European Data Protection Board Issues New Guidelines on Personal Data for Scientific Research

The European Data Protection Board (EDPB) has introduced new guidelines intended to clarify the application of the General Data Protection Regulation (GDPR) to the processing of personal data for scientific research. Published on April 24, 2026, these guidelines are now open for a public consultation period, which will conclude on June 25, 2026. This initiative by the EDPB, as reported by Ropes & Gray, addresses a long-standing need for authoritative, EU-wide interpretation of the GDPR's research provisions, which have previously been subject to a patchwork of national laws. The guidelines tackle key areas including the definition of 'scientific research,' the lawful bases for processing sensitive personal data (such as consent, public interest, and legitimate interest), and the transparency obligations and safeguards required under Article 89(1) of the GDPR. The move is seen as a significant step towards regulatory clarity for the global research community, particularly for organizations involved in clinical trials and academic institutions. The COVID-19 pandemic and the UK's departure from the EU had further highlighted the necessity for such specific guidance. The EDPB's move is expected to help researchers navigate complex compliance issues, particularly concerning the use of broad consent and the balancing of data subject rights with research objectives. The guidelines also touch upon further processing and storage limitation of personal data, emphasizing that data collected for specified purposes should not be further processed in a manner incompatible with those purposes, aligning with Article 5(1)(b) of the GDPR. This development is crucial for ensuring that scientific advancements can proceed ethically and in full compliance with data protection principles. The public consultation phase will allow stakeholders to provide feedback, potentially shaping the final version of these important guidelines.