDPR. ↩
On the concept of a specific area of research see further in section 4.1.2.1. ↩
Case C-77/21, paras. 52-59. ↩
Judgment of 1 August 2022, OT v Vyriausioji tarnybinės etikos komisija, C-184/20, EU:C:2022:601, para. 99. ↩
See further in section 8. ↩
Guidelines on consent, para. 2. ↩
As further clarified in sections 4.1.2.1 and 4.1.2.2, personal data processed for scientific research purposes on the basis of consent, pursuant to Article 6(1)(a) GDPR, may be collected using either broad or dynamic consent. ↩
Processing that is necessary for the protection of vital interests of the data subject or of another natural person, pursuant to Article 6(1)(d) GDPR, may also be a viable legal basis in rare circumstances (see Recital 46). ↩
See further in section 4.4. When processing genetic data, biometric data or data concerning health, further conditions or limitations, pursuant to Article 9(4) GDPR, might apply. ↩
Article 10 GDPR. ↩
Recital 43 GDPR; Judgment of 4 July 2023, Meta Platforms Inc and Others v Bundeskartellamt, C-252/21, EU:C:2023:537, para. 144. ↩
Opinion 3/2019, para. 20; controllers should consider that there may be provisions in MS law that delegate the authority to consent to the processing of personal data in medical research to spouses, family members or legal guardians in cases where the research participant is incapacitated. ↩
EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 10. ↩
Article 7(4) of the GDPR; See also Guidelines on consent, para. 26, and Opinion 3/2019, para. 19. ↩
See further at para. 48. ↩
Recital 33 GDPR. ↩
Article 5(2) and 24(1) GDPR. ↩
Article 35 GDPR; See also: Article 29 Working Party Guidelines on DPIA (WP 248 rev.01, endorsed by the EDPB on 25 May 2018). ↩
Recital 33 GDPR; Cf. also Recital 26 second para. DGA. ↩
Guidelines on consent, para. 158. ↩
Guidelines on consent, para. 156. ↩
See further in Example 10. ↩
See, by analogy: Judgment of 12 September 2024, HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG v Müller Rechtsanwaltsgesellschaft mbH and Others, Joined Cases C-17/22 and C-18/22, EU:C:2024:738, para. 52. ↩
Recital 42 GDPR; Guidelines on consent, para. 64. ↩
Cf. EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default (Version 2.0, 20.10.2020) para. 70. ↩
See further in section 4.1.2.2. ↩
Guidelines on consent, para. 160. ↩
See further in para. 115; Guidelines on consent, para. 117. ↩
Meaning an entity or individual that acts as a neutral intermediary between the holder of data and the user of data, and that manages and oversees the processing of personal data. ↩
While such safeguards should be adopted when a controller relies on broad consent, they may also be relevant when a controller processes personal data for scientific research purposes on the basis of dynamic consent (see further in section 4.1.2.2) or another legal basis. ↩
Pursuant to Article 37(1) GDPR. ↩
Tools for managing consent can also be provided by data intermediation services, pursuant to Article 10(b) Regulation (EU) 2022/868 (Data Governance Act (DGA)). ↩
Cf. DoH, October 2008, para 24; Article 62(4)(f) of Regulation (EU) 2017/745 on medical devices; Article 28(1)(c) CTR. ↩
In addition, a controller may — as a safeguard pursuant to Article 89(1) GDPR — record the agreement of data subjects to process their personal data for scientific research purposes, when relying on another legal basis than consent. ↩
Opinion 3/2019 para. 16. ↩
Guidelines on consent, para. 154; EDPB-EDPS Joint Opinion 3/2026 On the Proposal for a Regulation on establishing a framework of measures for strengthening Union’s biotechnology and manufacturing sectors particularly in the area of health (European Biotech Act) (10.03.2026) para. 37. ↩
EDPB-EDPS Joint Opinion 3/2026, para. 46; EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 5. ↩
Article 5(2) GDPR; Judgment of 11 November 2020, Orange Romania SA v ANSPDCP, C-61/19, EU:C:2020:901, para. 42. ↩
Article 7(2) GDPR. ↩
Article 12(1) GDPR. See further: Guidelines on transparency, para. 35pp. ↩
European Commission, Ethics and data protection (05.07.2021) p. 12. ↩
Examples of MS laws: Section 4, subsection 1, paragraph 3 of the Finnish Data Protection Act (1050/2018); Article R322-2 of the French Research Code; Article 33 of the Icelandic Information Act (140/2012); Section 12(10-14) of the Italian Law Decree no. 179 of 18 October 2012; 1 Chapter 2 § 2 p. Swedish law (SFS 1992:1434). ↩
Official authority, pursuant to Article 6(1)(e) GDPR refers to an authority granted by the European Union, EFTA or a Member State. ↩
According to Recital 41 GDPR, the legal basis relied upon should be clear and precise. ↩
Recital 45 GDPR. ↩
See further in section 4.1. ↩
See further in section 4.3. ↩
See e.g.: Judgment of 16 December 2008, Heinz Huber v Bundesrepublik Deutschland, C-524/06, EU:C:2008:724, para. 62. ↩
EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, Version 1.0, Adopted on 8 October 2024 (version for public consultation). ↩
In accordance with Article 6(1) second para. GDPR, it is noted that public authorities cannot rely on Article 6(1)(f) GDPR when they are processing personal data in the performance of their tasks. ↩
See above at para. 11 lit v; See also: Judgement of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, 22, EU:C:2024:857, para. 49. ↩
See further at paras. 1 and 61; See also: Guidelines on legitimate interest, para. 24. ↩
Guidelines on consent, section 3. ↩
For a similar reasoning, see further at para. 46. ↩
The adopted safeguards should go beyond the mandatory measures required by the GDPR, such as performing a DPIA pursuant to Article 35(1) GDPR. See, to that effect: [[EDPB Opinion 28-2024 on certain data protection aspects related to the processing of personal data in the context of AI models|Opinion 28/2024]] on certain data protection aspects related to the processing of personal data in the context of AI models (17.12.2024) para. 97. ↩
See further in section 8.2. ↩
Guidelines on legitimate interest, para. 57. ↩
Guidelines on legitimate interest, para. 60. ↩
Judgement of 21 December 2023, ZQ v. Medizinischer Dienst, C-667/21, EU:C:2023:1022, para. 78. ↩
Judgment of 4 October 2024, ND v DR, C-21/23, EU:C:2024:846, paras. 79-83; C-184/20, paras. 120-127. See also Guidelines 1/2024, para. 40. ↩
EDPB-EDPS Joint Opinion 3/2026, para. 36; See also further in section 8. ↩
Article 35(3)(b) GDPR. ↩
Article 9(4) GDPR. The EDPB underlines that such limitations may also be imposed by MS law for processing operations that are covered by other legal bases than Article 6(1)(e) GDPR. ↩
See further in section 4.1.2.1. ↩
See further in section 4.1.2.2. ↩
Guidelines 8/2020 on the targeting of social media users (Version 2.0, 13.4.2021) para. 127. ↩
21, p. 77. ↩
See e.g. Judgement of 4 October 2024, Maximilian Schrems v Meta Platforms Ireland Limited, 21, EU:C:2024:834, paras. 78-79. ↩
C-252/21, paras. 81-82; Guidelines on the targeting of social media users, para. 127 lit (i). ↩
Guidelines on the targeting of social media users, paras. 127-128. ↩
Guidelines 8/2020, para. 127 lit (v). ↩
C-446/21, para. 80. ↩
Examples of Union and MS laws: Section 10 of the Danish Data Protection Act; Section 6, subsection 1, paragraph 7 of the Finnish Data Protection Act (1050/2018); Article 44-6 of the French Data Protection Act; Section 27(1) of the German Federal Data Protection Act; Article 11(1)(10) of the Icelandic Data Protection Act; Section 110 of the Italian Data Protection Code; 6 § Swedish law (2003:460); Article 57(1)(a)(i) Regulation (EU) 2025/327 (EHDS). See also: Recital 151 of Proposal for a Regulation on establishing a framework for Union’s biotechnology and biomanufacturing sectors (European Biotech Act) (COM(2025) 1022 final); Recital 30 of Commission Delegated Regulation (EU) 2025/2050. ↩
C-184/20, para. 70. ↩
See by analogy: C-439/19, paras. 105-106. ↩
See further in section 8. ↩
Recital 52 EHDS. ↩
Article 29 Working Party — Guidelines on transparency under Regulation 2016/679 (WP260 rev.01, endorsed by the EDPB on 25 May 2018). ↩
Guidelines on transparency, para. 32. ↩
Guidelines on transparency, para. 35-36. ↩
Guidelines on transparency, para. 39; Privacy dashboards can be provided for by data intermediation services, pursuant to Article 10(b) DGA. ↩
For an example of how implement a consent record, see: W3C Community Group, consent Records and Receipts as per ISO/IEC TS 27560:2023 using DPV (01.0.8.2024) https://w3c.github.io/dpv/guides/consent-27560 (accessed on 24.09.2025). ↩
Pursuant to Chapter III GDPR. See further in section 6. ↩
If the controller relies on consent for the processing of personal data, a privacy dashboard can be a particularly useful tool. See further in para. 50. ↩
See, inter alia, Articles 12(1-2), 13(1)(a) and 14(1)(b) GDPR; See also: Guidelines on transparency, para. 55 and Guidelines on right of access, para. 53. ↩
This information can also be provided using automated or pre-recorded messages. See: Guidelines on transparency, para. 21. ↩
Judgment of the Court of 5 December 2023, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija, Case C-683/21, ECLI:EU:C:2023:949, para. 36. ↩
Processors should assist the controller in the fulfilment of data subject’s rights, pursuant to Article 28(3)(e) GDPR; In cases of joint controllership, the provision of information and fulfilment of data subjects’ rights should be laid down in the agreement between the controller, pursuant to Article 26(1) GDPR. ↩
Article 13(3) GDPR. ↩
See further in section 5.5. ↩
For a similar reasoning, see: Guidelines on transparency, para. 48. ↩
See further in section 4.1.2.1. ↩
Pursuant to Article 21(6) GDPR. See further in section 6.3. ↩
EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 35; See also further at para. 77. ↩
The EDPB notes that, in accordance with Article 11(1) GDPR, there is no obligation under the GDPR to retain identifiers. ↩
Recital 37 of the Digital Omnibus. ↩
See further in section 5.4.2.3. ↩
Recital 37 of the Digital Omnibus. ↩
See further at para. 79. ↩
Judgement of 28 November 2024, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC, C-169/23, EU:C:2024:988, para. 49. ↩
Depending on the context of scientific research and the set-up of the research infrastructure, it may be the case that several entities are joint controllers when intermediaries are collecting and providing personal data for scientific research purposes. See further in section 7.3. ↩
Guidelines on pseudonymisation (version for public consultation, 16.1.2025) p. 79. ↩
See in this respect: Guidelines on transparency, paras. 57 and 61. ↩
Guidelines on transparency, para. 59. ↩
See further at para. 89. ↩
Recital 62 of the GDPR; Guidelines on transparency, para. 62. ↩
This may be the case if digital mail boxes are used in the MS in question. See further at para. 88. ↩
Guidelines on transparency, para. 63. ↩
EDPB Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, para. 37. ↩
See further at para. 89. ↩
C-169/23, para. 44. ↩
C-169/23, para. 54. ↩
Guidelines on transparency, para. 67. ↩
Moreover, if scientific research includes processing of personal data of persons that are alleged of criminal acts or abusive behaviour, the processing needs to be lawful under Article 10 of the GDPR and specific safeguards needs to be adopted. ↩
Cf. Article 17(3) Recommendation (CM/Rec(2016)6) of the Committee of Ministers to member States on research on biological materials of human origin (11.5.2016). ↩
Guidelines on transparency, paras. 29 and 56. ↩
Guidelines on transparency, para. 29. ↩
EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 38. ↩
Transfers to third countries, or international organisations, are subject to specific provisions in Chapter V of the GDPR. For more information on what constitutes a transfer, see: Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR (Ver. 2.0, 14.2.2023) para. 9. ↩
Guidelines on transparency, para. 29. ↩
Guidelines on transparency, paras. 30 and 48. ↩
The current guidelines do not address Article 15 GDPR on the right of access by the data subject. Guidance on the right of access is provided in EDPB Guidelines 01/2022 on data subject rights — Right of access (Version 2.1, 28.3.2023). ↩
Restrictions, pursuant to Article 23 GDPR, in the context of processing for scientific research purposes may in particular be relevant for safeguarding important objectives of general public interest of the Union or of a MS as listed in Article 23(1)(e) and (i) GDPR. ↩
See further in section 8. ↩
Examples of derogations in MS law, pursuant to Article 89(2) of the GDPR include: Article 22(2) of the Danish Data Protection Act; Section 31 of the Finnish Data Protection Act (1050/2018); and Section 110(2) of the Italian personal data Protection Code. ↩
See, for example, Article 71 EHDS. ↩
See further in section 6.2.2. ↩
Judgment of 4 October 2024, Agentsia po vpisvaniyata v OL, C-200/23, EU:C:2024:827, para. 120; Judgement of 7 December 2023, UF and AB v Land Hessen, joined cases C-26/22 and C-64/22, EU:C:2023:958, para. 111-112; See also further in section 6.3. ↩
Guidelines on legitimate interest, para. 79. ↩
For guidance on how to perform the necessity test, see inter alia: EDPS, Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit (2017). ↩
In order to rely on the exceptions to the right to erasure under Article 17(3)(b) or (c) GDPR, the Union or MS law on which the processing is based should clearly identify the scientific research area and be in accordance with the conditions laid down in Article 6(3) and, where applicable, Article 9(2). ↩
C-200/23, para. 124; C-13/16, para. 30. ↩
In this regard, the wording render impossible or seriously impair implies a high threshold. For a similar reasoning, see: Guidelines on legitimate interest, para. 73 and 79. ↩
See further in section 5. ↩
Judgement of 9 March 2017, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni, C-398/15, EU:C:2017:197, p. 47. ↩
Joined Cases C-26/22 and C-64/22, para. 111. ↩
Guidelines on legitimate interest, para. 25. ↩
See also para. 119. ↩
C-524/06, para. 62; C-184/20, p. 85. ↩
C-13/16, para. 30. ↩
See also para. 120. ↩
See, for a similar reasoning: Guidelines on Automated individual decision-making and Profiling, page 19. ↩
Article 5(1)(c) GDPR; C-184/20, p. 93. ↩
Guidelines on legitimate interest, para. 74. ↩
C-200/23, para. 125. ↩
Guidelines on legitimate interest, para. 71. ↩
Guidelines (07/2020) on the concepts of controller and processor in the GDPR (Version 2.1, 7.7.2021). If sub-processors are involved in the processing of personal data, controllers should consider the guidance provided in Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) (7.10.2024). ↩
Guidelines on controller and processor, para. 2. ↩
Guidelines on controller and processor, para. 11. ↩
In line with the principle of accountability, pursuant to Article 5(2) and 24(1) GDPR. ↩
Guidelines on controller and processor, para. 12. ↩
Article 4(7) GDPR. ↩
Guidelines on controller and processor, para. 40. ↩
Judgment of 27 February 2025, Amt der Tiroler Landesregierung v Datenschutzbehörde and Others, C-638/23, EU:C:2025:127, paras. 42-47; Guidelines on controller and processor, para. 23. ↩
C-638/23, para. 28. ↩
C-638/23, para. 37. ↩
See further in section 7.3. ↩
Judgement of 5 June 2018, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, C-210/16, EU:C:2018:388, para. 38; Guidelines on controller and processor, para. 45. ↩
The European commission has proposed that sponsors of clinical trials for medicinal products should be designated as controllers for certain processing operations. See: Article 58(48) of the Proposal for a Regulation on establishing a framework of measures for strengthening Union’s biotechnology and biomanufacturing sectors (European Biotech Act). ↩
Those controllers may, depending on the circumstances, also be joint controllers. See further in section 7.3. ↩
See further in section 8.5. ↩
Article 29 GDPR; Guidelines on controller and processor, para. 19; See also, for a similar reasoning: EDPB-EDPS Joint Opinion 3/2026, para. 25. ↩
Article 4(8) GDPR; Guidelines on controller and processor, para. 76. ↩
Article 28(3) GDPR. ↩
Guidelines on controller and processor, para. 39-41. ↩
Guidelines on controller and processor, para. 80. ↩
Art. 28(10) GDPR. ↩
See further in section 7.3. ↩
Article 26(1) GDPR. ↩
Guidelines on controller and processor, para. 55. ↩
EDPB-EDPS Joint Opinion 3/2026, paras. 22 and 23; See also at para. 133. ↩
Guidelines on controller and processor, page 23 — Example on clinical trials. ↩
See Judgement of 10 July 2018, Tietosuojavaltuutettu v Jehovan todistajat — uskonnollinen yhdyskunta, C-25/17, EU:C:2018:551, para. 66. ↩
Guidelines on controller and processor, para. 166 and footnote 73. ↩
Article 26(1) GDPR. ↩
Article 26(2) GDPR. ↩
Judgement of 7 March 2024, IAB Europe v Gegevensbeschermingsautoriteit, C-604/22, EU:C:2024:214, para. 58. ↩
Article 26(3) GDPR. ↩
Article 82(4) GDPR. ↩
Guidelines on controller and processor, para. 166. ↩
Article 89(1) GDPR should be read in conjunction with Recital 156. ↩
See further in section 8.3. ↩
Specific safeguards required by Union or MS law may be prescribed together with a legal basis that can be relied on for the processing of personal data for scientific research purposes. Safeguards can also be provided in Union or MS law together with a derogation from the prohibition of processing of special categories of personal data, in accordance with Article 9(2)(g), (i) or (j) of the GDPR. Finally, Article 89(1) GDPR can be linked to Article 9(4), which allows MSs to adopt national legislation with additional conditions for the processing of genetic data, biometric data and data concerning health. ↩
See further in section 8.2. ↩
See Article 29 Working Party’s Guidelines on data protection impact assessment (DPIA) (WP 248 rev.01) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679. ↩
Articles 7 and 8 CFREU. ↩
Cf. Guidelines 4/2019 on Article 25 — Data Protection by Design and Default (Version 2.0, 20.10.2020) paras. 11-12. ↩
Cf. Article 17(3) Recommendation (CM/Rec(2016)6) of the Committee of Ministers to member States on research on biological materials of human origin (11.5.2016). ↩
Concerning genetic and biometric data, see further in section 8.4. ↩
Recital 75 GDPR. ↩
Judgment of 24 February 2022, SIA ‘SS’ v Valsts ieņēmumu dienests, C-175/20, EU:C:2022:124, para. 72-74. ↩
Recital 26 GDPR; See also Article 29 Working Party, Opinion 05/2014 on Anonymisation Techniques (WP216) p. 5. ↩
Case C-77/21, para. 34. ↩
Recital 156 GDPR. ↩
Article 4(5) GDPR: ”[…] the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.” ↩
Guidelines on pseudonymisation, para. 23. ↩
Guidelines on pseudonymisation, section 3.1; See also: ENISA, pseudonymisation techniques and best practices (November 2019); ENISA, Deploying pseudonymisation techniques — The case of the Health Sector (March 2022). ↩
Provided that the recipient has the means reasonably likely to be used to identify the data subject. See further: Judgment of 4 September 2025, C-413/23 P, EDPS v. SRB, EU:C:2025:645, para. 82. ↩
Guidelines on pseudonymisation, p. 78-79. ↩
Article 4(13) GDPR: “personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question.” ↩
A29 WP, Opinion 05/2014, p. 10. ↩
Article 4(14) GDPR: “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.” ↩
Judgment of the Court of 17 October 2013, Michael Schwarz v Stadt Bochum, C-291/12, EU:C:2013:670, para. 27. ↩
Cf. Recitals 39 and 75 GDPR. ↩
See further in section 5.1. ↩
See further in section 4.1.3. It should be noted that if a controller commits to consent as a safeguard, then it needs to adhere to the consent provided by the data subject, even if the legal basis is not consent. ↩
This safeguard is without prejudice to research in the medical field, where the research results may influence the healthcare of data subjects. See, to that end: Recital 159 of the GDPR. ↩
For an example in this regard, see: Article 73 as well as recital 77 EHDS and Articles 2(20), 5(3)-(4) DGA. ↩
Article 40 GDPR. ↩
Article 42 GDPR. ↩

Armingaud Avocat

Explorateur

EDPB Guidelines 01-2026 on processing of personal data for scientific research purposes

Guidelines 01/2026 on processing of personal data for scientific research purposes

Executive Summary

1 Introduction

2 The scope of the concept ‘processing of personal data for scientific research purposes’

2.1 Key-indicative factors for determining whether processing of personal data is motivated by scientific research purposes

2.2 Research data infrastructures

2.3 Ancillary processing operations

3.1.1 Presumption of purpose compatibility

3.1.2 Further processing when providing personal data to another controller for scientific research purposes

4.1.2 Specificity

5.1 General

5.4.1 General

6.1 General

7 Attribution of responsibility (controller and processor)

7.1 Controller

7.2 Processor

7.3 Joint controllers

8.1 General

8.2 Risk analysis and data protection impact assessment (DPIA)

8.3 Anonymisation and pseudonymisation of personal data

8.4 Safeguards when processing genetic or biometric data

8.5 Determination of other types of appropriate safeguards

Footnotes

Vue Graphique

Table des Matières

Armingaud Avocat

Explorateur

EDPB Guidelines 01-2026 on processing of personal data for scientific research purposes

Guidelines 01/2026 on processing of personal data for scientific research purposes

Executive Summary

1 Introduction

2 The scope of the concept ‘processing of personal data for scientific research purposes’

2.1 Key-indicative factors for determining whether processing of personal data is motivated by scientific research purposes

2.2 Research data infrastructures

2.3 Ancillary processing operations

3 Data protection principles (Article 5 GDPR)

3.1 Purpose limitation (Article 5(1) GDPR)

3.1.1 Presumption of purpose compatibility

3.1.2 Further processing when providing personal data to another controller for scientific research purposes

3.2 Storage limitation (Article 5(1)(e) GDPR)

4 Lawfulness (Articles 5(1)(a), 6(1) and 9 of the GDPR)

4.1 consent (Article 6(1)(a) of the GDPR)

4.1.1 Freely given consent

4.1.2 Specificity

4.1.2.1 Broad consent

4.1.2.2 Dynamic consent

4.1.3 consent to participate in scientific research pursuant to ethical or legal requirements not stemming from the GDPR

4.2 Public interest or exercise of official authority (Article 6(1)(e) GDPR)

4.3 Legitimate interest (Article 6(1)(f) GDPR)

4.4 Processing special categories of personal data for scientific research purposes (Article 9 GDPR)

4.4.1 Explicit consent (Article 9(2)(a) GDPR)

4.4.2 Personal date manifestly made public by the data subject (Article 9(2)(e) GDPR)

4.4.3 Derogations laid down in Union or MS law (Article 9(2)(g), (i) and (j) GDPR)

5 Obligations to inform (Articles 12-14 GDPR)

5.1 General

5.2 Provision of information when personal data are collected directly from the data subject (Article 13(1) GDPR)

5.3 Further processing of personal data for further scientific purposes (Article 13(3) GDPR)

5.4 Provision of information when personal data are not collected directly from the data subject (Article 14(1) GDPR)

5.4.1 General

5.4.2 Exceptions from the obligation to provide information (Article 14(5) GDPR)

5.4.2.1 The data subject already has the information (Article 14(5)(a) GDPR)

5.4.2.2 Provision of information proves impossible (Article 14(5)(b) GDPR)

5.4.2.3 Disproportionate effort (Article 14(5)(b) GDPR)

5.4.2.4 Individual information which is likely to render impossible or seriously impair the achievement of the scientific research objectives (Article 14(5)(b) GDPR)

5.4.2.5 Obtaining or disclosure is expressly laid down by Union or MS law (Article 14(5)(c) GDPR)

5.4.2.6 The personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or MS law, including a statutory obligation of secrecy (Article 14(5)(d) GDPR)

5.5 Changes to processing operations for scientific research purposes (Article 13(4) and 14(5)(a) GDPR) which data subjects have to be informed of

6 Data subjects’ rights (Articles 15-21 GDPR)

6.1 General

6.2 Right to erasure (right to be forgotten) (Article 17 GDPR)

6.2.1 Grounds for erasure (Article 17(1) GDPR)

6.2.2 Exceptions from the obligation to erase personal data upon request (Article 17(3) GDPR)

6.3 Right to object (Article 21 GDPR)

7 Attribution of responsibility (controller and processor)

7.1 Controller

7.2 Processor

7.3 Joint controllers

8 Appropriate safeguards (Article 89(1) of the GDPR)

8.1 General

8.2 Risk analysis and data protection impact assessment (DPIA)

8.3 Anonymisation and pseudonymisation of personal data

8.4 Safeguards when processing genetic or biometric data

8.5 Determination of other types of appropriate safeguards

Footnotes

Footnotes

Vue Graphique

Table des Matières