Guidelines 1/2026 on processing of personal data for scientific research purposes

Executive summary Scientific research is an important objective in the EU treaties, which state that the Union has the objective of strengthening its scientific and technological bases by achieving a European research area in which researchers, scientific knowledge and tech nology circulate freely, and encouraging it to become more competitive. Many fields of scientific research involve the processing of personal data and such processing has led to important scientific breakthroughs to the benefit of society, not least in the field of medical sciences. Several scientific breakthroughs have been made possible by the advent of new technologies, such as recent advances in artificial intelligence. These technological developments enable researchers to use and analyse data in ways that were not possible only a couple of years ago. While the recent technological developments present many benefits and opportunities for scientific research, they have also revealed risks to fundamental rights and freedoms when processing personal data for scientific research purposes. These risks need t o be managed properly to make sure that personal data are processed responsibly and with respect for personal integrity as well as the private life of individual data subjects. The EU’s commitment to scientific research is reflected in the General Data Protection Regulation (the GDPR). By laying down specific rules and considerations for the processing of personal data for scientific research purposes, the GDPR provides for a framework that enables and facilitates the processing of personal data for scientific research, while safeguarding the fundamental rights and freedoms of data sub jects. The processing of personal data for scientific research purposes has given rise to a number of important and sometimes difficult questions from controllers, processors and supervisory authorities on how the GDPR should be interpreted and applied. To bring more clarity and guidance for researchers, the European Data Protection Board (the EDPB) decided that it was necessary to issue the present guidelines. This is also in line with the EDPB’s commitment in the Helsinki statement, where the EDPB set out to fac ilitate easier GDPR compliance. The most important questions addressed in the present guidelines are listed below : Concept of scientific research : Only research that is genuinely scientific benefits from the specific rules applying to processing of personal for scientific research purposes in the GDPR. To help determine if the processing of personal data is carried out for scientific research within the meaning of the GDPR, the guidelines pr esent six key - indicative factors that should be considered, in addition to the nature, scope, context and purposes of processing. If the research activities meet these six factors, they can be presumed to constitute scientific research. If the research activities do not meet all factors, the controller needs to justify and be able to demonstrate why the activities should be considered scientific research, within the meaning of the GDPR ( section 2 ). Presumption of compatibility : Further processing for scientific research purposes is presumed to be compatible with the initial purpose for collecting the personal data. Therefore, 2 | Adopted - version for public consultation a controller that further processes personal data for scientific research purposes does not have to do the purpose compatibility test under the GDPR. However, the controller must still check if the processing is lawful. When doing this check, it is often p ossible to rely on the same legal basis that applied for the initial processing ( section 3.1 ). Storage limitation : Controllers can store personal data for scientific research purposes for longer periods of time, even if the original purposes for processing the data have been fulfilled. For example, if the initial research results give rise to future research projects that require additional processing of personal data, it may be permitted to store the personal data for such projects ( section 3.2 ). Consent : Where the purposes of research are not fully known at the time of collecting the personal data, it is possible for controllers to rely on the consent of a data subject to collect and process personal data in a certain area of scientific research (so - call ed broad consent ). To rely on broad consent, the controller should process personal data in accordance with ethical standards for scientific research and put additional safeguards in place to compensate for the lack of purpose specification. Controllers can also ask data subjects to consent to different individual research projects, or parts thereof, separately, as soon as the purposes of those projects become known (so - called dynamic consent ). A combination of both approaches to consent is also possible ( section 4.1.2 ). Public interest or exercise of official authority : Relying on performance of a task carried out in the public interest, or exercise of official authority, as a legal basis is not limited to public entities conducting scientific research. Private entities may also rely on that legal basis, if the legal ac t in question covers their activities ( section 4.2 ). Legitimate interest : Scientific research can be a legitimate interest under the GDPR, regardless of whether the research is undertaken on a non - profit or commercial basis. A controller that intends to process personal data for scientific research purposes on the basis of leg itimate interest can often attribute significant weight to the processing of personal data for scientific research purposes when applying the balancing test. This is because genuine scientific research is considered to be an important activity that is bene ficial for the whole of society ( section 4.3 ). Special categories of personal data : Union or Member State law can authorise the processing of special categories of personal data. The legal act must provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject. Member State law may also impose further conditions or limitations for the processing of genetic, biometric, or health data. Such laws may be relevant for controllers when processing personal data for scientific research purposes ( section 4.4.3 ). If no Union or MS law permits the processing of special categories of personal data for a given scientific research purpose, then controllers can instead ask for the explicit consent of data subjects. Consent to processing of special categories of personal data can be broad or dynamic ( section 4.4.1 ). It can also be possible to process special categories of personal data that were manifestly made public by the data subject, for example on social media ( section 4.4.2 ). 3 | Adopted - version for public consultation Transparency : If controllers process personal data for long periods of time for scientific research purposes, then they should adopt appropriate measures to ensure transparency during the entire processing period. Controllers should also provide updates to data subjec ts if there are changes to the processing. The obligation to provide transparency also applies if the controller does not have access to any personal data or any contact with the data subject, for example if the processing is done by a processor. In such c ases, the processor may be the one that gives information to the data subjects or replies to information requests on the controller’s behalf, if requested to do so by the controller ( section 5 ). Right to erasure: Data subjects have a right to have their personal data erased, but the GDPR provides for exceptions from this right. There is a specific exception for situations where the processing is necessary for scientific research purposes. This exception only appli es if the right to erasure is likely to render impossible or seriously impair the objective of conducting scientific research and if the controller has adopted appropriate safeguards ( section 6.2.2 ). Right to object : Data subjects have the right to object to the processing of their personal data, but there are limitations to this right when personal data are processed for scientific research purposes. Controllers may reject an objection, if the processing is necessar y for the performance of a task carried out for reasons of public interest under Union or Member State law. This includes cases where a legitimate interest pursued by the controller or a third party coincides with a public interes t ( section 6.3 ). Attribution of responsibility : Where several entities are involved in the processing of personal data for scientific research purposes, it is necessary to assess and document how responsibility is allocated among the entities. This is particularly relevant when multiple actors are involved in the drafting of a scientific research protocol or in the case of a public - private partnership . The determination of roles is important to ensure accountability and compliance of the entities involved in the processing of personal data and to determine towards which entity data subjects can exercise their data protection rights ( section 7 ). Appropriate safeguards : Controllers must adopt appropriate safeguards for the rights and freedoms of data subjects when they process personal data for scientific research purposes. In line with the principle of data minimisation, anonymised - or alternatively pseudonymised data - should be used for scientific research, as long as the purposes of processing can be fulfilled using such data. The processing of personal data that can be used to directly identify a person is only allowed where it is strictly necessary and proportionate to achieve the purposes of the scientific research. Depending on the nature, scope, context and purposes of processing, it may be necessary to also apply other safeguards than anonymisation or pseudonymisation of personal data. Such safeguards can be independent or ethical oversight, secure processing environments, privacy enhancing technologies, protective measures for publication of research results, confidenti ality arrangements, conditions for further use, etc. ( section 8.3 - 8.5 ). 4 | Adopted - version for public consultation 6 | Adopted - version for public consultation The European Data Protection Board Having regard to Article 70 (1)(e) of Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repea ling Directive 95/46/EC, ( the GDPR), Having regard to the E uropean E conomic A rea (the EEA) Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , Having regard to Article 12 and Article 22 of its Rules of Procedure, Has adopted the following Guidelines 1 Introduction 1. Scientific advancement, promotion of scientific research and the establishment of a European research area are objectives laid down in the EU’s founding treaties 2 . Furthermore, Article 13 of the Charter of Fundamental Rights of the European Union ( the CFREU) 3 provides that scientific research shall be free of constraint and academic freedom shall be respected. The EU’s commitment to scientific research is also reflected in both the provisions and recitals of the General Data Protection Regulation ( the GDPR), that apply when processing personal data for scientific research purposes 4 . 2. The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU 5 . 3. The EDPB recognises that the processing of personal data in the area of scientific research is diverse and complex, not least as there are many different actors, fields of research, types of data and categories of data subjects involved, as well as differe nt technologies and methods used to collect and process data. Accordingly, the EDPB decided to issue these guidelines on the interpretation and application of the provisions in the GDPR that are specific to or of particular relevance when processing person al data for scientific research purposes. 1 References to ‘Member States’ (MS) made throughout this document should be understood as references to ‘European Economic Area (EEA) Member States’. 2 Cf. Article 2(3) Consolidated version of the Treaty on European Union (TEU) (OJ C 326, 26.10.2012, p. 13); Article 179 Consolidated version of the Treaty on the Functioning of the European Union (TFEU) (OJ C 326, 26.10.2012, p. 47). 3 Charter of Fundamental Rights of the European Union (CFREU) (OJ C 326, 26.10.2012, p. 391). 4 Recitals 33, 50, 52, 53, 62, 65, 113, 156, 157, 159, 160, 161 and 162 and Articles 5(1)(b) and (e), Article 9(2)(j) and (4), 14(5)(b), 17(3), 21(6) and 89 GDPR. 5 Recital 4 GDPR; Recital 32 in Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regard s the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus) (COM(2025) 837 final). 7 | Adopted - version for public consultation 4. The GDPR does not exhaustively harmonise the requirements for the processing of personal data for scientific research purposes. Accordingly, the EDPB underlines that there is ample room left to, and consequently a need for, complementary Union and Member S tate (MS) law. The application of such laws is not addressed in the current guidelines 6 . 2 The scope of the concept ‘processing of personal data for scientific research purposes’ 5. As stated in the previous section, conducting scientific research is a fundamental freedom under EU law and the GDPR includes several provisions that apply specifically to the processing of personal data for scientific research purposes. If a controller in tends to apply those provisions, then it must substantiate and be able to demonstrate that the purpose for processing personal data is to carry out scientific research 7 . 6. While the EDPB is aware that no universally agreed definition of scientific research exists, it is nonetheless necessary to clarify the concept of processing of personal data for scientific research purposes , in the meaning of the GDPR 8 . 7. Recital 159 GDPR provides that: “[for] the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privatel y funded research. In addition, it should take into account the Union's objective under Article 179(1) TFEU of achieving a European Research Area. Scientific research purposes should also include studies conducted in the public interest in the area of public health .” 8. Furthermore, the GDPR recognises that research using personal data in registries can provide knowledge and results that can “ improve the quality of life for a number of people and improve the efficiency of social services ” 9 . 9. While the concept of scientific research should be interpreted in a broad manner, it “ may not be stretched beyond its common meaning ”. Therefore, the EDPB has previously stated that : “‘scientific research’ […] means a research project set up in accordance with relevant sector - related methodological and ethical standards, in conformity with good practice ” 10 . In other words, the concept of scientific research purposes in the GDPR covers processing of personal data in research activities that are genuinely scientific . 6 In so far as Union or MS laws provide for legal bases for the processing of personal data for scientific research purposes, under Article 6(1)(e) GDPR, see further in section 4.2 . On derogations under Article 9(2)(g), (i) or (j) GDPR, see further in section 4.4.3 . 7 In accordance with the principle of accountability, pursuant to Articles 5(2) and 24(1) GDPR. 8 The EDPB underlines that the term scientific research purposes in the GDPR should be given an autonomous and uniform interpretation in EU law. Cf.: Judgement of 6 February 2003, Stichting ter Exploitatie van Naburige Rechten (SENA) v Nederlandse Omroep Stichting (NOS) , C - 245/00, EU:C:2002:543, para. 23. 9 Recital 157 GDPR. Such registries can for example be data sets with patient records, in the field of medical research, or databases with information about welfare payments in the field of social sciences. 10 EDPB Guidelines 05/2020 on consent under Regulation 2016/679 (Guidelines on consent) (Version 1.1, 04.05.2020) para. 153. 8 | Adopted - version for public consultation 10. Other sources describing scientific research activities emphasise different elements, such as the aim to acquire new knowledge, systematic and methodical research, the role of the entities and the qualifications of persons involved in research, adherence t o scientific methodology and ethical standards and dissemination of research results 11 . Like the GDPR, other sources underline that scientific research can be conducted by both public and private entities and that it may be conducted for profit 12 . 2.1 Key - indicative factors for determining whether processing of personal data is motivated by scientific research purposes 11. While neither the GDPR nor the sources referred to above reveal a unitary or finite definition of scientific research , they present some common elements which can serve as key - indicative factors . Controllers should give particular importance to these key - indicative factors, as listed below, when determining whether processing of personal data is motivated by scientific purposes or not, taking into account the nature, scope and context of processi ng: i. Methodical and systematic approach The research activities, including formulation and testing of a hypothesis 13 , are conducted following a methodical and systematic approach of the relevant research field, for example in accordance with a comprehensive research plan. If the research is exploratory or in a preliminary stage, the research may have a stated objective as opposed to a hypothesis. ii. Adherence to ethical standards The research activities are conducted in adherence to ethical standards in the relevant research field 14 . Ethical standards are intended to prevent individuals from being subjected to harm or other adverse effects due to participating in scientific research 11 See, inter alia : Recital 25 of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (E U) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (OJ L, 2024/1689, 12.7.2024); Annex I of Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual - use items (OJ L 206, 11.6.2021, pp. 1); Article 2 (1) of Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC, OJ L 2019 130, p. 92); Article 3(1)(b) Digital Omnibus; ALLEA, The European Code of Conduct for Research Integrity (ECCRI) (Revised Edition 2023); Uni ted Nations Special Rapporteur on the Right to Privacy, Recommendation on the protection and use of health - related data (05.12.2019) p. 7 - 8; Frascati Manual 2015 – Guidelines for Collecting and Reporting Data on Research and Experimental Development (OECD , 2015) (Frascati Manual 2015) paras. 2.26, 2.6 and 2.7 as well as Annex 2 - Glossary of terms; Explanatory Report to the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223) p ara. 50; Council Recommendation of 18 December 2023 on a European framework to attract and retain research, innovation and entrepreneurial talents in Europe (OJ C, C/2023/1640, 29.12.2023) paras. 1 - 2. 12 UN Recommendation on the protection and use of health - related data, p. 9; OJ C, C/2023/1640, para. 2; Preamble to ECCRI, page 4. 13 ECCRI, p. 2.2; Frascati Manual 2015, p. 2.26. 14 Guidelines on consent, para. 153; ECCRI, p. 2.2 and 2.4. 9 | Adopted - version for public consultation and include – among other things – the respect for human autonomy and the concept of consent to participate in research 15 , transparency, accountability and oversight 16 . iii. Verifiability and transparency The research activities aim to achieve verifiable results and the conduct of research allows the hypotheses, methods, data and conclusions to be open to criticism, normally following peer review. 17 The results of the research are shared with other parties, for example by publication, or will be shared in the future, with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets . iv. Autonomy and independence The research activities are conducted autonomously and independently in relation to the prejudices of the scientific community and other external parties, as well as the researcher’s own prejudices, in an environment free from undue pressures 18 . This means that the research team has the freedom to define research questions, identify methods by which problems are solved, choose and develop scientific theories, as well as the freedom to disseminate and publish the results of their research 19 . T he researchers processing the personal data have academic (e.g. a PhD title) or scientific qualifications (e.g. proven experience or recognition) in the relevant field of research 20 . This applies r egardless of whether the research activities are carried out by an academic institution, non - profit organisation, public institution or a for - profit organisation (such as a commercial company or a start - up) . The research can also be conducted under the supervision of qualified researchers . The research team is transparent about any assumptions or values that may influence their research and the robustness of scientific evidence, including any remaining uncertainties and knowledge gaps. 15 See: World Medical Association (WMA) Declaration of Helsinki – Ethical Principles for Medical Research Involving Human Participants (18 th WMA General Assembly, Helsinki, Finland, June 1964, last amended by the 75th WMA General Assembly, Helsinki, Finland, October 2024) p. 25; See also: Article 5 of the Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine (ETS No. 164, Oviedo 4.4.1997); On consent to participate in scientific research, see further in section 4.1.3 ; While informed consent of the research participants has generally been required in the field of medical research involving human subjects for some time, it is now also commonplace also in other fields of scientific research. See, for example: European Co mmission, Ethics in Social Science and Humanities (5.7.2021) p. 13p. 16 EDPS, A Preliminary Opinion on data protection and scientific research (6.1.2020) p. 13. 17 ECCRI, p. 2.3; EDPS, A Preliminary Opinion on data protection and scientific research, p. 10. 18 ECCRI, p. 2.1. 19 ECCRI, p. 2.1 and 2.3; Cf. also: Pillar 1 Point 2 of the European Charter for Researchers (Annex II OJ C, C/2023/1640, p. 1640): “ Limitations to the freedom of scientific research can arise because of particular research circumstances – including supervision/guidance/management – or legal or operational constraints, e.g. intellectual property rights, budgetary or infrastructural reas ons ” ; The EDPB notes that the results of research should be published or otherwise spread without interference with the data subjects’ right to private life and protection of personal data. Publication of directly identifia ble personal data would normally only b e appropriate in certain fields of scientific research, for example publishing personal data on public figures such as politicians in the course of political science (see further in section 4.4.2 ), or if the data subject has consented to the publication of results. 20 ECCRI, p. 2.2. 10 | Adopted - version for public consultation v. Objectives of the research The research activities are carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing 21 . This does not exclude that the research may also aim to further commercial interests. vi. Potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways The research activities are merited, as they have the potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways 22 . The scientific merits of the research can be subject to assessment, review or approval by independent experts or committees 23 , for example when applying for a research grant or when applying for authorisation to market certain products that involve elements of scientific evaluation 24 . 12. If the research activities under assessment meet all of the factors in para. 11, they can be presumed to constitute scientific research. If the research activities do not meet all factors, the controller needs to justify and be able to demonstrate why the activities should nonetheless be considered scientific research, within the meaning of the GDPR. When doing such an assessment, the more key - indicative factors are present, the more likely it is that the activities constitute scientific research within the meaning of the GDPR. Example 1 : Processing of personal data for scientific research purposes A pharmaceutical company is developing a new pharmaceutical intended to combat a rare disease. To explore the potential side effects, the pharmaceutical company initiates a clinical trial. While the pharmaceutical is developed by a commercial company, the purpose of the clinical trial is also to further the scientific knowledge of the rare disease in question and improve the quality of life of patient suffering from the disease. To this end, the research activities carried out within the scope of the clinic al trial correspond to factor v (objectives of the research). The pharmaceutical company hires a team of academically qualified and vetted researchers to carry out the scientific research activities necessary to conduct the trial. This corresponds to factor i v ( independence and autonomy ). The research team selects a number of patients suffering from the disease in question to participate in the trial as research participants. These patients’ personal data will be processed during the course of the trial. To conduct the trial, the researcher s draw up a research plan, following the rules of good clinical practice (GCP) that will be reviewed by an ethical committee. In so far as the clinical trial will be conducted in accordance with the 21 When assessing the contribution to the growth of society´s collective knowledge and wellbeing, controllers should consider reviews of the scientific merit of their research projects that, for example, can have been undertaken by independent review bodies. 22 To assess this factor, controllers should have recourse to the goal of the research, as stated in the research or project pla n. 23 ECCRI, p. 2.8. 24 An example is this regard is Annex 1 Module 5 p. 5.2 of Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the Community code relating to medicinal products for human use (OJ L 311, 28.11.2001, p. 67), which provides that “[ the ] clinical particulars to be provided […] must enable a sufficiently well - founded and scientifically valid opinion to be formed as to whether the medicinal product satisfies the criteria governing the granting of a marketing authorisation .” 11 | Adopted - version for public consultation research plan, this indicates that researchers are following a methodical and systematic approach in adherence to ethical standards, corresponding to factors i and ii. The research activities are expected to generate new scientific knowledge, and the results of the trial will be published in a scientific journal. Accordingly, the research activities correspond to factors iii (verifiability and transparency) and v i ( potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways ). For these reasons, the clinical trial and the associated processing of the research participants’ personal data can be deemed to be conducted for scientific research purposes under the GDPR. Example 2 : Processing of personal data for scientific research purposes GSPM AI GmbH is a start - up company that conducts research and development in the field of generative AI and is looking to conduct research on the topic of bias in generative AI models. To do so, GSPM AI intends to apply for funding for its research from a foundation which provides funding in various fields of technological research. The conditions for funding include that research projects must use established scientific methods, be subject to ethical review and the results of the research must be made publ icly available. The choice of scientific method, formulation of hypotheses etc. is to be determined by the researchers applying for sponsorship. In so far as the intended research fulfils the conditions for funding, the research activities will correspond to factor i (methodical and systematic approach) as well as factor iv (autonomy and independence). GSPM AI partners with a university faculty that conducts research in the field of robotics and AI and that is looking to get involved in research concerning bias in generative AI models. By doing so, the research project will include qualified researchers, in line with factor i v ( autonomy and transparency ). The company and the university set up a joint research group that starts to plan for the research project, applies for sponsorship and submits to review by the university’s ethical board, which is composed of independent experts. Subjecting the research pr oject to ethical review corresponds to factor ii (adherence to ethical standards). The joint research group is granted sponsorship. Having successfully completed the project, GSPM AI and the university faculty publish a peer - reviewed paper, in line with factor iii (verifiability and transparency). By sharing the research results through publication, the research projects benefit the larger research community, while not excluding commercial use of the results by GSPM AI. Therefore, the research activities correspond to factor v (objectives of the research). In sum, the processing of personal data within the scope of the research project takes place for scientific research purposes, in the meaning of the GDPR. 12 | Adopted - version for public consultation Example 3 : Processing of personal data not considered as motivated for scientific research purposes A retail company analyses their sales data of online customers, to get insight in the different categories of customers (target groups), what purchases they make, their frequency of website visits and how many customers are returning to their webpage on mo re than one occasion. The company intends to use the analysis to inform their marketing strategy. The research does not aim to achieve verifiable results and the results are not shared with any other parties. The results of the analysis do not have any apparent potential to contribute to existing scientific knowledge or apply such knowledge in novel wa ys. It is also not carried out by independent and autonomous researchers, but by marketing experts within the company. The aim of the research is solely concerned with furthering the commercial interests of the company and is not carried out with the aim o f contributing to the growth of society´s collective knowledge and wellbeing. Nor is the research subject to independent review. Considering that the research does not trigger the key - indicative factors, it does not qualify as scientific research in the meaning of the GDPR and the associated processing of personal data cannot be considered to be conducted for scientific research pur poses. 2.2 Research data infrastructures 13. Personal data may be processed in a research data infrastructure 25 (also referred to as a research repository or database) for the purposes of making the data available for future research projects within a specific area of research 26 . The processing of personal data within the scope of a research infrastructure may be motivated by scientific research purposes, within the meaning of the GDPR. To determine whether this is the case, a controller should assess the relevant processing oper ations that are necessary for operating the research infrastructure in light of the factors listed at para. 11 . For example, the entity that decides on the operation of the infrastructure, or a legislator, may establish criteria that determine which research data should be collected and for which types of research projects access to the data should be granted. Acc ess to research data will typically be limited to projects in certain fields of research. Moreover, conditions on access to data could require that researchers have fulfilled certain academic or scientific qualifications, or that researchers that request a ccess to special categories of data should adhere to ethical standards, relevant to the concerned field of research. 25 See, for example: Article 2(1) Regulation (EU) 2021/695 of the European Parliament and of the Council of 28 April 2021 establishing Horizon Europe – the Framework Programme for Research and Innovation, laying down its rules for participation and dissemina tion, and repealing Regulations (EU) No 1290/2013 and (EU) No 1291/2013 (J L 170, 12.5.2021, p. 1) and Article 2(a) Council Regulation (EC) No 723/2009 of 25 June 2009 on the Community legal framework for a European Research Infrastructure Consortium (ERIC ) (OJ L 206, 8.8.2009, pp. 1). 26 On the concept of a specific area of research , see further in section 4.1.2.1 . 13 | Adopted - version for public consultation Example 4 : Processing of personal data for scientific research purposes in a research infrastructure A public agency responsible for monitoring the quality of education has a statutory task to make personal data on pupils available for scientific research projects. Data can be disclosed to support the agency’s tasks, but also for research projects being undertaken by external researchers. The law determines which types of personal data can be disclosed, namely personal data such as grades and gender. The public agency also has access to and can disclose individual diaries on the behaviour and well - being of pupils, noted down by teachers and other staff (such as school nurses) for the stated purposes. Public and private schools submit data in a pseudonymised format to the agency and the data is also stored in this format in a secure environment with access controls. The law also provides the conditions for access of the pseudonymised data in a secure processing environment. Accordingly, a researcher can apply with an individual research project for approval to get access to the personal data stored in the database kep t by the public agency. To be approved, the research project must have a sufficiently detailed research plan outlining which data is to be used and for what purposes. This fulfils factors i (methodical and systematic approach) and v (objectives of the rese arch). Moreover, the research must be conducted by qualified researchers, in line with factor i v ( autonomy and independence ). In addition, the results of the research must be made available to the general public, fulfilling factor iii (verifiability and transparency). To protect data subjects, the staff working for approved research projects must commit to confidentiality agreements and can only access the data remotely, through a secure processing environment without the possibility to download personal data from that environment. It is, however, possible to download aggregated data that does not contain any personal data. If a researcher wants to access special categories of personal data for a research project, such as data on the health or mental well - being of pupils – pursuant to Article 9(2) of the GDPR – then it also needs ethical approval, in line with factor ii (adherence to ethical standards). Considering that the conditions for accessing the database trigger several of the factors listed above, the processing of personal data related to the management and provision of research data can be deemed to be conducted for scientific research purposes, in the meaning of the GDPR. 2.3 Ancillary processing operations 14. Not only processing operations undertaken within the scope of research projects or research infrastructures may be motivated by scientific research purposes, but also other processing operations that are ancillary to scientific research projects. Ancillary processing operations can be processing operations in the preparatory step of research, for example processing contact details of individuals in order to identify potential research subjects (e.g. patients, pupils, persons receiving social welfare etc.). Other potential ancillary processing operations 14 | Adopted - version for public consultation relate to the management of the research data as such and include (but are not limited to) identification of relevant data, data extraction, filtering, grouping, curation and categorisation of personal data 27 . Anonymisation or pseudonymisation of personal data prior to the processing of personal data in individual research projects may also be motivated by scientific research purposes 28 . 15. Ancillary processing operations should have a clear scientific research objective, which must be assessed on a case - to - case basis in light of the factors listed at para. 11 , in order for those processing operations to be considered motivated by scientific research purposes. 27 Curation and categorisation refer to the ordering of data contained in datasets that are to be used for scientific research purposes, including sorting and labelling data as well as deleting categories of personal data that are not necessary for the scien tific research purposes. 28 See further in section 8.3 . 15 | Adopted - version for public consultation Example 5 : Ancillary processing operation for scientific research purposes A research institute intends to create a panel of respondents whose answers will reflect the opinions on current events of the general population. The purpose of creating the panel is to enable scientific research projects, that would be considered motivat ed by scientific research purposes under the GDPR, in a number of academic fields of social sciences, where the opinions of data subjects is a necessary data point. The institute has access to certain geographical and population data via a registry maintained by a public body tasked by national law with statistical research and provision of aggregated as well as non - aggregated statistical data for, inter alia, scienti fic research. Via this registry, the research institute can enter queries to get a random representative selection of potential respondents in different geographical areas, on the basis of certain pre - established criteria (e.g. number of residents per hous ehold, income levels in the different geographical areas, types of buildings). The research institute sends out invitation letters to the potential members of the panel, using the addresses to the households it has received from the public body. Data subjects can decide to participate in the panel by answering the letter or by fillin g out a form on the webpage of the research institute. Personal data of data subjects who do not respond will be deleted after a predetermined period of time. To protect the personal data of panellists, the research institute provides a platform through which individual researchers can construct surveys and pose questions to the panellists, provided that their research projects fulfil certain conditions. While t he identities of the panellists are known to the research institute, their personal data – in the form of answers to surveys – is pseudonymised when provided to the researchers, who also do not get any contact details to the panellists. Moreover, data subj ects can at any time stop their participation in the panel, and request to have their data erased. When access to personal data from the panellists is provided or when researchers utilise the panel and process personal data for the conduct of scientific research projects, the processing operations associated with the use of the panel can be considered t o be for scientific research purposes, within the meaning of the GDPR. 3 Data protection principles (Article 5 GDPR) 16. Section 3 firstly addresses the distinction between the processing of personal data for scientific research purposes as the primary purpose of processing, and the further processing of personal data that was initially collected for another purpose than scientific research (or for another scientific research purpose). Secondly, section 3 addresses the presumption of purpose compatibility contained in Article 5(1)(b) of the GDPR, when further processing of personal data is carried out for scientific research purposes. Thirdly, section 3 addresses the principle of storage limitation , and how it applies when personal data is processed for scientif ic research purposes. 16 | Adopted - version for public consultation 3.1 Purpose limitation (Article 5(1) GDPR) 17. If a controller collects personal data to process it for a specific scientific research purpose, then the research purpose is considered to be the primary purpose of processing. If a controller subsequently wants to process that personal data for another scientific research purpose that is not covered by the primary purpose, such processing is considered to be further processing for another purpose . If a controller initially collects and processes personal data for non - scientific purposes , but later on deci des to process the personal data for scientific research purposes, this is considered further processing for scientific research purposes . 18. Personal data can also be collected for several purposes, amongst which one of the purposes can be scientific research. In such situations, the scientific research purpose is also considered to be a primary purpose of processing. 3.1.1 Presumption of purpose compatibility 19. Under Article 5(1)(b) GDPR, further processing for scientific research purposes is presumed to be compatible with the initial purpose(s) of the processing 29 . Therefore, when further processing personal data for scientific research purposes it is not necessary to undertake the compatibility test, pursuant to Article 6(4) GDPR 30 . However, the compatibility test should be undertaken if the primary purpose of processing is scientific research, but the further processing of personal data is done in pursuit of another purpose than scientific research 31 . 20. While Article 5(1)(b) GDPR only refers to the purposes of processing, recital 50 also addresses the lawfulness of processing and states that: ”[…] the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a c ase, no separate legal basis from that which allowed the collection of the personal data is required […] Further processing for […] scientific research purposes […] should be considered to be lawful processing operations .” 21. In this regard, the EDPB has previously stated that under certain conditions, and provided that appropriate safeguards have been adopted pursuant to Article 89(1) GDPR, a controller may be able to rely on the legal basis for the initial processing operatio ns when further processing personal data for scientific research purposes 32 . However, the EDPB and the EDPS have also stated that the question of compatibility of purposes should not be confused 29 Article 5(1)(b) GDPR: “ Personal data shall be […] collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for […] scientific […] research purposes […] shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes .”. See also proposed Recital 29 and Article 3(2) Digital omnibus. 30 Nonetheless, the controller must still adopt appropriate safeguards, in line with Article 89(1) GDPR. See further in section 8 below. 31 Unless the purpose for further processing is archiving in the public interest, historical research or statistical purposes, w hich also benefit from the presumption of purpose compatibility. 32 EDPB, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70.1.b)) (23.1.2019) para. 31. 17 | Adopted - version for public consultation with principle of lawfulness 33 . Therefore, the possibility to rely on the legal basis that the initial processing was based on requires an assessment of lawfulness to determine that this legal basis is also suitable to rely on for the further processing of personal data for scientific research purpose s. 22. In many cases controllers will be able to rely on the same legal basis, for example where a controller initially processed personal data on the basis of public or legitimate interest 34 . It is, however, not always possible to rely on the same legal basis when further processing personal data for scientific research purposes. This applies in particular if the initial legal basis for the primary processing is consent or a legal obligation 35 . 23. If a controller considers that further processing for scientific research purposes could be based on Article 6(1)(f) GDPR, the significant societal interest of conducting scientific research, as also reflected by the presumed compatibility of processing fo r scientific research purposes, carries significant weight in the balancing test in relation to the data subjects’ interests or fundamental rights or freedoms 36 . Example 6 37 : Further processing of personal data for scientific research purposes A private research institute collects publicly accessible personal data from social media and uses this data in a scientific research project to analyse the use of a particular dialect in written language. Following a risk analysis and having implemented a ppropriate safeguards, the research institute determines that it can rely on a legitimate interest, pursuant to Article 6(1)(f) GDPR, to collect the data. Having concluded the research project, the research institute wishes to further use the collected data to develop an app for use in another research project. The purpose of the app is to support individuals speaking the dialect with improving their spellin g when writing in dialect, and then for the research institute to use that data to conduct research on the improvement of writing skills over time. The research institute does not have to undertake the compatibility test, pursuant to Article 6(4) GDPR, as the further processing of the personal data gathered in the first research project is presumed to be compatible with the original purposes of proces sing, in line with Article 5(1)(b). 33 EDPB - EDPS Joint Opinion 2/2026 On the Proposal for a Regulation as regards the simplification of the digital legislative framework (10.02.2026) para. 32. 34 Articles 6(1)(e) and (f) GDPR respectively. See further in sections 4.2 and 4.3 . 35 A change of purpose could be contradictory to the specificity of consent or the scope of the legal obligation. For example, i f further processing of personal data for scientific research purposes would exceed the boundaries of an initial consent obtain ed from a data subject, then the controller would need to obtain consent for the further processing, or determine another legal basis that it can rely on. In this regard, it should be noted that controllers may, provided that additional safeguards are a dopted , obtain consent for processing of personal data that covers an area of scientific research. Such consent may include several processing operations in different research projects by several controllers. See further in section 4.1.2.1 . 36 See further at para. 61 . 37 See also the E xample 10 , where a controller relies on performance of a contract (Article 6(1)(b) GDPR) for the initial processing, but legitimate interest (Article 6(1)(f)) for the processing of personal data for scientific research purposes. 18 | Adopted - version for public consultation The research institute assesses the lawfulness, pursuant to Article 6(1)(f) GDPR, for the further processing of the collected personal data. When doing so, the institute considers the societal interest of the research and the presumed compatibility of the further processing in the balancing test and concludes that it can use the data to develop the app in question. 24. If a controller further processes special categories of personal data, pursuant to Article 9(1) GDPR, for scientific research purposes, it may also rely on the presumption of compatibility of purposes, pursuant to Article 5(1)(b). Nevertheless, the controller must still assess which derogation to the prohibition to process special categories of personal data, pursuant to Article 9(2) GDPR, that applies when further processing such data for scientific research purposes 38 . Accordingly, if the controller intends to rely on the same derogation, pursuant to Article 9(2) GDPR, that it relied on for the initial processing operation, then the controller must assess whether that derogation is also suitable for the further processi ng of personal data for scientific research purposes 39 . 25. When the controller further processes personal data concerning health, genetic or biometric data, it should also consider that there may be additional conditions or limitations imposed by MS law on the processing, pursuant to Article 9(4) of GDPR, also in cases of further processing for scientific research purposes. 3.1.2 Further processing when providing personal data to another controller for scientific research purposes 26. If a controller (controller A) wishes to, or is obliged by Union or MS law, to provide personal data to another controller (controller B), and controller B intends to process the data for its own scientific research purposes, the provision of personal data by controller A will be considered further processing if it was not one of the primary processing purposes when the personal data was collected. When providing personal data to another controller for scientific research purposes, neither the providing (co ntroller A) nor receiving controller (controller B) needs to undertake a compatibility assessment, pursuant to Article 6(4) GDPR 40 . 3.2 Storage limitation (Article 5(1)(e) GDPR) 27. Under the principle of storage limitation 41 , a controller collecting personal data for scientific research purposes must determine for how long the personal data will be processed or, if that is not possible, the criteria used to determine that period. The controller must also inform 38 See further in section 4.4 . 39 EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research (2.2.2021) para. 22. 40 Both controllers must still comply with all relevant obligations of the GDPR including, inter alia, determining an appropriat e legal basis under Article 6(1) GDPR and, when applicable, which derogation under Article 9(2) GDPR that it can rely on to proces s special categories of personal data, as well as if any additional conditions or limitations pursuant to Article 9(4) GDPR apply. 41 Article 5(1)(e) GDPR: “ Personal data shall be […] kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for […] scientific […] research purposes […] in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject […]” 19 | Adopted - version for public consultation the data subjects on this matter 42 . Storage of personal data following the conclusion of a research project will typically be justified as long as it is necessary to retain the data in order to verify or scrutinise research results, for example within the scope of a peer review process or in accordance with scientific standards for retention. The storage period must be determined by the controller before the personal data are processed 43 . In this regard, controllers should consider and inform data subjects about possible uncertainties regarding the exact duration of the scientific research activities, for example when undertaking longitudinal research projects. 28. Article 5(1)(e) lit 2 GDPR permits controllers to store personal data if the data is intended to be further processed for specific scientific research purposes, even if the original purposes for processing the data have been fulfilled and regardless of whe ther the original purposes were scientific research or not. For example, if research results give rise to future research projects that require additional processing of personal data in future research projects, it may be permissible to store the personal data for such projects. 29. If it is not possible to specify the purposes of a future research project at the time of storage, specifying potential research in a certain area of research can suffice 44 . However, in line with the principle of purpose limitation that requires the purpose of processing to be specific, storage for generic scientific research purposes without any specification of purpose cannot be justified with reference to Article 5(1)(e) GDPR. Moreover, the future scientific research activities should be reasonably foreseeable in relation to the relevant scientific field of research, taking the nature, scope, context and purposes of the envisaged processing operations into account. This means that the controller should substantiate how it intends to use the personal data in future scientific research projects, although it should not be required to draft a complete research plan. 30. Furthermore, controllers storing personal data for scientific research purposes must evaluate which categories of personal data are necessary to retain for presumptive future research projects, in line with the principles of purpose limitation and data min imisation, pursuant to Article 5(1)(b) and (c) GDPR 45 . When doing the necessity assessment as part of this evaluation, controllers should take due regard to elements that may give rise to risks to data subjects, such as processing of special categories of personal data, pursuant to Article 9(2) GDPR 46 . 31. Controllers storing data in accordance with Article 5(1)(e) lit 2 GDPR must also adopt appropriate safeguards, pursuant to Article 89(1) GDPR 47 . In particular, when controllers store personal data for prolonged periods of time, they must regularly review the necessity of storing personal data – including in which format the data should be retained (i.e. whether 42 Article 13(2)(a) and 14(2)(a) GDPR. 43 Article 25(1) GDPR. 44 On the concept of a specific area of research see further in section 4.1.2.1 . 45 Case C - 77/21, paras. 52 - 59. 46 Judgment of 1 August 2022, OT v Vyriausioji tarnybinės etikos komisija , C - 184/20, EU:C:2022:601, para. 99. 47 See further in section 8 . 20 | Adopted - version for public consultation the personal data should be anonymised or pseudonymised) – in light of the envisaged further processing for scientific research purposes. 4 Lawfulness (Articles 5(1)(a), 6(1) and 9 of the GDPR) 32. Before a controller starts processing personal data, it must determine which is the appropriate lawful basis for the envisaged processing 48 . The main legal bases that are relevant for the processing of personal data for scientific research purposes are consent (Article 6(1)(a) 49 ), legal obligation (Article 6(1)(c)), public interest (Article 6(1)(e)) and legitimate interest (Article 6(1)(f)) 50 . 33. If a controller intends to process special categories of personal data for scientific research purposes, then it needs to determine which derogation under Article 9(2) GDPR applies 51 . Similarly, if a controller processes personal data relating to criminal convictions and offences for scientific research purposes, it has to ensure that it can do so under the control of official authority or authorisation by Union or MS Law 52 . 34. In the following section, the considerations relating to lawfulness that are of particular interest when processing personal data for scientific research purposes are elaborated upon. 4.1 Consent (Article 6(1)(a) of the GDPR) 35. The EDPB’s Guidelines 5/2020 on consent under Regulation 2016/679 (hereafter Guidelines on consent) provide general guidance on the legal basis consent, pursuant to Article 6(1)(a) GDPR. The following sub - section provides additional guidance relevant to th e processing of personal data for scientific research purposes when relying on Article 6(1)(a) GDPR. 4.1.1 Freely given consent 36. Controllers must consider the condition that consent must be freely given, in particular if they intend to process personal data of data subjects that are in a vulnerable or disadvantaged position, i.e. if there is a situation of imbalance in power in the relationship between the data subject and the controller 53 . In the field of scientific research this could, for example, be the case when a research project involves processing of personal data of convicted persons, 48 Guidelines on consent, para. 2. 49 As further clarified in sections 4.1.2.1 and 4.1.2.2 , personal data processed for scientific research purposes on the basis of consent, pursuant to Article 6(1)(a) GDPR, may be collected using either broad or dynamic consent. 50 Processing that is necessary for the protection of vital interests of the data subject or of another natural person, pursuant to Article 6(1)(d) GDPR, may also be a viable legal basis when processing personal data for scientific research purposes cannot b e manifestly based on another legal basis (see Recital 46). However, as this would only occur in rare circumstances, Article 6(1)(d) GDPR is not elaborated upon in the present Guidelines. 51 See further in section 4.4 . When processing genetic data, biometric data or data concerning health, further conditions or limitations, pursuant to Article 9(4) GDPR , m ight apply. 52 Article 10 GDPR. 53 Recital 43 GDPR; Judgment of 4 July 2023, Meta Platforms Inc and Others v Bundeskartellamt , C - 252/21, EU:C:2023:537, para. 144. 21 | Adopted - version for public consultation pupils, unemployed or disenfranchised persons. If there are any doubts in this respect, controllers should refrain from relying on consent as a legal basis. 37. If personal data is processed in the field of medical research involving patients, such as clinical trials, then the controller should consider the mental or physical condition of the patient. If a patient’s capacity to provide consent is severely affected by his or her mental or physical medical condition, then the controller should refrain from relying on consent for the processing of personal data 54 . Conversely, the fact that a data subject is a patient receiving health care does not in itself affect the data subject’s capacity to freely provide consent, in so far as the data subject is not severely affected by a mental or physical medical condition 55 . 38. A controller can obtain a single consent for clinical research that involves the processing of personal data which are necessary both for the purposes of providing healthcare and conducting scientific research, since those purposes are interrelated. Howeve r, a controller cannot ask a data subject to consent to the processing of personal data for scientific research purposes as a condition for providing healthcare or other services, if those purposes for processing are not necessary for and interrelated with the conduct of scientific research 56 . In such a case, the controller should ask data subjects to consent to the processing of personal data for scientific research purposes separately, as it may otherwise not be considered to have been freely given. Example 7 : Freely given consent A private research institute is undertaking a study on how persons with a particular neurological disease are treated in their contact with public authorities and entities. There is no legal provision in Union or MS law that the institute can base the proc essing of personal data for its research on and it therefore explores whether it would be possible to rely on the explicit consent of the data subjects involved in the study, pursuant to Article 9(2)(a) GDPR. In order to ensure that data subjects with the particular neurological disease are in a position to give their consent, the institute consults with a non - profit organisation that represents patients and their relatives. The non - profit organisation gives the advice that most of the potential research su bject should be in a position to give their consent but that some, given the severity of their disease, will not be able to do so. On the basis of this advice, the institute conducting the study decides to proceed on the basis of consent, but will exclude data subjects that it determines are not in a position to give free consent. 39. If data subjects receive any kind of reimbursement or other benefit for participating in a research project, which may be regulated by Union or MS law, then controllers must determine whether the reimbursement or other forms of incentives affect the choice made by the data subjects as to whether or not they agree to the processing of their personal data. In this regard, remuneration intended to cover the income that data subjects might lose for 54 Opinion 3/2019, para. 20; Controllers should consider that there may be provisions in MS law that delegate the authority to consent to the processing of personal data in medical research to spouses, family members or legal guardians in cases where the res earch participant is incapacitated. 55 EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 10. 56 Article 7(4) of the GDPR; See also Guidelines on consent, para. 26 , and Opinion 3/2019, para. 19. 22 | Adopted - version for public consultation participating in a research project, for example because they may miss out from work, would normally not affect whether consent is freely given. Conversely, if the remuneration would constitute a significant part of the data subject’s regular income, it is more likely that it would affect whether consent was freely given or not. 4.1.2 Specificity 40. In the field of scientific research, it is possible for controllers to rely on the consent of a data subject to collect and process personal data in a certain area of scientific research when the purposes of research are not fully known at the time of coll ection of the data. This requires that certain conditions are met, most notably that additional safeguards should be adopted 57 , in line with recognised ethical standards relevant to the particular field of scientific research 58 . In the scientific research community, this way of obtaining consent is commonly referred to as broad consent , which is the term that will be used henceforth in the current guidelines. 41. Another way to obtain consent is for controllers to ask data subjects to consent to each different individual research project – or part thereof – separately, as soon as the purposes for processing personal data in those projects become known. This way of obtaining consent is commonly referred to as dynamic consent . 42. The determination of how to obtain consent must be made before personal data is processed. Controllers should opt for a mechanism of obtaining consent that provides data subjects with sufficient specificity of the purposes of processing and a high level of data protection over time, as described in this section. The choice for the type of consent should, in line with the accountability principle 59 , be appropriately documented, e.g. in a risk analysis or – where required – the data protection impact assessment (DPIA) 60 . The following sub - sections describe important considerations for controllers when they determine which way of obtaining consent is appropriate when processing personal data for scientific research purposes. 4.1.2.1 Broad consent 43. A controller can obtain broad consent from data subjects when collecting and storing personal data for processing in future research projects within certain areas of scientific research. In certain cases, several controllers can rely on the same broad consent 61 . This is possible when it has not yet been decided how to use the data in individual research projects at the time of collection and when the precise processing purposes are clearly determined at a later stage, for example when a research plan that detail s the processing of personal data is drafted or finalised. 44. With regard to broad consent, t he EDPB has stated that the GDPR cannot be interpreted in a way that allows controllers to navigate around the key principle of specifying the purposes 57 See further at para. 48 . 58 Recital 33 GDPR. 59 Article 5(2) and 24(1) GDPR. 60 Article 35 GDPR; See also: Article 29 Working Party Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679 (Guidelines on DP IA) (WP 248 rev.01, endorsed by the EDPB on 25 May 2018). 61 Recital 33 GDPR; Cf. also Recital 26 second para. DGA. 23 | Adopted - version for public consultation for which consent of the data subjects is asked 62 . Accordingly, controllers cannot ask data subjects to consent to the processing of their personal data without any specification of the purposes for which the data will or may be processed and it is not sufficient to only state that personal data will be u sed for scientific research purposes 63 . Therefore, controllers intending to process personal data for scientific research purposes on the basis of broad consent should define the purposes of future research as clearly as possible 64 . 45. The delimitation of the purpose should enable controllers to determine what personal data are necessary to process 65 and make it possible for data subjects to understand what purposes of processing they are consenting to 66 . The purpose for processing can be delimited to a certain field of research, for example medical research in the field of oncology, or sociological research in the field of criminology. However, the purpose can also be delimited in view of expected outcome s of the research, for example conducting genetic research to find better medical treatment methods . 46. When controllers obtain broad consent, they should ensure that data subjects understand the consequence of their choice that their personal data will be processed in research projects within the area of scientific research that was communicated to them. Th ereafter, when the purposes of processing for individual research projects (or stages thereof) become known and before the processing is initiated, the controller should consider if the processing of personal data in those projects will be undertaken insid e the boundaries of the broad consent. When doing so, controllers should evaluate if the processing of personal data correlates with the reasonable expectations of the data subjects, in line with the principle of fairness and the autonomy of data subjects 67 . If possible, controllers should consult with groups representing the data subjects to get a better understanding of the data subjects’ wishes and expectations. If a controller determines that the processing of personal data in an individual research proj ect (or part thereof) would fall outside the scope of a broad consent, then it should ask the data subjects to consent to that individual research project (or stage thereof) – i.e. rely on dynamic consent 68 . 47. Broad consent can be relied on for the processing operations of – inter alia – collection, curation, storage and provision of data (e.g. by way of transmission or giving access through a secure processing environment), as well as subsequent processing operations in individual research projects or parts thereof, as long as the proc essing of personal data remains within the relevant research area and the reasonable expectations of the data subjects. For example, patients that have had their genome sequenced a s part of personalised medical 62 Guidelines on consent, para. 15 8 . 63 Guidelines on consent, para. 156. 64 See further in E xample 10 . 65 See, by analogy: Judgment of 12 September 2024, HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG v Müller Rechtsanwaltsgesellschaft mbH and Others, Joined Cases C - 17/22 and C - 18/22, EU:C:2024:738, para. 52; See also: Judgment of 26 January 2023, Criminal proceedings against V.S , Case C - 205/21, EU:C:2023:49, para. 125. 66 Recital 42 GDPR; Guidelines on consent, para. 64. 67 Cf. EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default (Version 2.0, 20.10.2020) para. 70: “The data subject should be granted the highest degree of autonomy as possible with respect to control over personal data within the fram es of the legal basis.” 68 See further in section 4.1.2.2 . 24 | Adopted - version for public consultation treatment can consent to making their personal data available for the purposes of scientific research in the field of medical genetics for multiple research projects. Broad consent can also be relied on if a research project progresses towards a direction that was not anticipated or expected at the time when the personal data was collected, as long as it remains within the relevant research area. 48. If a controller asks for broad consent, then it should adopt specific safeguards that give data subjects sufficient control over the use of their personal data to offset for the lack of purpose specification 69 . In particular, controllers should make detailed information available to data subjects (for example on a webpage) on how their personal data are being processed, as the research progresses in individual research projects. This allows data subjects to cons ider whether or not they want to exercise their rights, e.g. the right to withdraw consent 70 . In addition, controllers should adopt measures that enable data subjects to receive information about the processing of their personal data, for example by subscribing to a newsletter. The modality for receiving information and its regularity should be de termined in line with the wishes of the data subject, as well as legal requirements or ethical considerations for communication with participants in research projects. 49. Controllers should also assess whether they should implement safeguards to compensate for the lack of purpose specification. Safeguards may include, among others, measures for use and access controls (such as an independent data trustee) 71 , time - limited validity of consent or an independent oversight body 72 . An oversight body may include a representative of the research participants, experts in the respective scientific research field, experts in data protection, as well as the data protection officer (DPO) (when a DPO has been designated 73 ). The oversight body may in particular be tasked to review proposed new research projects and to give an opinion on the processing of personal data for those projects. If the research activities are already covered by an existing oversight mechanism, such as an ethical review board, the controller can review whether that mechanism provides sufficient oversight of the processing of personal data as a safeguard. 50. Finally, controllers should assess if it may be useful to provide an effective technical tool, or other measure, that empowers data subjects in the exercise of their choice regarding consent to the processing of their personal data for individual research projects 74 . Such a tool should not cause a digital divide, over - or underrepresentation of certain groups of individuals. 69 Guidelines on consent, para. 160. 70 See further in 115 ; If consent is withdrawn, all data processing operations that were based on consent and took place before the withdrawal of consent - and that were undertaken in accordance with the GDPR - remain lawful. However, the controller must stop the concerned processing operations and if there is no other lawful basis justifying continued processing of the personal d ata (e.g. further storage), then the data must be deleted or anonymised by the controller and the data subject should receive confirmation that erasure has occurred: Guidelines on consent, para. 117. 71 Meaning an entity or individual that acts as a neutral intermediary between the holder of data and the user of data, and that manages and oversees the processing of personal data. 72 While such safeguards should be adopted when a controller relies on broad consent, they may also be relevant when a controller processes personal data for scientific research purposes on the basis of dynamic consent (see further in section 4.1.2.2) or ano ther legal basis. 73 Pursuant to Article 37(1) GDPR. 74 Tools for managing consent can also be provided by data intermediation services, pursuant to Article 10(b) Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/ 1724 (Data Governance Act (DGA)) (OJ L 152, 3.6.2022, p. 1). 25 | Adopted - version for public consultation Example 8 : Processing of personal data for scientific research purposes on the basis of broad consent Various university hospitals work together in a research network in order to make personal data from the treatment of patients available for scientific research through a federated database. The envisaged storage and further processing of pseudonymised per sonal data will be based on broad consent from each patient, as the specific research projects and the relevant purposes are not foreseeable at the time of medical treatment when consent is obtained. In order to meet the requirements of a comprehensive medical research infrastructure, and to include inter - disciplinary issues as well as questions of multimorbidity, the purposes covered by the given consent are not limited to any specific disease. Instea d, the given consent covers a broad range of specified medical disciplines. When additional medical disciplines that are not covered by the original consent are added, data subjects are informed about this. The data subjects are also asked whether they wan t to consent to the processing of their personal data in research projects covered by the additional purposes. The research network requires the adoption of mandatory safeguards for each participating hospital, including independent review of individual research projects and strict terms of use for researchers. The use of patient data for a specific research projec t also requires prior review and approval by an independent ethics committee. General information about the research network and the use of personal data is provided in flyers and brochures that are available in each hospital, as well as in the media and o nline. Furthermore, information about every future research project is published on a website and provided individually to data subjects who have subscribed to a newsletter. The personal data are collected by the university hospitals when treating data for a period of five years. During this time period, the personal data are collected and made available for scientific research purposes, as long as the data subject does not wi thdraw their consent. The collected personal data can be processed for scientific research purposes for a specified period of time, that spans beyond the time period for consent. However, no new personal data collected from the treatment of the data subjec ts are made available for scientific research after the five - year period has expired. If a data subject visits a university hospital after the five - year period has expired, they are asked again if they want to consent to making their personal data availabl e for scientific research purposes for five more years. 4.1.2.2 Dynamic consent 51. Relying on dynamic consent means that controllers initially obtain data subjects’ consent to the processing of their personal data for a research project in a certain area of research, or for specific stages of a research project that are already known at the time of collection of their personal data. For processing of personal data for purposes related to subsequent research projects that were not known at the time of collection of consent, or stages within a project that were introduced after the initial consent had been obtained, a separate consent is obtained. If a controller relied on broad consent when it collected the personal data, there 26 | Adopted - version for public consultation are circumstances where it should rely on dynamic consent when further processing the personal data for scientific research purposes. This includes situations where the further processing of personal data for individual scientific research projects (or par ts thereof) would fall outside the reasonable expectations of data subjects, or if those projects would not fall within the specific research area that a data subject has consented to. 52. Dynamic consent enables the controller to address changes in both the researchers’ scientific needs and the data subjects’ interests, when processing personal data for scientific research purposes over extended periods of time. To that end, dynamic consent can facilitate the conduct of long - term scientific research activities, as it allows controllers to continuously communicate with research participants, as well as manage the research. For example, if the researchers are in a close and prolonged relations hip with the data subjects, as may be the case in fields of research where researchers interact with research participants on a regular basis in long - term research projects, dynamic consent is often the appropriate way of obtaining consent. 4.1.3 Consent to participate in scientific research pursuant to ethical or legal requirements not stemming from the GDPR 53. There can be ethical or legal requirements to obtain the consent of data subjects 75 , expressing their willingness to participate in scientific research as research participants, as a prerequisite for carrying out certain types of research 76 . An individual’s consent to participate in research pursuant to ethical or legal requirements is typically intended to ensure the protection of the right to human dignity and the right to integrity of data subjects as individuals, under Article 1 and 3 of the CFREU 77 . Such consent is not required by the GDPR, but may be considered as an additional safeguard according to Article 89 GDPR 78 . 54. It is important to underline that consent to participate in scientific research, which stems from ethical or legal requirements, should be distinguished from consent to the processing of personal data as a legal basis pursuant to the GDPR 79 . This is because requirements of consent that fulfil an ethical standard or legal obligation typically goes beyond the processing of personal data and do not always fulfil the requirements of a valid consent pursuant to the GDPR, in particular explicit consent that is necessary for the processing of special categories of data, pursuant to Article 9(2)(a) of the GDPR. Therefore, i f a controller that asks for consent to participate in scientific research, following ethical or legal requirements, also intends to rely on consent as legal basis for processing of personal data – pursuant to Article 6(1)(a) (and Article 9(2)(a), if applicable) of the GDPR – then the controller needs to determine and 75 Cf. DoH, October 2008, para 24; Article 62(4)(f) of Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices (OJ L 117, 5.5.2017, p. 1); Article 28(1)(c) CTR; See also see further at footnote 15 . 76 In addition, a controller may – as a safeguard pursuant to Article 89 (1) GDPR – record the agreement of data subjects to process their personal data for scientific research purposes, when relying on another legal basis than consent, even if there is no l egal or ethical requirement to do so. 77 Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70.1.b)) (23.1.2019) para. 16. 78 Guidelines on consent, para. 154; EDPB - EDPS EDPB - EDPS Joint Opinion 3 /2026 On the Proposal for a Regulation on establishing a framework of measures for strengthening Union’s biotechnology and manufacturing sectors particularly in the area of health (European Biotech Act) (10.03.2026) para. 37. 79 EDPB - EDPS Joint Opinion 3/2026, para. 46 ; EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 5. 27 | Adopted - version for public consultation be able to demonstrate 80 whether the consent given fulfils the conditions of the GDPR to provide a valid legal basis for the processing of personal data. 55. A controller that asks data subjects to consent to the participation in a research project and to the processing of personal data at the same point in time must ensure that the request for consent, pursuant to the GDPR, is clearly distinguishable 81 . For many research projects, it will be possible to request data subjects to consent to both the participation in the research project as such and the processing of personal in the same interface or consent form. As long as the different requests for consent are sufficiently distinguishable, it may even be preferrable to provide a common interface or consent form, as information on the processing of personal data provided to data subjects under the GDPR should be as concise as possible 82 . However, for projects research projects that involve particularly complex or sensitive processing of personal data, it may be necessary for the controller to provide a separate interface or form that only addresses consent pursuant to the GDPR 83 . 4.2 Public interest or exercise of official authority (Article 6(1)(e) GDPR) 56. Where scientific research is recognised as a societal good that contributes to the general knowledge and the wellbeing of society, there is significant public interest in conducting scientific research activities. Accordingly, processing of personal data in the public interest, pursuant to Article 6(1)(e) GDPR, is a legal basis of particular imp ortance for scientific research 84 . 57. Pursuant to Article 6(3) GDPR, processing of personal data in the public interest or in the exercise of official authority 85 must be based on a legal basis laid down by Union or MS law to which a controller is subjected 86 . In contrast to Article 6(1)(c) GDPR, Union and MS law 80 Article 5(2) GDPR; Judgment of 11 November 2020, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), C - 61/19, EU:C:2020:901, para. 42. 81 Article 7(2) GDPR. 82 Article 12(1) GDPR. The information provided to the data subject could be provided using a layered approach, where the data subject will receive more detailed information in another interface. See further in Article 29 Working Party, Guidelines on transpa rency under Regulation 2016/679 (WP260 rev.01) (Guidelines on transparency) para. 35pp; See also further at para. 79 . 83 European Commission, Ethics and data protection (05.07.2021) p. 12. 84 Examples of MS laws that are intended to provide a legal basis for processing of personal data for scientific research purposes, pursuant to Article 6(1)(e) GDPR, are: Section 4, subsection 1, paragraph 3 of the Finnish Data Protection Act (1050/2018); Ar ticle R322 - 2 of the French Research Code; Article 33 of the Icelandic Information Act (140/2012); Section 12(10 - 14) of the Italian Law Decree no. 179 of 18 October 2012; 1 Chapter 2 § 2 p. Swedish law (SFS 1992:1434) on higher education. This list is not e xhaustive as to the EU or MS law that can be relevant when processing personal data for scientific research purposes on the basis of Article 6(1)(e) of the GDPR. 85 Official authority, pursuant to Article 6(1)(e) GDPR refers to an authority granted by the European Union, EFTA or a Member State. In other words, tasks carried out in the public interest of a third country or in the exercise of an official authorit y vest ed by virtue of foreign law do not fall within the scope of this provision. See to that end: EDPB/EDPS, Annex to Joint Response to the LIBE Committee on the impact of the US Cloud Act on the European legal framework for personal data protection (12.7.2019) p. 4 - 5; See also: Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC (WP 217, 09.04.2014) p. 21. 86 According to Recital 41 GDPR, the legal basis relied upon should be clear and precise and its application should be foreseeable to persons subject to it. Moreover, the legal basis must be laid down in law, regulation, decree or another legal provision tha t is publicly available. See to that end: Judgment of 1 October 2015, Smaranda Bara and Others v Casa Naţională de Asigurări de Sănătate and Others , C - 201/14, EU:C:2015:638, paras. 40 - 41; To ensure foreseeability, it may be appropriate for the legal basis to specify additional aspects on the processing of personal data, as provided in Article 6(3) 2 nd paragraph GDPR. With regard to EU Law, and the elements of processing that should be laid down in a legislative (basic) act as opposed 28 | Adopted - version for public consultation in the scope of Article 6(1)(e) does not always determine precise obligations for a controller, but rather authorises controllers to process personal data when necessary to fulfil a task of public interest or in the exercise of official authority vested in the controller. For example, Union and MS law may authorise a controller to conduct scientific research in a certain field in the public interest, without necessarily specifying how the research is to be undertaken. 58. Relying on performance of a task carried out in the public interest, or exercise of official authority, as a legal basis is not limited to public entities conducting scientific research. Private entities may also rely on that legal basis, if the legal act covers their activities 87 . Controllers that are not authorised to process personal data on the basis of Article 6(1)(e) GDPR can instead assess whether they can rely on consent (Article 6(1)(a) 88 ) or legitimate interest (Article 6(1)(f) 89 ) . 59. Finally, Union or MS law providing for processing of personal data pursuant to Article 6(1)(e) GDPR, and any processing of personal data reliant upon such laws, must comply with the principles of necessity and proportionality 90 . 4.3 Legitimate interest (Article 6(1)(f) GDPR) 60. The EDPB’s Guidelines 1/2024 on legitimate interest based on Article 6(1)(f) GDPR (hereafter Guidelines on legitimate interests 91 ) provide general guidance on the legal basis legitimate interest. The following sub - section provides additional guidance relevant to the processing of personal data for scientific research purposes when relying on Article 6(1)(f) GDPR. 61. Scientific research and the accompanying processing of personal data can be a legitimate interest under Article 6(1)(f) GDPR 92 , regardless of whether it is undertaken on a non - profit or commercial basis 93 . Moreover, scientific research is generally attributed with special importance as an activity that is beneficial for society 94 . Accordingly, a controller that intends to process personal data for scientific research purposes on the basis of legitimate interest can , when applying the balancing test pursuant to Article 6(1)(f) GDPR, often attribute to a legal act that follows from delegation in legislation, see further: EDPS, Guidance for co - legislators on key elements of legislative Proposals (7.5.2025) sections 6 and 8. 87 Recital 45 GDPR. It is noted that processing of personal data relating to criminal convictions or offences requires by privat e entities requires explicit authorisation in law or a decision by supervisory authority, in accordance with Article 10 GDPR. 88 See further in section 4.1 . 89 See further in section 4.3 . 90 The relevant considerations in that respect are laid down in the case law of the CJEU, see e.g.: Judgment of 16 December 2008, Heinz Huber v Bundesrepublik Deutschland , C - 524/06, EU:C:2008:724, para. 62; Judgment of 4 May 2017, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA "Rīgas satiksme" , C ‑ 13/16, ECLI:EU:C:2017:336, p. 30; Judgment of 22 June 2021, B v Latvijas Republikas Saeima C ‑ 439/19, EU:C:2021:504, para. 109; C - 184/20, p. 85; Judgement of 2 March 2023, Norra Stockholm Bygg AB v Per Nycander AB , C - 268/21, EU:C:2023:145, p. 54; C - 252/21, para. 116; With regard to EU law, see also Guidance for co - legislators on key elements of legislative proposals, section 5. 91 EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, Version 1.0, Adopted on 8 October 2024 (version for public consultation). 92 In accordance with Article 6(1) second para. GDPR, it is noted that public authorities cannot rely on Article 6(1)(f) GDPR when they are processing personal data in the performance of their tasks. 93 See above at para. 11 lit v ; See also: Judgement of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens , C - 621/22, EU:C:2024:857, para. 49; It should also be noted that the processing of personal data must be motivated by scientific research purposes in the meaning of the GDPR, as outlined in section 2. 94 See further at paras. 1 and 61 ; See also: Guidelines on legitimate interest, para. 24. 29 | Adopted - version for public consultation significant weight to the processing of personal data for scientific research purposes, in relation to the data subjects’ interests or fundamental rights or freedoms. 62. The controller must consider the reasonable expectations of the data subject 95 . In certain areas of activities, there may be a more apparent expectation of the data subjects that their personal data will be processed for scientific research purposes. The expectations of data subjects may, for example, be determined following a consultation with organisations that represent categories of data subjects 96 . 63. Finally, when assessing if the legitimate interest for a scientific research purpose overrides the data subjects’ interests or fundamental rights or freedoms, the controller should also take the requirement to provide appropriate safeguards, pursuant to Ar ticle 89(1) of the GDPR, into account. In this regard, the controller must assess the appropriateness of such safeguards in order to avoid, reduce or mitigate the impact on the rights and freedoms of data subjects as much as possible 97 . Any remaining risks of a negative impact on the rights and freedom of data subjects should then be weighed in the balancing test, in order to determine whether the risks are of such a nature or extent as to outweigh the legitimate interests of the control ler or a third party 98 . If a controller determines that the adopted safeguards are not sufficient to address the identified risks, then additional mitigating safeguards should be adopted and the controller should undertake the balancing test anew 99 . If the controller considers that no sufficient mitigating measures can be taken, then the processing cannot be based on Article 6(1)(f) GDPR and the controller should consider whether another legal basis is applicable 100 . 4.4 Processing special categories of personal data for scientific research purposes (Article 9 GDPR) 64. If special categories of personal data, pursuant to Article 9(1) GDPR, are processed for scientific research purposes, then a controller must assess which of the derogations under Article 9(2) GDPR it can rely upon to process such data 101 . The notion of special categories of personal data covers not only data that directly reveal sensitive information about a data subject, but also personal data that can be used to collate or deduce such information, and sensitive information inferred from the data processed 102 . 95 Guidelines on consent, section 3. 96 For a similar reasoning, see further at para. 46 . 97 The adopted safeguards should go beyond the mandatory measures required by the GDPR, such as performing a DPIA pursuant to Article 35(1) GDPR, in order to be considered having a mitigating effect when performing the balancing test, pursuant to Article 6(1 )(f) GDPR. See, to that effect: Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (17.12.2024) para. 97. 98 See further in section 8.2 . 99 Guidelines on legitimate interest, para. 57. 100 Guidelines on legitimate interest, para. 60. 101 Judgement of 21 December 2023, ZQ v. Medizinischer Dienst , C - 667/21, EU:C:2023:1022, para. 78. 102 Judgment of 4 October 2024, ND v DR , C - 21/23, EU:C:2024:846, paras. 79 - 83; C - 184/20, paras. 120 - 127. See also Guidelines 1/2024, para. 40. 30 | Adopted - version for public consultation 65. The risks associated with processing of special categories of personal data must be mitigated by implementing appropriate and effective safeguards, in line with Article 89(1) GDPR 103 . If controllers process special categories of personal data on a large scale , they must assess and mitigate the risks associated with such processing through a DPIA 104 . 66. MS law regulating the processing of genetic, biometric, or health data may impose further conditions, including limitations on controllers 105 . While such Union or MS law is outside the scope of the present guidelines, those exceptions may be of particular importance for controllers when processing those categories of personal data for scientific research purposes. 4.4.1 Explicit consent (Article 9(2)(a) GDPR) 67. Controllers may also assess if they can rely on the explicit consent of data subjects, including broad 106 or dynamic consent 107 , pursuant to Article 9(2)(a) GDPR, to process special categories of personal data for scientific research purposes. The considerations outlined in section 4.1 are also relevant when a controller considers relying on Article 9(2)(a) GDPR, as a derogation from the prohibition of processing to special categories of personal data. 4.4.2 Personal data manifestly made public by the data subject (Article 9(2)(e) GDPR) 68. If a data subject has manifestly made special categories of personal data public , a controller may assess whether it can rely on Article 9(2)(e) GDPR to process that data for scientific research purposes. In this regard, the word manifestly implies that there is a high threshold for relying on the exemption, pursuant to Article 9(2)(e) GDPR 108 . 69. In order to assess whether personal data has been made manifestly public, the controller needs to “ascertain whether the data subject had intended, explicitly and by a clear affirmative action, to make the personal data in question accessible to the genera l public” 109 . A clear affirmative action may, for example, consist of participating in a public event that is broadcasted online 110 . 70. A controller that wants to process special categories of personal data in individual posts on social media for scientific research purposes should make sure that the data was posted following an active choice by the data subject. The controller should chec k the settings available to users on the social media platform. The controller should also verify that users 103 EDPB - EDPS Joint Opinion 3 /2026, para. 3 6 ; See also further in section 8 . 104 Article 35(3)(b) GDPR. 105 Article 9(4) GDPR. The EDPB underlines that such limitations may also be imposed by MS law for processing operations that are covered by other legal bases than Article 6(1)(e) GDPR. 106 See further in section 4.1.2.1 . 107 See further in section 4.1.2.2 . 108 Guidelines 8/2020 on the targeting of social media users (Version 2.0, 13.4.2021) para. 127. 109 C - 252/21, p. 77. 110 See e.g. Judgement of 4 October 2024, Maximilian Schrems v Meta Platforms Ireland Limited, anciennement Facebook Ireland Limited , C - 446/21, EU:C:2024:834, paras. 78 - 79 on relevant circumstances to consider when assessing whether an action of a data subject constitutes the manifestly making public of special categories of personal data in the sense of Arti cle 9(2)(e) GDPR. 31 | Adopted - version for public consultation who post public content can only do so after having adjusted the necessary settings, with knowledge that their data will be made public 111 . 71. Controllers should also consider the context in which the special categories of data are made public and by whom 112 . In that respect, special categories of personal data that are actively posted by data subjects themselves (for example by an influencer or a video blogger) can indicate that the data has been manifestly made public, which would not be the case if the data was posted by a third party (e.g. a photo published by a friend or relative which reveals special categories of data ) 113 . 72. Finally, the EDPB reiterates that the fact that a data subject has made special categories of personal data public at a certain point in time and in a certain context, does not mean that the data subject has also made other personal data – within the same category of data – public 114 . Example 9 : Personal data which are manifestly made public by the data subject A private research institute for psychology is conducting a study on the impact of frequent use of social media platforms on the psychological well - being of young adults. The research team investigates the possibility of collecting personal data concerning health from data subjects’ profiles that are public on a social media platform, on the basis of legitimate interest, pursuant to Article 6(1)(f) GPDR, and the derogation for special categories of data manifestly made public, pursuant to Article 9(2)(e). T o inform itself of the possibility to use the data, the research team reviews the privacy policy and the individual settings available to users on the social media platform. Following this review, the research team can determine that users’ personal data i s not made public by default, but only following an active choice in the platform settings by the individual user. Therefore, the researchers determine that it is possible to process the personal data on the basis of Article 6(1)(f) GDPR, and the derogatio n pursuant to Article 9(2)(e). In order to enhance the privacy of data subjects whose personal data will be processed in the research project, all data collected from the social media platform is pseudonymised before it is entered into the data set. Furthe rmore, data subjects are informed by the research institute through the social media platform, in accordance with Article 14(1) GDPR, and given the opportunity to object to the processing of personal data. 111 C - 252/21, paras. 81 - 82; Guidelines on the targeting of social media users, para. 127 lit (i). 112 Guidelines on the targeting of social media users, paras. 127 - 128. 113 Guidelines 8/2020, para. 127 lit (v). 114 C - 446/21, para. 80. 32 | Adopted - version for public consultation Example 10 : Personal data which are manifestly made public by the data subject Researchers at a public university undertake research in the field of political science where they are processing personal data on political opinions that have been made public on social media or other media outlets by politicians. As the political orienta tions are manifestly made public by the data subject on publicly accessible social media profiles and through media outlets, the derogation – pursuant to Article 9(2)(e) of the GDPR – applies to the processing of this special category of personal data. 4.4.3 Derogations laid down in Union or MS law (Article 9(2)(g), (i) and (j) GDPR) 73. Controllers may rely on derogations to the prohibition of processing of special categories of data provided for by Union or MS law, pursuant to Article 9(2)(g), (i) and (j) of the GDPR, when processing personal data for scientific research purposes. 115 Such laws must “ respect the essence of the fundamental rights and observe the principle of proportionality ” 116 . To fulfil the principle of proportionality, the laws must – inter alia – provide for suitable and specific measures, to safeguard the fundamental rights and interests of the data subject, to be adopted by the controller 117 . 74. A controller that intends to rely on a derogation pursuant to Article 9(2)(g), (i) or (j) GDPR should consider and be able to demonstrate that the law in question applies to the intended processing for scientific research purposes. Moreover, the controller should assess and be able to demonstrate that it has implemented suitable and specific measures required by the concerned Union or MS law. In this regard, controllers m ight have to adopt appropriate safeguards, pursuant to Article 89(1) GDPR 118 , in addition to measures mandated by law. This will be relevant when the processing operation in question gives rise to data protection risks that were not anticipated by the law providing an exemption under Article 9(2) GDPR. 115 Examples of Union and MS laws that are intended to provide derogations for processing of personal data for scientific research purposes, pursuant to Article 9(2)(j) GDPR, are: Section 10 of the Danish Data Protection Act; Section 6, subsection 1, paragrap h 7 of the Finnish Data Protection Act (1050/2018); Article 44 - 6 of the French Data Protection Act; Section 27 (1) of the German Federal Data Protection Act; Article 11(1) (10) of the Icelandic Data Protection Act; Section 110 of the Italian D ata Protectio n Code; 6 § Swedish law (2003:460) on ethical approval of scientific research on human beings; and Article 57(1)(a)(i) Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (EHDS) (OJ L, 2025/327, 5.3.2025). This list is not exhaustive as to the derogation in EU or MS law that could be relevant when processing special categories of personal data fo r scientific research purpo ses, on the basis of Article 9(2) GDPR. The EDPB has not reviewed nor analysed the laws referred to. See also: Recital 151 of Proposal for a Regulation of the European Parliament and of the Council on establishing a framework of measures for strengthening Union’s biotechnology and biomanufacturing sectors particularly in the area of health and amending Regulations (EC) No 178/2002, (EC) 1394/2004, (EU) 536/2014, (EU) 2019/6, EU (2024/795) and (EU) 2024/1938 (European Biotech Act) (COM(2025) 1022 final and E DPB - EDPS Joint opinion 3 /2026 , para. 15 ; Recital 30 of Commission Delegated Regulation (EU) 2025/2050 of 1 July 2025 supplementing Regulation (EU) 2022/2065 of the European Parliament and of the Council by laying down the technical conditions and procedures under which providers of very large online platform s and of very large online search engines are to share data with vetted researchers ( OJ L, 2025/2050, 9.10.2025 ). 116 C - 184/20, para. 70. 117 See by analogy: C - 439/19, paras. 105 - 106; See also Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR (15.12.2020) para. 56 and EDPS, Opinion 2/2023 on the Proposals for Directives on standards for equality bodies in the field of equal treatment (02.02.2023) paras. 14 - 15; For processing of personal data for scientific research purposes specifically, see: Recital 156 of the GDPR; See also: EDPB Document on response to the request from the European Commission for clarif ications on the consistent application of the GDPR, focusing on health research, para. 56. 118 See further in section 8 . 33 | Adopted - version for public consultation The need to adopt such safeguards will depend on the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons. 75. Finally, the EDPB notes that reliance on Article 6(1)(f) GDPR in the context of medical research (such as clinical trials) also requires the application of a derogation, pursuant to Article 9(2) GDPR. One example of a provision in Union law that provides f or a derogation pursuant to Article 9(2) GDPR is Article 53(1)(e) in the European Health Data Space Regulation (EHDS). This provision can be relied upon for controllers intending to process health data for the purposes of conducting scientific research on the basis of Article 6(1)(f) 119 . 5 Obligations to inform (Articles 12 - 14 GDPR) 76. The EDPB’s Guidelines on transparency under Regulation 2016/679 (hereafter Guidelines on transparency 120 ) provide general guidance on the obligations to inform, pursuant to Article 12 - 14 GDPR. The following section provides additional guidance relevant to the processing of personal data for scientific research purposes. 5.1 General 77. When a controller intends to or anticipates that it will process personal data for scientific research purposes over longer periods of time, then it should give data subjects an opportunity to voluntarily provide contact details. This will make it possible for data subjects to get necessary updates on the processing of their personal data. Data subjects should get this opportunity, even if the purposes for processing personal data do not require the processing of contact details. 78. Examples of when it might be relevant to gather contact details are generational studies or when the research is based on data contained in a research infrastructure (such as a biobank or a data repository). In such cases, the data subjects should be given a choice of how to be contacted, for example by e - mail. To overcome the digital divide, data subjects should also be given an opportunity to be contacted by mail or telephone 121 . 79. Controllers should consider setting up a webpage or providing an application through which data subjects can stay informed on the processing of their personal data, if relevant using a layered approach , as detailed in the Guidelines on transparency 122 . If several controllers participate in the processing of personal data in scientific research activities, the setting up of webpages or applications should be co - ordinated. In this regard, it should be noted that for certain types of research, or if the r esearch project only concerns a limited number of participants, it might not be necessary to provide a webpage or application, as the controller 119 Recital 52 EHDS. 120 Article 29 Working Party – Guidelines on transparency under Regulation 2016/679 (Guidelines on transparency) (WP260 rev.01, endorsed by the EDPB on 25 May 2018). 121 Guidelines on transparency, para. 32. 122 Guidelines on transparency, para. 35 - 36. 34 | Adopted - version for public consultation may have more direct ways of informing the data subjects, for example via calls, text messages, e - mail or regular mail. 80. Controllers should also consider providing a privacy dashboard, as described in the Guidelines on transparency 123 , and in case consent is relied on as a legal basis, provide the data subject with consent receipts, i.e. a digital record on the consent statement 124 . A privacy dashboard can also enable data subjects to exercise their rights 125 , give or withdraw their consent (where applicable) in an easy and accessible manner 126 , or be used to ask questions about the processing of their personal data to the controller. 81. Moreover, controllers should consider setting up a contact point, either digital or analogue – but preferably both – through which data subjects can pose questions, get information or exercise their data protection rights. This will allow data subjects to adequately and consciously make decisions regarding the use of their personal data. In this regard, the EDPB underlines that it follows from the general obligations of the GDPR that data subjects must have efficient ways of contacting controllers 127 . 5.2 Provision of information when personal data are collected directly from the data subject (Article 13(1) GDPR) 82. When personal data are collected directly from the data subject, then the controller must provide information on processing of personal data at the time of collection. The following sub - section provide examples on how information should best be provided to data subjects in some situations where personal data is collected for scientific research purposes. 123 Guidelines on transparency, para. 39; Privacy dashboards can be provided for by data intermediation services, pursuant to Article 10(b) DGA. 124 For an example of how implement a consent record, see: W3C Community Group, Consent Records and Receipts as per ISO/IEC TS 27560:2023 using DPV (0 1 .0.8. 2024 ) https://w3c.github.io/dpv/guides/consent - 27560 ( accessed on 24 .09. 2025 ) . 125 Pursuant to Chapter III GDPR. See further in section 6 . 126 If the controller relies on consent for the processing of personal data, a privacy dashboard can be a particularly useful too l to keep data subjects informed about the processing of their personal data and to enable them to withdraw consent. See further in para. 50 . 127 See, inter alia, Articles 12(1 - 2), 13 (1)(a) and 14(1) (b) GDPR; See also: Guidelines on transparency, para. 55 and Guidelines on right of access, para. 53. 35 | Adopted - version for public consultation Example 11 : Information to data subjects whose personal data is directly collected from the data subject through a clinical trial A pharmaceutical company is conducting a clinical trial for a new pharmaceutical product in co - operation with a healthcare facility. In accordance with Article 28(1)(c) of the Clinical trials regulation (CTR), the informed consent of the research participa nts to participate in the clinical trial is required. When the research participants sign up for the trial, they are informed during an interview and given a folder that includes a form for informed consent and information about the trial, possible side ef fects of the pharmaceutical product, how the research data will be processed and the objectives of the trial. The folder also contains a separate section which informs about the central elements of processing of personal data, which is clearly indicated in a table of contents in the folder. In addition, data subjects are informed about the possibility of getting more detailed information through a dedicated webpage and a contact point (with an email address and a phone number) through which data subjects ca n pose questions, receive information or exercise their data protection rights. Example 12 : Information to data subjects whose personal data is directly collected from the data subject through interviews A university faculty of labour studies is conducting a study on participation when making decisions in the work place. The researchers are gathering data by phone calls or in - person interviews with data subjects who are recruited by phone from a statistica lly randomised cohort of research participants. The faculty adopts a layered approach when providing information. Therefore, the researchers inform the data subjects orally about the central elements of processing of personal data before the interview star ts 128 . The researchers also inform that more detailed information can be found on the webpage of the university, or be obtained by calling the university’s central number. 128 This information can also be provided using automated or pre - recorded messages. See: Guidelines on transparency, para. 21. 36 | Adopted - version for public consultation Example 13 : Information to data subjects whose personal data is directly collected from the data subject through an application A university faculty for arts and music is researching preferences and listening habits for fans of folk music. To gather research data, the researchers have created an extension application to a music platform that contains a survey. Advertisement for the research appears in the news feed of the music platform, whereby data subjects can download the extension application. The faculty adopts a layered approach when providing information. Therefore, data subjects are provided with the information about the central elements of processing directly in the app before the download starts and their personal data is processed. The a pp also provides a link to the faculty’s webpage with more detailed information. Since the legal basis for processing is the consent of the research participants, data subjects are also asked to consent to the processing of their personal data, by clicking a clearly distinguished check - box, before downloading the extension application. 83. The obligation to provide information pursuant to Article 13 of the GDPR applies also if the controller does not itself process or has access to any personal data, nor has any direct or indirect contact with the data subject 129 . One such case is if the processing of personal data for scientific research is undertaken by a processor on behalf of the controller, or a joint controller. In such situations, the processor or the other controller may provide information to data subject s on the controller’s behalf 130 . If a controller is contacted by a data subject that requests information, pursuant to Article 15 GDPR, the controller must fulfil the request for information by the data subject, for example by requesting the processor or other controller to reply to the request on their behalf. Example 14 : Provision of information when a controller does not have any contact details or direct contact with data subjects A retail analytics company operates a nationwide loyalty card program. The company lawfully collects and stores purchase data from customers who have signed up to the program, on the basis of consent. Data subjects can also consent to the use of the data f or scientific research purposes. A university business school wants to conduct scientific research on consumer purchasing behaviour. It decides on the purposes and methodology for the research, and determines what data it needs to conduct the research. The university contracts the retail analytics company to process loyalty card data on its behalf. Even though the university does not hold or process the personal data, it is the controller under Article 4(7) GDPR. 129 Judgment of the Court of 5 December 2023, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija, Case C - 683/21, ECLI:EU:C:2023:949, para. 36. 130 Processors should assist the controller in the fulfilment of data subject’s rights, pursuant to Article 28(3)(e) GDPR; In cas es of joint controllership, the provision of information and fulfilment of data subjects’ rights should be laid down in the agre em ent between the controller, pursuant to Article 26(1) GDPR. 37 | Adopted - version for public consultation A customer wants to know more about how their individual personal data are processed for the scientific research project conducted by the university and contacts the university’s DPO. Since the university cannot identify the data subject, the DPO informs t he university which in turn instructs the retail analytics company to provide the necessary information to the DPO. Having received the information, the DPO informs the data subject about the processing of their personal data at the retail analytics compan y. 5.3 Further processing of personal data for further scientific purposes (Article 13(3) GDPR) 84. If a controller that collected personal data for another purpose than scientific research at a later point in time decides to furth er process the personal data for scientific research purposes, then the controller must inform the data subjects accordingly 131 . In line with the principle of purpose limitation, this also applies if the controller intends to process the personal data for a new scientific research purpose that is different from an initial scientific research purpose 132 . 85. The controller must inform the data subjects in advance of the further processing operations. Provision of information within a sufficient period before the processing starts should allow the data subjects to consider the impact of the further processing of their personal data. Several factors should be taken into account to determine such period, such as the intrusiveness of the processing into the private life, its impact on the protection of personal data, the processing of special categories of data or other types of sensitive personal data, the reas onable expectations of the data subject, or the fact that data subjects are in a vulnerable position 133 . This also allows data subjects to exercise their rights under the GDPR, not least to withdraw their consent in case the processing operations concerns a certain area of scientific research to which the data subject has given broad consent, 134 or to object to the further processing 135 , when applicable. 86. It may be challenging for controllers to inform data subjects of further processing for scientific research purposes if they have not retained the contact details of the data subjects, for example due to pseudonymisation of the personal data where identifiers or a table of correspondence are not accessible for the controller. To that end, if the controller knows at the time of collection (or when contact details are deleted because they are not necessary to process) that the personal data will be processed for scientific purposes at a later stage, then the controller should make sure that data subjects can stay informed, in accordance with Articles 12 and 13 GDPR 136 . 131 Article 13(3) GDPR. 132 See further in section 5.5 . 133 For a similar reasoning, see: Guidelines on transparency, para. 48. 134 See further in section 4.1.2.1 . 135 Pursuant to Article 21(6) GDPR. See further in section 6.3 . 136 EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 35 ; See also further at para. 77 . 38 | Adopted - version for public consultation 87. Controllers should not knowingly delete contact details if they intend to or anticipate that they will further process personal data for scientific research purposes. If a controller knowingly deletes contact details and then fails to inform data subjects directly when further processing personal data for scientific research purposes, this may lead to a breach of the principle of transparency, pursuant to Article 5(1)(a) GDPR, as well as Article 13(3). 88. If the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, it may not have contact details of the data subjects. If the controller has i dentifiers, such as a name or administrative identification number 137 , it should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort 138 . 89. If public registries or other viable means are not available, if their use would require a disproportionate effort, 139 or if a data subject is not listed in any of the available sources, then the controller should inform data subjects indirectly 140 . The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available, which need to be adjusted depending on the context of the research project and the dat a subjects involved, include: • Providing information on a website, as detailed above 141 ; • Posting information in localities where the relevant data subjects are present regularly (e.g. schools, universities, correctional facilities, medical care facilities, pharmacies, etc); • Advertising in public spaces, on the television or radio, in newspapers – in particular local media or online; and • Providing information through associations representing research subjects (e.g. patient organisations, trade unions, non - profit organisations etc). 5.4 Provision of information when personal data are not collected directly from the data subject (Article 14(1) GDPR) 5.4.1 General 90. When a controller receives personal data from another controller and intends to process it for scientific research purposes, the obligation to inform pursuant to Article 14 GDPR applies. 137 The EDPB notes that, in accordance with Article 11(1) GDPR, there is no obligation under the GDPR to retain identifiers. 138 Recital 37 of the Digital Omnibus; In some Member States, the use of electronic post boxes provided by public or private entities is widespread. Electronic mail boxes are typically connected to an identifier, such as administrative identification number, that a controller can use to send electronic post directly to the data subject. 139 See further in section 5.4.2.3 . 140 Recital 37 of the Digital Omnibus. 141 See further at para. 79 . 39 | Adopted - version for public consultation This means that the receiving controller must make sure that the data subjects receive all mandatory information about the processing of personal data. 91. New personal data generated in the course of a research project will fall within the scope of Article 14 of the GDPR and are not considered as collected directly from data subjects 142 . For example, a controller may in the course of scientific research undertake data analysis which generates new personal data that is derived from the personal data provided by data subjects. This could occur where a researcher diagnoses a data subject wit h a psychological condition, on the basis of personal data provided by the data subject. Other situations could be where researchers generate a pseudonym or derive a data point from an identification or social security number, or add additional information about data subjects, such as their gender. 92. When a controller provides personal data to another controller for scientific research purposes, it is a good practice for the providing and receiving controllers to cooperate and adopt measures that enable the receiving controller to fulfil its obligation s to inform. For example, the receiving controller may ask the providing controller to share the necessary information to the data subjects. An alternative can be that the initial controller may refer data subjects to information provided in accordance wit h Article 14 GDPR on the webpage of the receiving controller or another webpage. 93. If personal data is provided by intermediaries for scientific research purposes, for example where a provider of a research database collects personal data from several controllers that is thereafter provided to researchers conducting individual research p rojects, the EDPB considers it a good practice for all involved parties to agree on how to comply collectively with their transparency obligations 143 . 94. If a controller or processor receives pseudonymised data from another controller to be processed for scientific research, then the data subjects should be informed about how they can exercise their rights, for example by providing the pseudonym relating to their personal data 144 . Example 15 : Two controllers liaising in order to fulfil their transparency obligations A university wishes to study the mental and physical health and well - being of patients with symptoms of post - covid conditions. For this purpose, the university (being the controller for the data processing related to the research) wishes to use personal da ta retained by specialised health centres (being controllers for the data processing related to the provision of health care), that was originally collected for the purposes of providing health care. 142 Judgement of 28 November 2024, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC , C - 169/23, EU:C:2024:988, para. 49. 143 Depending on the context of scientific research and the set - up of the research infrastructure, it may be the case that several entities are joint controllers when intermediaries are collecting and providing personal data for scientific research purpose s. If it is determined that several entities are joint controllers, then they need to enter into an agreement that determine their res pective responsibilities for compliance with the obligations under the GDPR, pursuant to Article 26(1) GDPR. See further in s ection 7.3 . 144 Guidelines on pseudonymisation (version for public consultation, 16.1.2025) p. 79. 40 | Adopted - version for public consultation In this case, the health centre must provide information to the patients, i.e. the data subjects, about the transmission of their retained personal data in pseudonymised format to the university. The university must inform the patients of the processing of their personal data for the research. A good practice in this situation is for the university to liaise with the health centres, and provide the latter with information about their processing of personal data, where relevant with a reference to e.g. a webpage where all information can be found , that can be provided to the patients, as the health centres hold the contact details of data subjects. 5.4.2 Exceptions from the obligation to provide information (Article (14(5) GDPR) 95. Pursuant to Article 14(5) GDPR, a controller that did not collect personal data directly from the data subjects is in certain situations exempt from providing information. Circumstances relevant in the field of scientific research are detailed in the subse ctions below. 96. The exceptions in Article 14(5) GDPR must be interpreted restrictively and should not be relied on routinely 145 . 5.4.2.1 The data subject already has the information (Article 14(5)(a) GPDR) 97. As further explained in section 5.5 , it is not necessary to inform data subjects if they already have all the relevant information on the processing of personal data. In this respect, the same considerations apply regardless of whether a controller collects the personal data directly from t he data subject or not. The receiving controller should determine whether the data subject was sufficiently informed when it receives the personal data. 5.4.2.2 Provision of information proves impossible (Article 14(5)(b) GDPR) 98. There will be very few situations in which a data controller can demonstrate that it is actually impossible to provide the information to data subjects 146 . However, such situations may arise in the context of scientific research, for example when the controller, despite reasonable efforts, cannot obtain contact details of data subjects. 99. Even if a controller may be exempt from providing information to data subjects directly, the controller should still endeavour to provide information by other means, for example via a website or by advertising in relevant channels 147 . 5.4.2.3 Disproportionate effort (Article 14(5)(b) GDPR) 100. If a controller can demonstrate that it would require a disproportionate effort to inform the data subjects individually, it is exempt from doing so, pursuant to Article 14(5)(b) GDPR. In 145 See in this respect: Guidelines on transparency, paras. 57 and 61. 146 Guidelines on transparency, para. 59. 147 See further at para. 89 . 41 | Adopted - version for public consultation the field of scientific research, the following situations may in particular be associated with a disproportionate effort: • A high number of data subjects to inform 148 , for example large registries with patient data, population data or data on pupils accumulated nation - wide, while many contact details are outdated due to the age of the dataset. This exemption cannot be relied on if the controller can lawfully obtain a h igh number of contact details easily, for example through the use public registers 149 ; • Difficulties of finding the contact details of the data subject, for example if the contact details were collected a long time ago and might no longer be accurate and there are no reasonable means available to the controller to obtain current contact detai ls; or • The age of the personal data 150 , e.g. if the data set is older than 10 years. 101. When assessing the effort involved to provide the information to data subjects against the impact and effects on the data subject if they are not provided with the information directly 151 , the controller should consider the safeguards that it has adopted pursuant to Article 89(1) of the GDPR, as well as measures to provide information indirectly. 5.4.2.4 Individual information which is likely to render impossible or seriously impair the achievement of the scientific research objectives (Article 14(5)(b) GDPR) 102. There are certain types of research where the provision of individual information would render impossible or seriously impair the achievement of the objectives of a scientific research project. For example, the provision of information to data subjects may introduce bias to the research or otherwise negatively affect the quality of the personal data that is collected. In such circumstances, it may be justified to carry out so - called covert research, where it is allowed to not inform data subjects individual ly, pursuant to Article 14(5)(b) GDPR. 103. It should be noted that processing of personal for scientific research without individually informing the data subjects should only occur where it is strictly necessary, as it constitutes a serious interference with the fundamental rights and freedoms of d ata subjects. Accordingly, when controllers conduct covert research, they should adopt appropriate safeguards, pursuant to Article 89(1) GDPR, to counter - act that interference. Such safeguards may include ethical review or monitoring of the processing of p ersonal data, to ensure that it is conducted with due respect to the fundamental rights and freedoms of data subjects. While the provision of individual information during the course of research may render impossible or seriously impair the achievement of the objectives of a scientific research project, controllers should nonetheless provide public information on the 148 Recital 62 of the GDPR; Guidelines on transparency, para. 62. 149 This may be the case if digital mail boxes are used in the MS in question. See further at para. 88 , footnote 138 . 150 Guidelines on transparency, para. 63. 151 EDPB Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID - 19 outbreak, para. 37. 42 | Adopted - version for public consultation processing, as outlined above 152 . Alternatively, data subjects could be individually informed as soon as provision of information would no longer render impossible or seriously impair the scientific research objectives. Example 16 : Individual information which is likely to render impossible or seriously impair the achievement of a research project Researchers at a university faculty in the field of social sciences are carrying out research on public servants, such as medical staff, teachers and police officers, who report suspected parental child abuse to social services. The reports that are examin ed by the researchers contain highly sensitive data, including alleged physical and sexual misconduct and assault, information about sexuality, potentially criminal actions etc. that involves children as well as parents or guardians that are alleged or sus pected perpetrators. Under Article 14(1) GDPR, the researchers would normally be obliged to inform both the children and parents or guardians of the processing of personal data. However, the provision of such information would inevitably lead to the persons being alleged of ab use to object to the processing of their personal data. This would in turn render the research impossible or at the very least seriously impair the research. Therefore, the researchers determine that they can rely on the exception provided for in Article 1 4(5)(b) GDPR, in order to not inform the persons whose personal data is processed for the scientific research project. The researchers adopt safeguards to preserve the integrity of data subjects, including ethical approval, pseudonymisation of research data, storage of research data in secure storage facilities with strict data controls, as well as limited retention of res earch data following peer review and external scrutiny of research results. 5.4.2.5 Obtaining or disclosure is expressly laid down by Union or MS law (Article 14(5)(c) GDPR) 104. If, pursuant to Union or MS law, a controller must obtain or disclose personal data for scientific research purposes, and that law “ imposes on the controller a sufficiently comprehensive and binding obligation to provide to the data subject information relating to obtaining or disclosure of personal data ”, 153 then there is no separate obligation to inform the data subjects about the processing, at the condition that the information provided to data subjects is at least equivalent to that required by Articles 14(1) to (4) GDPR 154 . 152 See further at para. 89 . 153 C - 169/23, para. 44. 154 C - 169/23, para. 54. 43 | Adopted - version for public consultation 5.4.2.6 The personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or MS law, including a statutory obligation of secrecy (Article 14(5)(d) GDPR) 105. In the field of scientific research, the exception from providing information on processing of personal data due to obligations of secrecy might be more prevalent than in other fields of activity. This is because there may be statutory requirements that pr ohibit researchers from disclosing information on the processing of personal data to preserve the integrity of the research subject 155 . Such requirements are particularly important in situations where a research subject discloses sensitive personal data about a third person, the disclosure of which could render the relationship between the research subject and the third person problematic , or even endanger the research subject 156 . Example 17 : Confidentiality of information on processing of personal data due to statutory obligation of secrecy A research project is carried out on domestic violence and abuse in relationships. The method for gathering data is conducting interviews with potential victims. During such interviews, personal data is gathered on data subjects who might be alleged perpet rators of domestic violence and abuse. While the GDPR would normally require the controller to inform the data subjects who are alleged perpetrators, doing so could endanger the research participants who are being interviewed, i.e. the potential victims. For this reason, the researchers carryin g out the interviews are bound by a statutory obligation of secrecy, which the research participants are informed about before the interview. In turn, the rights and freedoms of the alleged perpetrators are also protected by mandatory safeguards provided for by the relevant law in question. These safeguards include pseudonymisation of all personal data, as well as a strict secrecy obligation tha t prohibits the researchers from disclosing the personal data to other parties, such as law enforcement authorities. 106. Another situation where a controller may be justified in not informing data subjects on the processing of their personal data is when a data subject has provided personal data for medical research and has requested, in line with national law, to not be informed about discoveries about their health or wellbeing 157 . While this may exclude a controller from disclosing information to data subjects about their medical conditions, they must still be 155 Guidelines on transparency, para. 67. 156 Moreover, if scientific research includes processing of personal data of persons that are alleged of criminal acts or abusive behaviour, the processing needs to be lawful under Article 10 of the GDPR and specific safeguards needs to be adopted to protect the right and freedoms of the alleged perpetrators. 157 Cf. Article 17(3) Recommendation (CM/Rec(2016)6) of the Committee of Ministers to member States on research on biological materials of human origin (11.5.2016). 44 | Adopted - version for public consultation informed about the fact that their personal data are being processed for scientific research purposes. 5.5 Changes to processing operations for scientific research purposes (Article 13(4) and 14(5)(a) GDPR) which data subjects have to be informed of 107. If a controller makes changes to its processing operations that renders the information previously provided to data subjects obsolete or incomplete, then it must inform the data subjects about those changes, pursuant to Article 13(4) and 14(5)(a) GDPR 158 . When determining whether it is necessary to inform data subjects about changes to processing operations, controllers should consider that a main objective of the principle of transparency is to ensure that the reasonable expectations of the data subjects are met. Conversely, there is no need to inform data subjects if they have already been sufficiently informed and if the changes would not go beyond the reasonable expectations of the data subjects 159 . 108. In the field of scientific research, changes to the processing of personal data that would require additional information include: • Making substantial changes to the objectives of a research project, leading to a change of the purposes of processing of personal data; • Determining that the personal data will be processed on the basis of a different legal basis than the initial one 160 ; • Changes to the identity of the controller – for example if a research laboratory merges with another laboratory, forming a new entity; • Engaging with new research partners that are not reasonably expected by a data subject and that will receive personal data, in particular if research partners outside the EEA are engaged resulting in transfer to third countries, or international organisati ons 161 ; • Extending the period of processing personal data, including storage, depending on how substantial the change is and what information on the period of retention that has been communicated to the data subject; 158 Guidelines on transparency, paras. 29 and 56. 159 Guidelines on transparency, para. 29. 160 EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 38. 161 Transfers to third countries, or international organisations, are subject to specific provisions in Chapter V of the GDPR. Fo r more information on what constitutes a transfer , see: Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR (Ver. 2.0, 14.2.2023) para. 9. 45 | Adopted - version for public consultation Example 18 : Extending the period of processing personal data, including storage When the sponsor of a research project collects personal data concerning health, it informs the data subjects that their personal data will be stored for a period of 7 years after the completion of the project. The participants are also informed that if ad ditional funding for research is made available, the storage period may be extended for another period of time to continue the project. In the information notice, it is specified that the data subjects will be notified about that extension, if the further storage will last for a significant period of time. Before the completion of the project, participants are informed that their data will be stored for an additional period of 7 years after the end of the storage period originally envisaged. • Changes to the risk profile for the processing of personal data, for example because of changes to the scientific methods or the use of novel or untested technology; • Adding categories of personal data to the data set used in a research project, that have not been communicated to the data subject previously; and • Changes to the interface for data subjects to be able to exercise their rights, such as introducing a dedicated platform for the purpose 162 . 109. In line with what is stated at para. 85 , information on upcoming changes should be provided to the data subjects in a timely manner before the changes are implemented, in order to enable the data subjects to exercise their rights under the GDPR 163 . 110. Conversely, changes that would normally not require any additional information to the data subjects include: • Regularly re - occurring studies that remain the same from time to time, such as annual surveys; • Inclusion of new research partners that belong to a category of recipients of personal data that has already been communicated to the data subject; and • Including processing of additional types of personal data belonging to a category of personal data that was previously communicated to the data subject. 6 Data subjects’ rights (Articles 15 - 21 GDPR) 111. Chapter III of the GDPR, on data subjects’ rights, includes two specific provisions that are of particular importance when controllers process personal data for scientific research purposes. These two provisions are Article 17(3)(d) GDPR that contains an e xception from 162 Guidelines on transparency, para. 29. 163 Guidelines on transparency, paras. 30 and 48. 46 | Adopted - version for public consultation the right to erasure under certain circumstances, and Article 21(6) that provides for specific rules for the right to object when processing personal data for scientific research purposes. These two specific provisions, as well as other provisions on data subjects’ rights in Chapter III of the GDPR that are relevant when personal data is processed for scientific research purposes, are addressed in the following section 164 . 6.1 General 112. While the GDPR establishes a general framework for data subjects’ rights, Union or MS law may provide for restrictions of Articles 12 - 22 GDPR pursuant to one of the objectives listed in Article 23(1) 165 . Moreover, Article 89(2) of the GDPR permits derogations – In Union or MS law – from the rights in Articles 15, 16, 18, 19 and 21, subject to the conditions and safeguards referred to in Article 89(1) 166 , in so far as the exercise of such rights are likely to render impossible or seriously impair the achievement of the specific scientific research purposes, and only if the derogations are necessary for the fulfilment of those purposes 167 . Therefore, controllers should determine if there are any restrictions or derogations under Union or MS law that limit the exercise of data subjects’ rights and inform data subjects of such restrictions or derogations when fulfilling their transparency obligations. Conversely, if Union or MS law provide for additional rights in accordance with the GDPR, for example an unconditional right to object to processing of personal data for certain scientific research purposes 168 , then controllers should adopt measures to be able to fulfil those extensions and inform data subjects thereof. 6.2 Right to erasure (right to be forgotten) (Article 17 GDPR) 113. If a data subject requests erasure of their personal data that are being processed for scientific research purposes, the controller should first establish whether any of grounds for erasure listed in Article 17(1) GDPR apply and, subsequently, whether an e xception to the right to erasure in accordance with Article 17(3) applies 169 . The grounds for erasure for personal data that are of particular interest in the field of scientific research are delineated in the following sub - section. 6.2.1 Grounds for erasure (Article 17(1) GDPR) 114. Article 17(1)(a) GDPR provides that personal data shall, on request of a data subject, be erased when it is no longer necessary in relation to the purpose for which they were collected 164 The current guidelines do not address Article 15 GDPR on the right of access by the data subject. Guidance on the right of access is provided in EDPB Guidelines 01/2022 on data subject rights – Right of access (Version 2.1, 28.3.2023). 165 Restrictions, pursuant to Article 23 GDPR, in the context of processing for scientific research purposes may in particular be relevant for safeguarding important objectives of general public interest of the Union or of a MS as listed in Article 23(1)( e) a nd (i) GDPR. Moreover, any restriction must comply with the requirements of Article 23(2) GDPR. For more information on the application of Article 23 GPDR, see: Guidelines 10/2020 on restrictions under Article 23 GDPR (version 2.1, 13.10.2021). 166 See further in section 8 . 167 Examples of derogations in MS law, pursuant to Article 89(2) of the GDPR include: Article 22(2) of the Danish Data Protection Act; Section 31 of the Finnish Data Protection Act (1050/2018); and Section 110(2) of the Italian Personal Data Protection Co de. This list is not exhaustive as to the derogations in Union or MS law, pursuant to Article 89(2) GDPR, that apply when process ing personal data for scientific research purposes. The EDPB has not reviewed nor analysed the laws referred to. 168 See, for example, Article 71 EHDS; 169 See further in section 6.2.2 . 47 | Adopted - version for public consultation or otherwise processed. In this regard, it may be relevant to continue processing personal data for scientific research purposes after finalisation of a research project, for example if it is necessary for reproducibility of research results. It may also b e necessary to retain personal data for scientific research purposes if that data is used in multiple research projects. Moreover, if a data subject had previously objected to the processing of personal data for scientific research purposes, pursuant to Ar ticle 21(6) GDPR, then the data subject can also request the controller to delete the data, pursuant to Article 17(1)(a). 115. Article 17(1)(b) GDPR provides that if the data subject withdraws the consent on which the processing is based, according to Article 6(1)(a) (and Article 9(2)(a) GDPR, when special categories of data are processed), then the personal data shall be erased a t the request of the data subject. Unless there is another legal basis that justifies continued retention of the data, personal data must be erased following withdrawal of consent. 116. Pursuant to Article 17(1)(c) GDPR, data subjects have the right to have their personal data erased if they objected to the processing pursuant to Article 21(1) and no overriding legitimate grounds for the processing apply. Thus, the exercise of the right t o request erasure on the basis of Article (17(1)(c) is dependent on a preceding exercise of the right to object, which is explained further below 170 . When applying Article 17(1)(c), controllers should consider relevant guidance from the Guidelines on legitimate interest: “ […] the criteria to determine whether an objection or an erasure request should be granted are essentially the same under Article 21 and Article 17 (i.e., the request should be granted unless one can demonstrate “overriding legitimate grounds”). This implies t hat, as a rule, if an objection under Article 21(1) GDPR is granted, a related erasure request under Article 17(1)(c) GDPR should also be granted ” 171 . 117. Article 17(1)(e) of the GPDR provides that personal data have to be erased for compliance with a legal obligation in Union or MS law. This ground for erasure may, for example, be relevant if Union or MS law sets up specific data retention periods for perso nal data that is processed for scientific research purposes. 6.2.2 Exceptions from the obligation to erase personal data upon request (Article 17(3) GDPR) 118. According to Article 17(3) GDPR, a controller can reject a request for erasure if the processing of personal data is necessary for any of the grounds listed in that provision 172 . These grounds may also apply to processing of personal data for scientific research purposes 173 . 170 Judgment of 4 October 2024, Agentsia po vpisvaniyata v OL , C - 200/23, EU:C:2024:827, para. 120; Judgement of 7 December 2023, UF and AB v Land Hessen , joined cases C - 26/22 and C - 64/22, EU:C:2023:958, para. 111 - 112; See also further in section 6.3 . 171 Guidelines on legitimate interest, para. 79. 172 For guidance on how to perform the necessity test, see inter alia : EDPS, Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit (2017). 173 In order to rely on the exceptions to the right to erasure under Article 17(3)(b) or (c) GDPR, the Union or MS law on which the processing is based should clearly identify the scientific research area and be in accordance with the conditions laid do wn in Article 6(3) and, where applicable, Article 9(2). 48 | Adopted - version for public consultation 119. Necessity, in the first sub - sentence of Article 17(3) GDPR, must be interpreted restrictively. Accordingly, a controller must be able to show that the processing of the personal data involved is strictly necessary for the application of any of the exception grounds under Article 17(3) GDPR 174 . 120. Article 17(3)(d) GDPR provides for a specific exception from the right to erasure if the processing is necessary for scientific research purposes, in accordance with Article 89(1) GDPR. In addition to assessing the strict necessity of processing of persona l data in relation to the scientific research purpose, the controller must also assess the individual circumstances in each request of a data subject when applying Article 17(1)(d) GDPR. To that end, Article 17(3)(d) GDPR should only be applied in limited circumstances, as it is only when erasure is likely to render impossible or seriously impair the achievement of the scientific research purposes that it is possible for a controller to reject a request for erasure 175 . For example, if a controller processes personal data from a large number of data subjects, requests of data subjects for erasure of their personal data may not make it impossible or seriously impair the achievement of the scientific research purposes. How ever, if a controller uses personal data from a small number of data subjects, where the personal data of each data subject is of significant importance for the outcome of a research project, then it is more likely that the controller is justified in relyi ng on Article 17(3)(d) of the GDPR and reject a request for erasure. A request for erasure of personal data may also make it impossible or seriously impair the achievement of the scientific research purposes if the controller researches developments or tre nds over a longer period of time and the request is received while the research is still in progress. Example 19 : Rejecting a request of erasure on the basis of Article 17(3)(d) of the GDPR A private research institute is conducting scientific research on the historical development of a software that is publicly available in an open - source format in the shape of a merkle tree, which displays the development history of the software. When searc hing the merkle tree, it is possible to see the names of the developers of the software at any given point in time. 174 C - 200/23, para. 124; C - 13/16, para. 30; As to the interpretative rule that exceptions in EU law should be interpreted restrictively, see: Judgement of 22 April 2010, European Commission v United Kingdom of Great Britain and Northern Ireland , C - 346/08, EU:C:2010:213, para. 39. 175 In this regard, the wording render impossible or seriously impair implies a high threshold for a controller to reject a request for erasure, on the basis of Article 17(3)(d) GDPR. For a similar reasoning, see: Guidelines on legitimate interest, para. 73 and 79; See also above at para. 160. 49 | Adopted - version for public consultation The research institute receives a request from a software developer to delete an entry in which he is cited as a co - author, because the developer has changed his first name and considers that retaining his old first name for such a long time violates his r ight to private life. However, as the research needs to reflect the historical facts of the development of the software at any given point in time, including which individual software developers were involved, the research institute avails itself of the de rogation provided for in Article 17(3)(d) of the GDPR and rejects the request, on the basis that erasure is likely to seriously impair the achievement of the objectives of the research project. 121. If a controller anticipates that it will apply one of the exceptions from the obligation to erase personal data upon request, pursuant to Article 17(3) GDPR, then the controller should inform data subjects when fulfilling its transparency obligations 176 . 6.3 Right to object (Article 21 GDPR) 122. According to Article 21(1) GDPR, a data subject may at any time object to the processing of personal data, on grounds relating to their particular situation 177 , insofar as the processing is based on either Articles 6(1)(e) or (f). 123. If a data subject exercises his or her right to object under Article 21(1) GDPR, then the controller must grant such a request, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. The EDPB underlines that it is the controller that has the burden to prove the existence of compelling legitimate grounds and balance these grounds in relation to the particul ar situation of the data subject 178 . 124. Article 21(6) GDPR specifies the provisions of Article 21(1) for objections directed towards processing of personal data for scientific research purposes, thus limiting the right to object to processing operations based on Article 6(1)(e) or (f). Pursuant to Article 21(6) GDPR, a controller may reject a data subject’s objection to the processing of their personal data for scientific research purposes if the processing is necessary for the performance of a task carried out for reasons of public interest. Mor eover, controllers should consider any specific provisions in Union or MS law that may complement the provisions of Article 21(6) GDPR. 125. The possibility to reject an objection, pursuant to Article 21(6) GDPR, is not limited to public interest in the meaning of Article (6)(1)(e). A controller relying on legitimate interest, pursuant to Article 6(1)(f) GDPR, can also reject an objection under Article 21(6) if the controller can demonstrate that the processing of personal data for scientific research purposes is a legitimate interest that coincides with a public interest 179 . 176 See further in section 5 . 177 Judgement of 9 March 2017, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni , C - 398/15, EU:C:2017:197, p. 47; I.e. personal, social or professional reasons: Guidelines on Automated individual decision - making and Profiling for the purposes of Regulation 2016/679 (WP251rev.01, endorsed by the EDPB on 25 May 2018) p. 19. 178 Joined Cases C - 26/22 and C - 64/22, para. 111. 179 Guidelines on legitimate interest, para. 25. 50 | Adopted - version for public consultation 126. Necessity must be interpreted restrictively 180 . Accordingly, a controller must be able to show that the processing of the personal data involved is strictly necessary for performing a task carried out for reasons of public interest, entailing scientific research purposes, and that the task cannot be carried out, or not be carried out as efficiently 181 , unless that data is processed 182 . In this regard, the context and nature of the scientific research activities and the reasons of public interest pursued will be determinative for the assessment of necessity. Similar as under the right to erasure, the number of data subjects is relevant w hen assessing necessity of processing 183 . 127. Moreover, the controller should verify whether the processing of personal data related to the specific objection remains necessary for the performance of a task carried out for reasons of public interest at the time when the request is made 184 . In this regard, the controller should, among other things, consider the data protection principles – in particular data minimisation 185 – and the progress of the scientific research activities since the start of the processing operations. 128. If a controller determines that it is necessary to process the personal data in question for scientific research purposes, it should nonetheless consider the particular situation of the data subject who objected to the processing 186 . To that end, data subjects should be enabled to present their particular situation, including personal, social or professional circumstances, which distinguishes them from other data subjects. Such circumstances could, for example, be suffering from a rar e disease, which may render a data subject identifiable even if their data are pseudonymised, or being in a family relation with a researcher, which could enable unwarranted identification of the data subject 187 . However, the fact that a data subject did not elaborate much on their particular situation in the objection is not sufficient for a controller to dismiss an objection per se and sometimes the particular situation may be obvious from the context of processing. If the controller has doubts as to the pa rticular situation of a data subject, it may ask the data subject to further specify their request 188 . 7 Attribution of responsibility (controller and processor) 129. The EDPB’s Guidelines 7/2020 on the concepts of controller and processor in the GDPR provide general guidance on the attribution of responsibility when processing personal data. 180 See also para. 119 . 181 C - 524/06, para. 62; C - 184/20, p. 85. 182 C - 13/16, para. 30. 183 See also para. 120 . 184 See, for a similar reasoning: Guidelines on Automated individual decision - making and Profiling, page 19. 185 Article 5(1)(c) GDPR; C - 184/20, p. 93. 186 Guidelines on legitimate interest, para. 74. 187 C - 200/23, para. 125. 188 Guidelines on legitimate interest, para. 71. 51 | Adopted - version for public consultation The following section provides additional guidance and examples relevant to the processing of personal data for scientific research purposes 189 . 130. The roles of controller, joint controller and processor are crucial in the application of the GDPR, since the attribution of roles determines which entity is responsible for compliance with the different provisions of the GDPR and how data subjects can exe rcise their rights in practice 190 . The EDPB underlines that the determination of roles is functional and aims to allocate responsibilities according to the actual roles of the entities 191 . Therefore, while the Guidelines provide examples and guidance to help entities determine their responsibilities under the GDPR when processing personal data for scientific research purposes, each entity must still assess and be able to demonstrate 192 their own responsibility for the particular processing operations in which they are involved 193 . 131. Where personal data is processed for scientific research purposes involving several entities, it is necessary to assess and document how responsibility is allocated among the entities. The determination may be particularly relevant where multiple actors ar e involved in drafting scientific research protocols, such as sponsors, hospitals, private companies etc., or in the case of public - private partnerships (PPPs). 7.1 Controller 132. The controller is the entity that decides on the purpose and the essential elements of the means of the processing 194 , i.e. the reasons of and the ways in which processing of personal data is carried out. However, the non - essential means of the processing, including certain practical aspects of implementation (such as the choice of the software to be used, etc.) may be left to a processor 195 . 133. Where Union or MS law designates a controller, such designation is determinative for attributing responsibility 196 . The determination of the purposes and means of processing must not be explicit in the law but can be implicit. If implicit, the determination must be sufficiently certain from the role, task and powers conferred on the controller 197 . That condition is met if the purposes and means arise, in essence, from the provisions of the law governing the activity of th e controller 198 . 134. If the processing of personal data is to be undertaken in the framework of a scientific research protocol, the EDPB notes that active participation in the determination and the definition of a 189 Guidelines (07/2020) on the concepts of controller and processor in the GDPR (Guidelines on controller and processor) (Version 2.1, 7.7.2021). If sub - processors are involved in the processing of personal data, controllers should consider the guidance prov ided in Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s) (7.10.2024). 190 Guidelines on controller and processor, para. 2. 191 Guidelines on controller and processor, para. 11. 192 In line with the principle of accountability, pursuant to Article 5(2) and 24(1) GDPR. 193 Guidelines on controller and processor, para. 12. 194 Article 4(7) GDPR. 195 Guidelines on controller and processor, para. 40. 196 Judgment of 27 February 2025, Amt der Tiroler Landesregierung v Datenschutzbehörde and Others , C - 638/23, EU:C:2025:127, paras. 42 - 47 ; Guidelines on controller and processor, para. 23 . 197 C - 638/23, para. 28. 198 C - 638/23, para. 37. 52 | Adopted - version for public consultation scientific research protocol, by clearly determining the purpose and essential elements of the means to achieve the objectives pursued, would normally qualify an entity as a controller for the processing of personal data within the meaning of the GDPR. How ever, the EDPB highlights that the fact that an organisation provides research funding or is consulted in the process of drafting a research protocol (e.g. as an independent consultant, expert, ethical committee etc.) is not in itself sufficient to attribu te the role of a controller (or joint controller 199 ). 135. I t is not necessary for the attribution of responsibility for an entity or an individual to actually process personal data 200 . Therefore, an entity or an individual may be qualified as a controller even though it does not process personal data at all, only process personal data to a limited extent, or only process pseudonymised data. 136. One example in this regard is clinical trials, where most of the processing of directly identifiable personal data takes place at a clinical trial site, such as a health care facility. The sponsor, which mainly process pseudonymised data, is nonetheless st ill regarded as a controller (or a joint - controller) because it determines purposes and means of processing personal data in a clinical trial, in particular in relation to the drafting of the trial protocol. 201 Another example is if a trusted data holder processes personal data on behalf of one (or several) controllers 202 . The use of a trusted data holder may be relevant in scientific research activities as a safeguard, to ensure the security of personal data and for maintaining efficient access controls 203 . 137. Typically, it is a legal person that determines the purposes and essential means of processing. When processing personal data for scientific research purposes, this could be a research institute, a hospital, a university a commercial company or a non - profi t research organisation. This means that individual researchers, such as researching healthcare staff, laboratory technicians or other persons involved in scientific research are generally not considered controllers, but rather acting under the authority o f a controller 204 . Exceptionally, there may be circumstances where researchers as natural persons are considered controllers for the processing of personal data in their own right. This may be the case when the research is carried out at a small healthcare facility or by a researcher that is conducting research in full independence with no affiliation to any research organisation. 199 See further in section 7.3 . 200 Judgement of 5 June 2018, Unabhängiges Landeszentrum für Datenschutz Schleswig - Holstein v Wirtschaftsakademie Schleswig - Holstein GmbH , C - 210/16, EU:C:2018:388, para. 38 ; Guidelines on controller and processor, para. 45. 201 The European commission has proposed that sponsors of clinical trials for medicinal products should be designated as controllers for certain processing operations. See: Article 58(48) of the Proposal for a R egulation of the European Parliament and of the Council on establishing a framework of measures for strengthening Union’s biotechnology and biomanufacturing sectors particularly in the area of health and amending Regulations (EC) No 178/2002, (EC) No 1394/2007, (EU) No 536/2014, (EU) 2019/6, (EU) 2024/795 and ( EU) 2024/1938 (European Biotech Act) . 202 Those controllers may, depending on the circumstances, also be joint controllers. See further in section 7.3 . 203 See further in section 8.5 . 204 Article 29 GDPR; Guidelines on controller and processor, para. 19; See also, for a similar reasoning: EDPB - EDPS Joint Opinion 3/ 2026 , para. 25. 53 | Adopted - version for public consultation Example 20 : A controller processing personal data for scientific research purposes – Survey services Rapid Survey is a private company that offers research and survey services. One of the services that the company offers is providing contact details to potential respondents of surveys. When Rapid Survey’s services are procured, a notification is sent out to respondents who can choose to participate or not in the survey at hand. A private research institute is conducting a research project in the field of political sciences concerning the political views of citizens. To complete the project, it needs to gather various data points from data subjects, including their preferences in current political issues, as well as demographical data. The research institute procures the services of Rapid Survey, but wants to design the survey and manage all the contacts with the respondents. Therefore, they pay a fee to get access to contact detai ls of Rapid Survey’s respondents, which are provided by the company. In this situation, the private research institute and Rapid Survey are separate controllers. Rapid Survey is the controller for managing and providing the list of contact details to its’ respondents. When the research institute has gotten access to this li st, it becomes the controller for all the subsequent processing operations. Example 21 : A controller processing personal data for scientific research purposes – Commercial entity When data subjects sign up for membership to a large chain of fitness studios, they are asked a question whether they provide broad consent to provide their personal data (following pseudonymisation) for certain research projects in the research field of sports medicine. Consenting to provision of data is not a condition for membership and da ta subjects can at any time withdraw their consent, either online through a membership portal, or by contacting their local fitness studio. The consent covers a certain area of research (sports medicine) and all research projects within that area. All rese arch projects must be approved by an internal committee that has been set up by the fitness studio chain and is advised by consultants with academic qualifications. Additionally, consent must be renewed every three years. When the fitness studio chain provides personal data from their members to individual research projects, it is acting as a controller and responsible for that provision of data, for scientific research purposes. After the personal data has been provided, however, it is the entity that requests the data and conducts the research that becomes the controller. 54 | Adopted - version for public consultation Example 22 : Separate controllers processing personal data for scientific research purposes – Research database A pharmaceutical company gets access to research data, including personal data, from a research database operated by a public university. The database contains pseudonymised health data and other relevant research data that a number of hospitals have made available to the university. The database may, pursuant to MS law, be used by public and private researchers for scientific research purposes in various fields of medical research, provided that certain conditions are met (scientific merits of individual r esearch projects, adherence to ethical standards, strict rules on data use, non - disclosure to third parties etc.). The database is a research infrastructure that is set up in parallel to the EHDS. In line with the conditions of access and following the adoption of safeguards, pursuant to Article 89(1) GDPR, the pharmaceutical company accesses the database to retrieve research data, including personal data, which it intends to combine with research d ata obtained from a number of concluded clinical trials. On the basis of the combined research data set, the pharmaceutical company will conduct scientific research for subsequent development of a pharmaceutical. The public university determines which personal data are to be collected, retained and made available for scientific research purposes, including under which conditions. Thus, the university determines the purposes and essential means for the processing op erations necessary for the collection and operation of the database, as well for making data available for scientific research projects. For those processing operations, the public university is considered an independent controller. When researchers or researching organisations access the personal data contained in the database for their own research purposes, they are independent controllers for the processing of personal data, as they determine what data are to be accessed and for w hich specific purposes. For this reason, the pharmaceutical company is considered an independent controller when it accesses the database to obtain personal data for scientific research purposes. 7.2 Processor 138. A processor is an entity that is separate from a controller and that processes personal data on behalf of a controller 205 . A processor may only process personal data in line with an agreement, or other legal act under EU or MS law, between the controller and the processor 206 . It may not process the personal data covered by the agreement beyond the controller’s instructions, but a processor may still have a certain margin of discretion with regards to adopting the most suitable technical and organisational means (non - essential 207 ) 205 Article 4(8) GDPR; Guidelines on controller and processor, para. 76 206 Article 28(3) GDPR. 207 Guidelines on controller and processor, para. 39 - 41. 55 | Adopted - version for public consultation to best serve the controller’s interests 208 . If a processor goes beyond the controller’s explicit instructions, by determining its own purposes and essential elements of the means, a GDPR infringement would occur and the processor would then be considered as a controller in respect of that processi ng 209 , potentially being subject to corrective measures or liability for infringing the GDPR. 139. In the context of processing of personal data for scientific research, different entities can act as processors, e.g. a research institution, a hospital, a software service provider, a contract research organisation (CRO) or an individual researcher (exter nal to the controller). While several entities are often co - operatively involved in the processing of personal data for scientific research purposes, this does not necessarily mean that any of the entities involved are to be regarded as processors as they can, depending on the circumstances, instead be joint controllers 210 . Example 23 : A processor processing personal data for scientific research purposes - contract research organisation (CRO) A specialised contract research organisation (CRO) provides different services to a sponsor of a clinical trial on a new vaccine. These services include monitoring of the study, translation of study documents, statistical analysis and maintaining the trial master file, including curation of relevant research data and deletion of unnecessary data. The sponsor defines the purpose and the essential means of the clinical trial in the research protocol and therefore acts as controller. The CRO provides the services on the basis of a service contract and processes personal data only as instructed by the sponsor, although the CRO has certain leeway in terms of non - essential means, for example deleting obtained research data that is not necessary for performing clinical trial. As a result, the CRO processes the personal data in the capacity as a processor o n behalf of the sponsor. Example 24 : A processor processing personal data for scientific research purposes – Survey services A research team in a university faculty wants to use a service offered by Rapid Surveys, a private company that offers research and survey services. The service in question consists of recruitment of respondents to a survey for a research project. For his pu rpose, Rapid Surveys has recruited persons who answer surveys on regular basis, in exchange for a small fee. 208 Guidelines on controller and processor, paras. 80. 209 Art. 28(10) GDPR. 210 See further in section 7.3 . 56 | Adopted - version for public consultation The research team designs a survey for a research project and procures the services of Rapid Surveys. Rapid Surveys gives the research team advice on which questions it could pose to the respondents, but it is ultimately the research team that decides on w hich questions to ask and therefore which personal data that needs to be collected. Rapid Surveys uses its own software and conducts the survey with data subjects who have signed up as respondents. When the survey is completed, Rapid Surveys transmits the results of the completed survey, including pseudonymised meta - data that enables the research team to correlate the answer to different categories of data subjects (such as gender, socio - economic conditions, area of residence, etc.). In this situation, the university faculty is a controller and Rapid Surveys is a processor. This is because even though Rapid Surveys decide on certain aspects of the processing of personal data (such as choice of it - system and offers a set of standardised technical security measures), it is ultimately the research team operating at the university faculty that decides the purposes and essential means, including which personal data are to be processed. 7.3 Joint controllers 140. Joint controllership occurs when two or more entities participate jointly in the determination of the purposes and essential elements of the means of processing. 211 An essential criterion for joint controllership is that the processing of personal data would not be possible without the entities’ concurrent involvement, meaning that the respective entities’ processing is inextricably linked. One way to identify conver ging decisions is to determine whether the processing would not be possible without both (or more) entities’ participation in the purposes and essential elements of the means of one or more processing operations, in the sense that the processing by each pa rty is somehow inseparable 212 . Several entities can also be explicitly or implicitly designated as joint controllers by Union or MS law 213 . 141. If several parties participate jointly in the drafting of a research protocol that determines the purposes and essential means of processing of personal data, this may suffice for all the entities involved to be considered joint controllers, even if the ac tual research and the processing of personal data is only carried out by one or some of the entities involved 214 . In such a context of processing, it is not necessary for all the entities involved to have an equally active participation in the determination of the purpose and essential elements of the means in order to qualify as joint controllers 215 . 142. Agreeing to and consequently adhering to an already established research protocol or study, without participating in the determination of the purposes and means of processing, is not always sufficient to create a situation of joint controllership within th e meaning of Article 26(1) 211 Article 26(1) GDPR. 212 Guidelines on controller and processor, para. 55. 213 EDPB - EDPS Joint Opinion 3/ 2026 , paras. 22 and 23; See also at para. 133 . 214 Guidelines on controller and processor, page 23 – Example on clinical trials; As mentioned in para. 135 , it is not necessary for any of the controllers to actually process personal data to be qualified as controllers. 215 See Judgement of 10 July 2018, Tietosuojavaltuutettu v Jehovan todistajat — uskonnollinen yhdyskunta, C ‑ 25/17, EU:C:2018:551, para. 66. 57 | Adopted - version for public consultation GDPR. Instead, this situation may be indicative of a relationship between a controller and processor. 143. If several parties carrying out the research are joint controllers, they can generally rely on the same legal basis. However, the GDPR does not preclude that different joint controllers rely on different legal bases, depending on their applicability to a g iven processing operation 216 . 144. The allocation of responsibilities must be laid down in an agreement between the joint controllers 217 , that must be made available to data subjects 218 . When multiple stakeholders involved in a research project within the scope of a common research protocol, the roles and responsibilities of the various entities should be clearly defined and clarified through an arrangement that reflect each entity’s dif ferent responsibility. In this regard, the CJEU has clarified that various entities may be involved at different stages of processing, and to different degrees, so that the level of responsibility of each entity must be assessed with regard to all the rele vant circumstances of the particular case 219 . If there are differing levels of responsibility, this must be reflected in the agreement, pursuant to Article 26(2) GDPR, and transparently communicated to the data subjects. In addition, even though controllers’ individual responsibilities under the GDPR may differ, data subjects retain their right to exercise their rights 220 , or claim compensation for any damage caused by the processing of personal data 221 , towards any joint controller. 145. If any of the joint controllers intends to procure a processor to process personal data on their behalf, procurement should be done in line with conditions agreed upon by the joint controllers in their agreement, pursuant to Article 28(1) GDPR 222 . Example 25 : Joint controllers processing personal data in the context of a non - interventional observational clinical study – Research consortium A research consortium pursues a joint research project on the quality and efficacy of an oncological treatment scheme, that is the prescribed method for treating lymphoma in a Member State. The research consortium involves a commercial pharmaceutical compa ny, several university hospitals and a private research institute. 216 Guidelines on controller and processor, para. 166 and footnote 73. 217 Article 26(1) GDPR. 218 Article 26(2) GDPR. 219 Judgement of 7 March 2024, IAB Europe v Gegevensbeschermingsautoriteit , C - 604/22, EU:C:2024:214, para. 58. 220 Article 26(3) GDPR. 221 Article 82(4) GDPR. 222 Guidelines on controller and processor, para. 166. 58 | Adopted - version for public consultation The research consortium sets out its research activities in a research protocol which includes the setting up of a jointly - operated database and a non - interventional observational study to be conducted at the different university hospitals. The research ac tivities also include several sub - projects to be undertaken following the conclusion of the observational study. The research protocol, which was drafted and approved jointly by all consortium partners, sets out the common purposes and methodology for the study, which research data (including personal data) that is to be collected and processed, criteria for inclusion/exclusion of research participants, permitted further use of the data for future research, etc. The university hospitals provide staff and facilities for conducting the observational study. They also collect personal data (e.g. medical history, demographics, and health status) from the patients that participate in the research project. The research d ata is not gathered in a central database, but is instead made available through a database that has a unified interface to access data from several independent databases, without consolidating or transferring the data. The database is jointly operated by a steering committee with representatives from all partners to the research consortium, who are equal in terms of decision - making. Because the observational study is conducted in accordance with the same research protocol and methodology, all parties to the research consortium should be considered as joint controllers for the processing of personal data for scientific research purpose s within the scope of the study. Furthermore, because the processing of personal data in the database is decided on and operated jointly by all partners of the research consortium, and since all data retained in that database are inseparable for the purpos es of conducting further research, all partners to the research consortium are joint controllers for the processing of personal in the federated database that is necessary to make personal data available to the consortium partners for future research activ ities. The respective university hospitals are independent controllers for the processing of personal data that is necessary for the purpose of providing healthcare, under national law and outside the scope of the observational study. Following the conclusion of the observational study, a number of sub - projects are initiated, using data stored in the federated database, as well as data from other sources. The sub - projects are undertaken in different constellations, involving co - operatio n between the different parties to research individual questions related to medical treatment of lymphoma. The partners to the research consortium are joint controllers when undertaking research in sub - projects subsequent to the conclusion of the observati onal study, but they are so only in their respective constellations. 59 | Adopted - version for public consultation After the research consortium has finalised the research to be undertaken within the scope of the research protocol, the pharmaceutical company initiates a project to develop a pharmaceutical product to treat side - effects associated with medical treatment of lymphoma. This project is undertaken unilaterally by the pharmaceutical company without the involvement of the research consortium partners. Accordingly, the pharmaceutical company is responsible for processing of personal data for this purpose as an in dependent controller. In so far as any partner to the research consortium has sub - contracted any external IT service providers to process personal data on their behalf, those service providers are regarded as processors, in line with Article 28(1) GDPR, and may only be procured in line with the conditions set out in the agreement between the entities, pursuant to Article 26(1) GDPR. 8 Appropriate safeguards (Article 89(1) of the GDPR) 146. Article 89(1) GDPR requires controllers to adopt of appropriate safeguards to ensure the rights and freedoms of data subjects. How controllers should apply Article 89(1) GDPR when processing personal data for scientific research purposes is explained in th e current section. 147. Safeguards pursuant to Article 89(1) GDPR entail that technical and organisational measures are in place, in particular to ensure respect for the principle of data minimisation, when personal data is processed for scientific research purposes 223 . While Article 89(1) GDPR provides that personal data should be anonymised or pseudonymised, as long as the scientific research purposes can be achieved if the data is processed in that manner 224 , that provision also requires the adoption of other types of appropriate safeguards, adapted to the specific scientific research purposes for which personal data are processed. This applies irrespective of the legal basis that the processing of personal d ata is based upon. Moreover, if personal data is further processed for scientific research purposes, controllers should assess whether the safeguards applied to the initial processing are adequate for the further processing. 8.1 General 148. Safeguards adopted under Article 89(1) GDPR must be assessed in relation to the nature, scope, context, purposes and risks of the scientific research activities. The safeguards should contribute to the fulfilment of the data protection principles, the requ irements of data protection by design and default, as well as ensure that the rights and freedoms of data subjects are guaranteed. While it is the responsibility of the controller to determine and 223 Article 89(1) GDPR should be read in conjunction with Recital 156. 224 See further in section 8.3 . 60 | Adopted - version for public consultation implement appropriate safeguards, Union or MS law may provide for specific safeguards to be adopted by controllers, when processing personal data for scientific research purposes 225 . 149. Apart from the adoption of safeguards pursuant to Article 89(1) GDPR, controllers processing personal data for scientific research purposes must always adopt the general safeguards and measures required by the GDPR to minimise any negative impact of proces sing, in line with – inter alia – Articles 5, 24, 25 and 32 of the GDPR. Such measures include, amongst others: • assessing the risks of the processing or carrying out a data protection impact assessment (DPIA) when required 226 ; • appointing a data protection officer (DPO) when required; • implementing technical and organisational measures for data security, including the establishment of procedures and policies to regularly assess the effectiveness of those measures; and • defining the distribution of tasks in the processing of personal data between organisational units and employees, etc. 150. General measures and safeguards adopted by the controller may, depending on how they are designed and implemented, in some cases overlap with and satisfy both the provisions mentioned in para. 149 and Article 89(1) GDPR. For example, access controls that limit access to personal data used in scientific research to researching staff only, may satisfy the requirements under both Articles 32 and 89(1) of the GDPR. 8.2 Risk analysis and data protection impact assessment (DPIA) 151. The starting point for adopting appropriate safeguards, pursuant to Article 89(1) GDPR, is conducting a risk analysis or – when required – a DPIA 227 . When assessing risks to rights and freedoms of data subjects and determining appropriate safeguards, it is important that controllers look beyond the scope of the right to private life and protection of personal data 228 . Risks to other fundamental rights and freedoms should also be considered 229 . In particular in the field of medical research, if the processing of personal data for scientific research purposes impacts or may impact the provision of health care to a data subject (e.g. if a medical condition is identified), controllers should consid er implementing measures for 225 Specific safeguards required by Union or MS law may be may be prescribed together with a legal basis that can be relied on for the processing of personal data for scientific research purposes. Safeguards can also be provided in Union or MS law together wi th a derogation from the prohibition of processing of special categories of personal data for scientific research purposes, in accordance with Article 9 (2) (g), (i) or (j) of the GPDR. Finally, Article 89 (1) GDPR can be linked to Article 9 (4), which all ows MSs to adopt national legislation with additional conditions for the processing of genetic data, biometric data and data concerning health. 226 See further in section 8.2 . 227 See Article 29 Working Party’s Guidelines on Data Protection Impact Assessment (DPIA) (WP 248 rev.01) (Guidelines on DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679. 228 Articles 7 and 8 CFREU. 229 Cf. Guidelines 4/2019 on Article 25 - Data Protection by Design and Default (Version 2.0, 20.10.2020) paras. 11 - 12. 61 | Adopted - version for public consultation informing data subjects, taking into account the wishes of data subjects not to be informed about findings that are relevant for their health, in accordance with applicable Union or MS law 230 . 152. When identifying data protection risks, controllers should in particular pay attention to the amount of personal data processed, the type of personal data 231 , whether the collected personal data is combined with other data sets, if the personal data will be retained following a research project, potential risks of re - identification of data subjects – including when providing data to research partners or other recipients – risks associated with publishing or sharing research results, as well as the controller’s relationship with the data subjects, in particular if the data subject is in a disadvantaged position in relation to the controller. 153. Potential consequences of the scientific research, such as adverse outcomes for the data subjects, should also be considered. If possible, the controller should consider the impact on individual data subjects, in particular individuals belonging to vulnera ble or disenfranchised categories or groups of data subjects. The controller should also consider if the processing of personal data may affect persons related to the data subject, such as family members or friends. Adverse outcomes could be exclusion or d iscrimination against individuals, defamation, stigmatisation, loss of confidentiality of personal data or damage to reputation 232 . 8.3 Anonymisation and pseudonymisation of personal data 154. A basic data protection principle of the GDPR is data minimisation, pursuant to Article 5(1)(c) GDPR. According to the principle of data minimisation, personal data shall be “ adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ”. Thus, when processing personal data for scientific research purposes, controllers must determine which data are strictly necessary to process 233 . 155. Data minimisation is emphasised in Article 89(1) GDPR, which states that where the scientific research purposes “[…] can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner .” Article 89(1) GDPR also states that the technical or organisational measures to be adopted for data minimisation “[…] may include pseudonymisation provided that those purposes can be fulfilled in that manner .” 156. Consequently, personal data processed for scientific research should in the first place be anonymised , as long as the purposes of processing can be fulfilled using anonymised data. Information that is considered anonymised data , within the meaning of the GDPR, is information that does not (or no longer) relate to an identified or identifiable natural person or is rendered anonymous in such a manner that the data subject is not or no longer identifiable 234 , which brings any subsequent processing of the data outside the scope of the 230 Cf. Article 17(3) Recommendation (CM/Rec(2016)6) of the Committee of Ministers to member States on research on biological materials of human origin (11.5.2016). 231 Concerning genetic and biometric data, see further in section 8.4 . 232 Recital 75 GDPR. 233 Judgment of 24 February 2022, SIA 'SS' v Valsts ieņēmumu dienests , C - 175/20, EU:C:2022:124, para. 72 - 74. 234 Recital 26 GDPR; See also Article 29 Working Party, Opinion 05/2014 on Anonymisation Techniques (WP216) p. 5. 62 | Adopted - version for public consultation GDPR. The anonymisation process itself, however, is a processing operation under the GDPR that must comply with the provisions of the GDPR, including the data protection principles and the requirements of lawfulness. With regards to lawfulness, a controlle r may be able to rely on the same legal basis for the process of anonymisation and for the preceding processing operations, if those processing operations form part of a set of operations that are undertaken for the same scientific research purposes 235 . 157. Where the scientific research purposes cannot be fulfilled using anonymised data, for example because controllers aim to analyse developments related to an individual over time, requiring the need for an identifier, or where anonymisation is not achievable , the personal data should instead be pseudonymised 236 . 158. Pseudonymisation 237 is a technical and organisational measure that allows controllers and processors to reduce the risks to data subjects and meet their data protection obligations, for example under Articles 25, 32 and 89 of the GDPR. If a controller processes personal data for scientific research purposes and applies pseudonymisation, then the legal basis for the processing of the personal data extends to all processing operations neede d to apply the pseudonymising transformation 238 . 159. The processing of personal data for scientific research purposes that can be used to directly identify a person should only be done where it has been deemed strictly necessary and proportionate in order to achieve the purposes of the scientific research. Thus, the controller should always opt for using anonymised data or pseudonymised personal data if the purpose of the scientific research does not require the use of personal data that can be use d to directly identify data subjects. 160. Consideration of which format of data is necessary and justifiable to process for scientific research purposes should take place when a controller draws up a plan for the processing of personal data, for example when a database is set up or when a research plan is drafted. The assessment should be undertaken as part of a risk analysis or, where relevant, a DPIA. 161. To ensure the proper effectiveness of anonymisation or pseudonymisation, controllers must use state - of - the - art anonymisation or pseudonymisation methods, taking into account the most current assessment of effectiveness, risks of re - identification, threats to security, etc. The EDPB’s guidelines on pseudonymisation provide further guidance on how to assess effectiveness 239 . There should also be an ongoing process of verification that the measures implemented to ensure anonymisation or pseudonymisation are effective over the course of 235 Case C - 77/21, para. 34. 236 Recital 156 GDPR. 237 Article 4(5) GDPR: “[…] the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separ ately and is subject to technic al and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person .” 238 Guidelines on pseudonymisation, para. 23 . 239 Guidelines on pseudonymisation, section 3.1; See also: ENISA, Pseudonymisation techniques and best practices - Recommendations on shaping technology according to data protection and privacy provisions (November 2019); See also ENISA, Deploying pseudonymis ation techniques – The case of the Health Sector (March 2022). 63 | Adopted - version for public consultation a research project, or as long as the data is otherwise retained, in particular if data sets are combined, which may increase the risk for re - identification. 162. Processing operations for scientific research purposes may entail processing of personal data in different formats. For example, if the research activities of a controller receiving data from another controller do not require processing of personal data th at can be used to directly or indirectly identify data subjects, the personal data must be anonymised before transmission. At the same time, the controller providing the anonymised data may itself retain the personal data in a pseudonymised or directly ide ntifiable form if there are purposes that justify such processing, such as reproducibility of research results or review of research data. 163. Legal or contractual obligations that prohibit the re - identification of individuals can, as organisational measures, complement technical anonymisation or pseudonymisation, in particular when data sets are shared between research partners or other recipien ts. Contractual obligations should also facilitate requests from data subjects exercising their rights in relation to pseudonymised personal data 240 . Therefore, contractual obligations should ensure that – following a request from a data subject that exercises his or her rights – the controller that pseudonymised the personal data can provide the information that is necessary to re - identify a data sub ject to controllers or processors that process the pseudonymised data for scientific research purposes. 241 Alternatively, contractual obligations could ensure that the original controller enables the practical exercise of data subjects’ rights. 164. Finally, data subjects should be informed about the extent to which their personal data is processed for research purposes in a form that permits identification and, if personal data is made available to other recipients, to whom. In particular, data subje cts should not be given the impression that their personal data will be anonymised if the data in fact will be processed in a pseudonymised form and the data subjects will still be identifiable, albeit indirectly. Moreover, data subjects should – prior to the processing – be informed that it will not be possible to retrieve their personal data from an aggregated dataset or as part of the research results after the anonymisation of the personal data. Hence, after anonymisation, data subjects will not receive any further individual information on the processing of their data, such as for instance results of clinical examinations, as it will no longer constitute personal data. This is without prejudice to the possibility for data subjects to receive general and aggregated information on the development of research projects or their results. 8.4 Safeguards when processing genetic or biometric data 165. Genetic data is personal data retrieved from analysis of biological samples of human origin that is related to the inherited or acquired genetic characteristics of an individual, such as a complete genome sequence or certain genetic markers that are unique to an individual 242 . Genetic data profiles are considered to be personal data by default and can only be 240 Provided that the recipient has the means reasonably likely to be used to identify the data subject. See further: Judgment of 4 September 2025, C - 413/23 P , EDPS v. SRB, EU:C:2025:645, para. 82. 241 Guidelines on pseudonymisation, p. 78 - 79. 242 Article 4(13) GDPR: “ personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysi s of a biological sample from the natural person in question .” 64 | Adopted - version for public consultation considered anonymous in exceptional circumstances, following a thorough analysis that takes the specific genetic configuration, and how common it is in the population, into account 243 . 166. Biometric data 244 is, similarly to genetic data, unique to individuals 245 and can – inter alia and depending on the type of data – reveal family relationships. 167. Particular caution must be exercised in any research project where genetic or biometric data are processed. This is due to the specific nature and risks with such processing operations, not only for data subjects that participate in scientific research, but also other data subjects who are related to the research participant. For example, genetic data can be used to obtain information about health predispositions, health risks and inherited diseases, as well as consanguineal kinship. The fact that genetic data cannot be chan ged by data subjects, but remains with them for the rest of their lives and beyond increases the risks. Such risks may also be present when processing biometric data, depending on the type of data concerned (e.g. fingerprints). 168. Appropriate safeguards that may be particularly important when processing genetic or biometric data include, but are not limited to, pseudonymisation, ethical approval, particularly restrictive purpose limitations, federated storage with access through sec ure processing environments, as well as rigid and role - based access controls. 169. Genetic research on isolated population groups should be accompanied by information campaigns directed towards the community involved. Such information campaigns should, in addition to the mandatory information pursuant to Articles 12 - 14 GDPR, describe the nature and methods of the research, the objectives pursued and the expected risks or benefits for the population groups involved. Any risks of discrimination or stigmatisation of members of the population group involved, as well as risks of unexpected fin dings, should be clearly and transparently communicated and mitigated 246 . 8.5 Determination of other types of appropriate safeguards 170. As Article 89(1) of the GDPR covers a wide variety of processing operations that are motivated by scientific research purposes using different methods and technology, it is necessary to adopt different types of safeguards for different types of processing operations. This is due to the different risks posed by the nature of research or research methods used. Accordingly, when processing personal data for scientific research purposes, it may be necessary to adopt other types of safeguards beyond anonymisatio n or pseudonymisation. Examples of such safeguards are: 243 A29 WP, Opinion 05/2014, p. 10. 244 Article 4(14) GDPR: “ personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, suc h as facial images or dactyloscopic data .” 245 Judgment of the Court of 17 October 2013, Michael Schwarz v Stadt Bochum , C - 291/12, EU:C:2013:670, para. 27. 246 Cf. Recitals 39 and 75 GDPR. 65 | Adopted - version for public consultation • Governance structures for oversight of the processing of personal data, such as internal or external review boards or other oversight committees, including representation by data subjects, when applicable; • Enhanced transparency, beyond the requirements of Articles 12 - 14 GDPR, towards data subjects about the use of their personal data, e.g. by providing information via an online platform, through which participants can be informed about ongoing and future res earch projects, their nature and methods, as well as provision of information on the outcome of research projects that have used personal data 247 ; • Consent, if not relied upon as a legal basis, as a safeguard 248 ; • Strict purpose - limitation, for example contractually limiting any further processing of personal data by a receiving controller; • An unconditional right to object to the processing of personal data; • Providing guarantees to data subjects, e.g. contractually or by unilateral commitments, that the research results will not be used to directly or indirectly influence or affect the research participants 249 ; • Adherence to ethical rules in the relevant field of science, including ethical approval, when applicable, or advice or oversight by ethics committees or boards; • Procedures for review of personal data that is continuously stored for scientific research purposes in order to determine the necessity of continued storage and in which format it is appropriate to store the personal data (i.e. whether it remains necessary to store the personal data in a pseudonymised or directly identifiable format); • Privacy enhancing technologies (PETs), such as homomorphic encryption or use of synthetic data; • Adherence to relevant standards or professional conduct in the relevant field of science; • Setting up a secure processing environment 250 or an access point through which researchers can gain access to research data without any need for local storage; • Rules and measures when providing personal data to other researchers, including contractual arrangements to prevent unauthorised transmissions to third parties, or use of federated databases; 247 See further in section 5.1 . 248 See further in section 4.1.3 . It should be noted that if a controller commits to consent as a safeguard, then it needs to adhere to the consent provided by the data subject, even if the legal basis is not consent. 249 This safeguard is without prejudice to research in the medical field, where the research results may influence the healthcare of data subjects. See, to that end: Recital 159 of the GDPR. 250 For an example in this regard, see: Article 73 as well as recital 77 EHDS and Articles 2(20), 5(3) - (4) DGA. 66 | Adopted - version for public consultation • Managing pseudonymisation and creating barriers between contact data or other identifiers of research participants and research data, for example through internal organisational firewalls or by entrusting pseudonymisation to a trusted third party; • Complementary measures to prevent re - identification of data subjects, such as statutory, administrative or contractual penalties for unauthorised attempts of re - identification; • Qualification requirements for researchers, as well as proper training in data protection for persons authorised to process the research data; • Measures to protect personal data, such as anonymisation of personal data, when publishing or disseminating research results; and • Confidentiality obligations for researchers and other staff members with access to the personal data (e.g. IT staff). 171. Codes of conduct 251 a nd certification 252 can be useful tools that provide more concrete guidance on how to identify risks and adopt mitigating measures, tailored to the specifics of a particular field or type of scientific research and the application of the specific provisions for scientific re search in the GDPR. Accordingly, controllers or processors may adopt particular safeguards, and measures to manage them, when adhering to a relevant code of conduct or in the process of certification. For the European Data Protection Board The Chair Anu Talus 251 Article 40 GDPR. 252 Article 42 GDPR.