Scientific Research and the GDPR: EDPB Issues Long-Awaited Guidelines | Data Matters Privacy Blog

"The EDPB stops short of a formal definition but introduces six indicative factors to assess whether an activity constitutes scientific research: a methodical and systematic approach; adherence to ethical standards; verifiability and transparency; autonomy and independence; clearly defined objectives; contribution to existing scientific knowledge or application of this knowledge in novel ways. Where all six factors are met, the activity will generally qualify as scientific research. Where they are not, organisations must justify their position, taking into account the nature, scope, and context of the processing."

"While the GDPR presumes that further processing for scientific research is compatible with the original purpose, the EDPB makes clear this is not a blanket exemption. The presumption applies only where the further processing genuinely qualifies as scientific research (as clarified by the Guidelines and set out above). Organisations should expect regulators to scrutinise whether activities genuinely constitute scientific research, rather than accepting labels at face value."

"For organisations in the life sciences sector, the Guidelines address long-standing areas of uncertainty - particularly around secondary use of data, broad consent, and transparency obligations - while signaling a clear shift toward stricter expectations on governance, purpose limitation, and accountability. The EDPB's objective is clear: to promote a more consistent and workable framework across the EU, while maintaining robust safeguards."

The Guidelines provide the most comprehensive regulatory statement on applying GDPR to scientific research. They address uncertainty in life sciences around secondary use of data, broad consent, and transparency obligations. The Guidelines do not give a formal definition of scientific research, but propose six indicative factors: methodical and systematic approach, adherence to ethical standards, verifiability and transparency, autonomy and independence, clearly defined objectives, and contribution to existing scientific knowledge or novel applications. When all six factors are met, the activity generally qualifies as scientific research. If not, organisations must justify their position based on the nature, scope, and context. The GDPR compatibility presumption for further processing applies only when the further processing genuinely qualifies as scientific research.

Read at Data Matters Privacy Blog