Patient data for research projects: purpose compatibility and safeguards

Patient data may be further processed for a research project when the specific purpose, legal basis and safeguards fit together. The research framework in Articles 5(1)(b) and 89 GDPR does not replace the rest of the lawfulness assessment. Health data also require a separate assessment under Article 9 GDPR.

This article explains how research organisations can prepare the secondary use of health data. It focuses on separating care from research, the two-level assessment under Articles 6 and 9 GDPR, anonymisation and pseudonymisation, roles within a research consortium, and risk analysis and data protection impact assessments.

Health data are special categories of personal data under Article 9(1) GDPR. Article 4(15) GDPR covers information about physical or mental health that reveals a person’s health status. Depending on the context, this includes diagnoses, findings, treatment, genetic information, measurements and information from which a health status can be inferred.

For research, the information conveyed by each field matters. A case number may look like a technical identifier on its own. If it can be linked to a separately stored list, it remains personal data. A rare condition or a combination of age, treatment location and period may also make a person indirectly identifiable.

Start with a data inventory. Assign each item its source, original purpose and scientific value. The article on health data in a workplace prevention programme also shows why data category and recipient group need separate assessments.

Using patient data for scientific research is usually secondary processing when the data were originally collected for care, billing or another task. The research protocol should therefore describe the original processing and the new project side by side. The research question, population, fields, method and planned recipients belong in the same assessment.

Article 5(1)(b) GDPR provides that further processing for scientific research purposes is generally considered compatible with the initial purpose under the conditions of Article 89 GDPR. This is an important facilitation. It does not replace the lawfulness assessment, the choice of a legal basis or the choice of an exception under Article 9(2) GDPR.

The EDPB public consultation draft of Guidelines 1/2026 makes this distinction expressly. It explains that the compatibility presumption and the lawfulness of further processing must be assessed separately. For health data, any additional conditions in national law under Article 9(4) GDPR must also be included.

Every processing operation in a research project needs a legal basis under Article 6 GDPR. This is not enough for health data. Article 9(1) GDPR first prohibits processing of special categories. A suitable exception under Article 9(2) GDPR is required for the specific operation.

Depending on the design, research projects may especially involve explicit consent under Article 9(2)(a) or a statutory rule under Article 9(2)(j) GDPR. Other grounds may be relevant if their conditions are genuinely met. The organisation must be able to explain why the selected exception supports this project and which statutory requirements it brings with it.

Consent in a long-term research programme needs careful design. It must be informed, freely given and withdrawable. Broad consent may require additional safeguards and a clear description of the research area. The records should also explain how withdrawal and already analysed results will be handled.

Article 89(1) GDPR requires appropriate safeguards for the rights and freedoms of data subjects. The measures must reflect the research purpose and the specific risks. Depending on the project, they include data minimisation, separate roles, access limits, controlled keys, secure working environments, erasure rules and publication controls.

Article 89 GDPR is therefore not a stand-alone legal basis. It describes safeguards and, subject to additional statutory requirements, possible restrictions of data-subject rights. The organisation must first establish that the processing is lawful and then show how the safeguards effectively reduce the risks.

Under Article 89(2) GDPR, Union or Member State law may provide restrictions of rights under Articles 15, 16, 18 and 21 where those rights are likely to make the specific research impossible or seriously impair it and the restriction is necessary. An internal research policy does not create that exception. The requirements and scope must come from the relevant legal basis.

Article 89(1) GDPR requires research purposes to be achieved with data that do not or no longer permit identification where this is possible. Truly anonymised data then fall outside the GDPR. The anonymisation process itself is a processing operation and must be lawful and protected while it takes place.

If research must compare individual courses or link data over time, pseudonymisation may be necessary. The link is protected by keeping additional information separate. Pseudonymised data remain personal data. The key should therefore not be in the same access group as the research data, and re-identification should be limited to strictly justified situations.

Review effectiveness on an ongoing basis. Rare conditions, small groups, external datasets and published results can make a person identifiable even after the name has been removed. Define the data format in the research plan and reassess it for every new data source and before publication.

Research projects often involve hospitals, universities, sponsors, pharmaceutical companies and IT providers. An entity that decides on the purposes and essential means is a controller. When several entities make those decisions together, joint controllership under Article 26 GDPR may apply. The arrangement should allocate responsibilities for information, data-subject rights and security in practical terms.

An IT provider may be a processor under Article 28 GDPR when it processes data on instructions. The heading of a contract does not decide the role. The actual decisions about the research objective, access, evaluation, sub-processors and the provider’s own uses are decisive.

Map the data flow from the hospital information system to the research database, partners and publications. For every station, record data categories, purpose, access, storage, transfer and erasure event. The records of processing activities under Article 30 GDPR can support the ongoing documentation.

The safeguards under Article 89 GDPR begin with a risk analysis. Article 35 GDPR requires a data protection impact assessment where processing is likely to result in a high risk. For health data, the assessment should focus on volume, sensitivity, combinations with other datasets, retention, recipients, re-identification risks and planned publication.

The assessment should also cover effects beyond data protection. A research result may lead to stigma, disadvantage, discrimination or an unexpected medical finding. With rare conditions, even a pseudonymised publication may identify a person or family. Safeguards must address these concrete consequences.

Before the project starts, define who approves the risk analysis, how access is controlled and when reassessment occurs. Changes to the protocol, new data sources, additional partners or planned publication may overtake the original assessment. A DPIA is not merely a filing exercise; it guides the design and control of the project.

Patients need understandable information about the original processing, research purpose, data categories, recipients, retention and their rights. The organisation should provide a workable process for access, rectification, erasure, restriction and objection. The process should still work when nobody has documented the link between research data and the source system.

Article 89(2) GDPR permits restrictions of certain rights in research only under its stated conditions and on the basis of Union or Member State law. The restriction must be necessary for the specific research purpose. A research interest or a general reference to confidentiality is not enough.

The project should also explain how findings that may concern an individual will be handled. Whether an individual result is communicated depends on the study design, medical responsibility and applicable law. The decision belongs in the protocol and must be compatible with the protection of the data subjects.

Start with the research protocol and data inventory. Describe the original purpose, new research objective, data categories, population and planned analyses. Mark direct identifiers, special categories, keys and combinations that may make a person identifiable.

Then assess legal bases and roles. Document the Article 6 GDPR basis, the applicable Article 9(2) exception, national special rules, controllers, joint controllers and processors. Record the information given to data subjects and the process for handling their rights.

Finally, prepare a risk analysis or DPIA where required, an Article 89 GDPR safeguard concept, anonymisation or pseudonymisation rules, key management, an access matrix, retention and erasure periods, and rules for partners and publications. Repeat the assessment when the project changes.

We review the research protocol, data inventory, Article 6 legal basis, Article 9 exception, national law, roles, safeguards and the DPIA question. The study protocol, data-flow description, role agreement, planned information documents and anonymisation or pseudonymisation concept support the first assessment. This keeps secondary use focused on the research purpose and the safeguards that purpose requires.