Cybersecurity Policy Report, Recommendations for Biotech Law Offered by EU Privacy Authorities, (Mar 13, 2026)

By Tony Foley

The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued a joint opinion yesterday on the European Commission’s proposal for enacting the European Biotech Act.

The Biotech Act aims to strengthen Europe’s biotechnology and biomanufacturing sectors, particularly in the area of health, by streamlining the regulatory framework and updating the rules for clinical trials. The EDPB and EDPS expressed support for the proposal’s objective of fostering European Union competitiveness and addressing existing fragmentation in the application of clinical trials regulations. In particular, they welcome the goal of establishing a single legal basis for the processing of personal information by sponsors and investigators, which they said would significantly improve legal clarity across the EU.

The opinion underlines that the sensitivity of health and genetic data processed in the context of clinical trials requires a high standard of protection. Specifically, the agencies made the following recommendations:

1. Clarify controller rules to specify whether the actors involved in funding and conducting clinical trials act as joint controllers;

2. Limit data retention by expressly applying the proposed 25-year retention period to the clinical trial master file rather than to all personal data processed during a trial;

3. With respect to further processing for other trials or scientific research, since the proposed act aims to provide a legal basis for the further processing of trial data by the same controller, it should clearly define the purposes and specific safeguards for such processing;

4. Ensure that obligations for sponsors complement the existing requirements under the EU AI Act to ensure a consistent regulatory environment;

5. Include appropriate technical and organizational measures like requiring pseudonymization whenever the trial does not require the processing of directly identifiable personal data; and

6. Specify that the implementing acts regarding sandboxes in the specific context of clinical trials should provide for a legal basis for processing of personal data, as well as the derogation under article 9(2) of the EU General Data Protection Regulation (GDPR) for the processing of sensitive personal data.

“Europe’s ambition to lead in medical innovation must go hand in hand with trust,” EDPB Chair Anu Talus said in a press release. “Our opinion makes recommendations to the co-legislators aiming to ensure that the pursuit of new treatments respects the fundamental rights of individuals. This will help build a framework that protects clinical trial participants and will ensure further legal certainty for researchers.”

“A competitive biotechnology sector in Europe requires a predictable and harmonised legal environment,” added European Data Protection Supervisor Wojciech Wiewiórowski. “We welcome the proposal’s move towards a single legal basis for clinical trials, which will facilitate GDPR compliance and strengthen consistency across the Union. However, this harmonisation must be accompanied by strong safeguards, including a clear definition of the roles and responsibilities of all actors involved to ensure trust and accountability in scientific research.”

News: InternationalLegislation DataPrivacy DataSecurity GDPR