Toward a Balanced Approach? EDPB Guidelines on Processing Personal Data for Scientific Research

On 15 April 2026, the European Data Protection Board (EDPB) adopted the long awaited Guidelines 1/2026 on the processing of personal data for scientific research purposes (Guidelines). The text is currently open for public consultation until 25 June 2026, and will likely be revised on a number of points before being formally finalised. Even in their draft form, however, the Guidelines deserve close attention. They are the most substantive EDPB document on this subject since the entry into force of the GDPR, and they will – once finalised – materially shape supervisory authority practice across the EU. 

While the GDPR allows certain exceptions for the processing of personal data for purposes of “scientific research”, it does not define the term itself.. National legislators, ethics committees and supervisory authorities have filled that gap unevenly, with the result that a regime that is "favourable" to research in principle has been genuinely difficult to navigate in practice. We have written before on some of the resulting tensions, in particular around consent and data donation. 

The Guidelines do not resolve every question, but they go further than any previous EDPB document in setting out how the concept of scientific research should be assessed and how the GDPR's research-friendly provisions should be applied. This blog highlights the elements most likely to matter for organisations carrying out, or contributing to, research projects. 

When does processing qualify as "scientific research"? 

Guidelines provide a structured test for what counts as scientific research within the meaning of the GDPR. The starting point is the principle, drawn from Recital 159, that the concept should be interpreted broadly – covering technological development and demonstration, fundamental research, applied research and privately funded research – but not "stretched beyond its common meaning". Only research that is genuinely scientific benefits from the GDPR's research-specific provisions. 

To operationalise this, the EDPB introduces six key-indicative factors that controllers should assess, taking into account the nature, scope, context and purposes of processing. In the table below, we translate these considerations into a practical checklist.

If all six factors are present, the activity can be presumed to constitute scientific research. If not, the controller bears the burden of justifying and documenting why the activities should nonetheless qualify, and the more factors are missing, the harder that justification becomes.

This is a meaningful step forward. It will help researchers, ethics committees and DPOs distinguish genuine science from activities that merely involve "research" in a loose sense (the Guidelines explicitly use the example of a retailer "researching" customer behaviour for marketing purposes – which does not qualify). Importantly, the EDPB confirms that the test applies regardless of whether the research is conducted by an academic institution, a public body, a non-profit or a commercial company, and regardless of whether it is for-profit or not. This is a useful confirmation for industrial research, public-private partnerships and start-ups operating in life sciences and AI. Furthermore, in a point of particular relevance to the research community, the EDPB also addresses the processing of personal data for inclusion in a database intended for future research activities. 

Presumption of compatibility – but lawfulness still required 

The Guidelines confirm that further processing of personal data for scientific research purposes is presumed to be compatible with the original purpose of processing under Article 5(1)(b) GDPR. A controller that further processes data for research therefore does not have to perform a compatibility test under Article 6(4). 

What the EDPB makes clear, however, is that compatibility and lawfulness are two different questions. The presumption only spares the controller the compatibility assessment; it does not provide a legal basis. The controller must still identify a valid Article 6(1) legal basis for the further processing. In many cases, the controller will be able to rely on the same legal basis as for the original processing – particularly where that basis is public interest (Article 6(1)(e)) or legitimate interest (Article 6(1)(f)). It will, however, often be more difficult to rely on the same basis where the original processing was based on consent or on a specific legal obligation, since these are typically tied to specific purposes. 

When special categories of personal data are involved, the same principle applies: the controller must separately assess which Article 9(2) derogation can be relied on for the further processing. The Article 5(1)(b) presumption does not displace Article 9. 

Consent: broad, dynamic, or both

Consent is one of the most challenging legal bases in the research context, precisely because the GDPR generally requires consent to be tied to specific, identified purposes. We have explored some of the underlying issues in our earlier post on consent in scientific research. The Guidelines confirm and refine the two main techniques that have emerged in practice to address this tension – broad consent and dynamic consent – and clarify when each is appropriate. 

Broad consent to collect and process personal data in a certain area of scientific research is appropriate where the precise purposes of future research are not known at the time of collection, but where the controller can identify a relevant area of research (for example "medical research in oncology" or "sociological research in criminology") or expected research outcome. Data subjects must always what purposes of processing they are consenting to (controllers should also evaluate the reasonable expectations of the data subjects). Broad consent to processing sensitive data is also permitted. Broad consent cannot, however, be a blank cheque: the EDPB confirms that a generic reference to "scientific research" is too vague. 

Controllers relying on broad consent must additionally implement compensating safeguards. The Guidelines list, among others, increased transparency through dedicated information channels (please see more details below) , independent oversight (such as an ethics review board or a data trustee), use and access controls, time-limited validity of consent, and tools that allow data subjects to manage and update their consent over time. 

Dynamic consent, i.e. when data subjects consent to each different individual research project – or part thereof – separately, as soon as the purposes for processing personal data in those projects become known is appropriate where new research projects fall outside the reasonable expectations of data subjects or outside the area for which broad consent was given. In long-term, longitudinal or interactive research, dynamic consent is often the more suitable approach. 

The determination on which consent technique will be used should be documented by the controller. The Guidelines make clear that broad and dynamic consent are not mutually exclusive: a controller can combine them, relying on broad consent at the outset and shifting to dynamic consent when individual projects move beyond the original area. 

A separate but practically important point is the relationship between GDPR consent and ethical or research consent (such as the informed consent forms used in clinical trials). The Guidelines reiterate that these are conceptually distinct: GDPR consent legitimises the processing of personal data, while research consent serves to protect human dignity and autonomy. The two can be combined in a single form, provided the GDPR consent request is clearly distinguishable, but they should not be conflated. 

Other legal basis: public interest and legitimate interest 

For controllers that cannot rely on consent, or that prefer not to, the Guidelines confirm two important points. 

Article 6(1)(e) GDPR (public interest or exercise of official authority) is not limited to public bodies. Private entities can also rely on it, provided their research activities are covered by a Union or Member State legal act. The Guidelines list a number of national laws that provide such a basis for research. This is particularly relevant for public-private research consortia and for private institutes whose activities are framed by a national research statute. 

Article 6(1)(f) GDPR (legitimate interest) is also explicitly available for scientific research, regardless of whether the research is non-profit or commercial. The Guidelines confirm that, in the balancing test, significant weight can be given to the societal value of genuine scientific research. This is a useful clarification, but it is not a free pass: the controller must still document a structured legitimate interest assessment (“LIA”), take into account the reasonable expectations of data subjects, and show that the safeguards under Article 89(1) are in place. Where the safeguards are insufficient to address the identified risks, the controller cannot rely on Article 6(1)(f) and must look for another basis. 

Use of sensitive data for scientific research 

For sensitive data categories, the Guidelines walk through the three derogations under Article 9(2) most relevant for research: explicit consent (Article 9(2)(a)), data manifestly made public by the data subject (Article 9(2)(e)), and Union or Member State law (Article 9(2)(g), (i) and (j)). 

Two practical points are worth noting. First, the EDPB is restrictive on what qualifies as "manifestly made public": there must be a clear affirmative action by the data subject indicating an intention to make the data accessible to the general public. Default settings on a social media platform, or a post by a third party, will generally not suffice. The EDPB is also clear that data made public in one context (e.g. a politician's public statement on policy) does not entail that other categories of data about that person have also been made public. 

Second, the Guidelines confirm that Article 53(1)(e) in the European Health Data Space Regulation (EHDS) provides a derogation under Article 9(2) and can be relied upon for controllers intending to process health data for the purposes of conducting scientific research on the basis of Article 6(1)(f). 

Transparency, attribution of responsibility in collaborative research consortia and appropriate safeguards 

On transparency, the Guidelines emphasise that long-running research projects require ongoing transparency, not just an information notice at the start. Controllers should consider providing dedicated webpages with updates on research project, contact points, privacy dashboards and (where consent is the legal basis) consent receipts. Where the controller does not have direct access to or contact with the data subjects (for example because processing is carried out by a processor or a joint controller) information requests can be handled through the processor or another controller on the controller's behalf.[LC2.1] Other relevant clarifications include examples of the attribution of controller, joint controller and processor roles in collaborative research scenarios, including clinical trials and research consortia. 

The Guidelines also provide examples of appropriate safeguards under Article 89(1) GDPR. These include a range of measures which, depending on the context, should be selected and implemented by the controller to support compliance with the data protection principles, meet the requirements of data protection by design and by default, and ensure that the rights and freedoms of data subjects are protected. In particular, the EDPB refers to: oversight by ethics committees or external review boards, contractual limitations and commitments to data subjects, adherence to ethical rules, professional standards and codes of conduct, use of privacy-enhancing technologies, secure processing environments, federated databases, pseudonymisation and separation of identifiers from research data, measures against re-identification, rules for sharing data with other researchers, researcher qualification and training requirements, confidentiality obligations, and anonymisation or other protective measures when publishing research results. 

What now? 

The Guidelines are a draft. They will be revised on the basis of public consultation feedback, with comments accepted until 25 June 2026. Some of the more contested points (the precise scope of "manifestly made public", the boundaries of broad consent, and the interface with the EHDS and other sectoral instruments) may yet be refined. The interaction with the Digital Omnibus on data, which is currently being negotiated, will also need to be tracked closely. 

That said, the direction of travel is clear. The EDPB is committed to facilitating GDPR compliance for genuine scientific research, while signalling that the research-specific provisions of the GDPR cannot be used as a convenient label for activities that do not meet the substance of scientific research. For organisations active in research, whether academic, public, private or hybrid, this will be the moment to revisit the foundations of their data protection framework: the qualification of activities as scientific research, the choice of legal basis, the consent strategy, the role allocation across partners, and the catalogue of Article 89(1) safeguards. 

If you would like to discuss what the EDPB Guidelines mean for your research activities, or how to align your data protection framework with the GDPR, the EHDS and other relevant instruments, please feel free to reach out to a Timelex lawyer.