Unpacking the EDPB’s Draft Guidelines on Personal Data Processing for Scientific Research
On April 15, 2026, the European Data Protection Board (EDPB) unveiled its much-anticipated draft Guidelines 1/2026, focusing on the processing of personal data for scientific research purposes under the General Data Protection Regulation (GDPR). This marks a pivotal moment for organizations in the life sciences sector, providing clarity and addressing long-standing uncertainties in areas such as secondary data use, consent protocols, and accountability measures.
Understanding ‘Scientific Research’
One of the most crucial aspects presented in the Guidelines is the interpretation of "scientific research." While the EDPB refrains from providing a formal definition, it offers six indicative factors to assess whether an activity qualifies as scientific research:
- A methodical and systematic approach
- Adherence to ethical standards
- Verifiability and transparency
- Autonomy and independence
- Clearly defined objectives
- Contribution to existing scientific knowledge or innovative applications
For activities meeting all six criteria, the classification as scientific research is generally affirmed. Conversely, if any factors are absent, organizations must justify their categorization based on the processing’s nature and context. This creates a practical threshold test that regulatory bodies are likely to adopt, urging organizations to critically scrutinize their research activities.
Navigating Further Processing
The Guidelines clarify the compatibility of further processing of personal data with its original purpose. Although the GDPR generally assumes such processing for scientific research is permissible, this is not an unfettered license. The presumption applies strictly when the further processing genuinely qualifies as scientific research. Organizations must conduct compatibility assessments if the data is repurposed for non-research objectives.
For instance, data collected for linguistic research could later be employed to develop a language analysis app, provided it aligns with the presumption’s criteria. Organizations are also reminded to check the lawfulness of processing, particularly concerning sensitive data, and to re-evaluate original legal bases, such as consent.
Emphasizing Storage Limitation
The EDPB emphasizes the principle of storage limitation significantly, advising organizations to establish and communicate clear data retention periods. This mandates clarity even when timelines are uncertain. While post-study data retention for purposes of verification or reproducibility is permitted, vague commitments to "future research" without specific purposes are prohibited. Future research endeavors need to be foreseeable and accompanied by necessary safeguards. Organizations should therefore prioritize granular purpose definitions to avoid scrutiny.
Legal Bases for Processing Personal Data
The Guidelines confirm that broad consent can be valid, provided stringent safeguards are in place, including:
- Clear framing of the research field and expected outcomes.
- Ongoing transparency concerning processing, such as project updates.
- Effective systems for enabling the withdrawal of consent.
- Consideration for dynamic consent as research evolves.
In specific contexts, private entities may also rely on public interest or legal obligation as legal bases for processing, especially in clinical trials. Furthermore, the recognition of legitimate interest as a basis for data processing in scientific research is a noteworthy clarification, especially for commercial entities where consent might not be practical.
Tackling Transparency and Disproportionate Effort
The EDPB takes a firm stance on the interpretive scope of the disproportionate effort exemption concerning providing notice to data subjects. Organizations must undertake case-by-case assessments, evaluating factors including the number of data subjects and data age. Should they invoke this exemption, alternative transparency measures, such as public notices, must be instituted. As a result, organizations need to revisit their Article 14 GDPR assessments and ensure documentation is thorough and robust.
Data Subject Rights
An interesting aspect of the Guidelines is the reaffirmation of strict applicability concerning research-related derogations. For instance, the right to erasure is qualified; exceptions applying to scientific research must ensure that erasure would complicate or impair the research’s intended results. A similar rigor applies to the objection rights of data subjects, reinforcing that only essential processing for public interest research qualifies for exemption.
Allocation of Responsibilities
The draft Guidelines also clarify the responsibilities of various entities involved in research. Notably, they assert that organizations can be considered data controllers even if they do not directly process personal data. In clinical trials, sponsors, for instance, can be viewed as controllers when they determine the purposes and means of processing—even with pseudonymized data. This signals a shift toward assessing control based on influence rather than direct data handling.
Conclusion: An Evolving Landscape
The EDPB’s draft Guidelines signal a significant evolution in how organizations approach the governance of scientific research under GDPR. By clarifying expectations surrounding accountability, purpose limitation, and data transparency, the EDPB emphasizes a robust framework that organizations must adhere to. As these Guidelines enter a public consultation phase until June 25, 2026, the anticipation of refinements indicates ongoing engagement and adaptation in the regulatory landscape governing scientific research.