Cybersecurity Policy Report, Guidelines on Data Processing for Scientific Purposes Released in EU, (Apr 17, 2026)

By Tony Foley

The European Data Protection Board (EDPB) has adopted guidelines designed to provide greater clarity for researchers regarding the processing of personal data for scientific research purposes.

The guidelines were announced yesterday in an EDPB news release, in which the board said many areas of scientific research relied on the processing of individuals’ personal data, driving significant breakthroughs benefiting society. In addition, the rise of new technologies like artificial intelligence (AI) has contributed to scientific progress by enabling researchers to use and analyze data in innovative ways. In addition to providing more clarity for researchers, the main objective of the guidelines is to make compliance with the European Union’s General Data Protection Regulation (GDPR) easier while ensuring the protection of individuals’ fundamental rights.

The guidelines outline the factors to be considered in determining whether processing is taking place for scientific research purposes, including a methodical and systematic approach, adherence to ethical standards, verifiability and transparency, autonomy and independence, the objectives of the research, and the potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways. Data controllers that cannot meet these standards must justify and be able to demonstrate why the activities in which they engage should be considered scientific research under the GDPR.

With respect to further processing of personal data for scientific research purposes, the guidelines provide that such further processing is presumed to be compatible with the original purpose of collecting individuals’ personal data but that controllers must make sure that the legal basis for the initial processing is also suitable for further processing. Researchers are permitted to rely on the concept of “broad consent” where the purposes of research are not fully known at the time the data is initially collected, but they should respect ethical standards for scientific research and put additional safeguards in place to compensate for the lack of purpose specification. In addition, researchers may ask individuals for “dynamic consent,” in which consent is obtained separately as soon as the purposes of a project become known.

The guidelines also clarify the rights of individuals when their data is processed for scientific purposes, including the right to request erasure of their data and to object to processing, both of which may be limited when applied to processing for scientific purposes. When several entities are involved in processing for scientific purposes, the EDPB emphasized that the entities must assess and document how responsibilities are allocated among them.

Regarding data security, the guidelines explain how controllers can assess and use appropriate technical and organizational measures like anonymization and pseudonymization when processing personal data for scientific research purpose, and they provide examples of other safeguards that can be implemented, including independent or ethical oversight, secure processing environments, privacy enhancing technologies, protective measures for publication of results, confidentiality arrangements, and conditions for further use.

The guidelines are subject to a public consultation through June 25. Interested parties may access the full text of the guidelines, along with a link to a page to provide feedback, on this web page.

News: InternationalLegislation DataPrivacy DataSecurity GDPR