The General Data Protection Regulation, Regulation (EU) 2016/679, is the EU's core data protection law. It treats data concerning health as a special category of personal data, which is prohibited from processing unless a specific condition applies, such as explicit consent, the provision of health or social care, or reasons of substantial public interest set out in EU or national law. Organisations processing health data must identify a lawful basis and a special category condition, apply data minimisation and security safeguards, and often carry out a data protection impact assessment. National laws add further conditions for health and research data, so requirements vary across member states. The GDPR underpins other health data initiatives, including the European Health Data Space, which builds sector-specific rules on top of it rather than replacing it.
How does GDPR apply to health data?
Under the GDPR, health data is a special category of personal data subject to stricter conditions for lawful processing.
Is health data special category data under GDPR?
Yes. Data concerning health is a special category under Article 9 of the GDPR, and processing it requires both a lawful basis and a specific special category condition.
HDS Certification Framework v2.1: anticipated changes
Version 2.1 of the health data hosting certification framework, published October 2026, strengthens transparency requirements on third-country data transfers and foreign legislation submission.
ANS - French Digital Health Agency · FranceAEPD analysis of data quality, accuracy and minimisation in processing by AI systems
Leer más
AEPD (Spanish Data Protection Agency) · SpainIberoamerican Network approves reference document on enhanced safeguards required for neurodata processing in non-health settings
The Iberoamerican Network of Data Protection Authorities has approved a reference document establishing enhanced safeguards for processing neurodata outside healthcare contexts.
AEPD (Spanish Data Protection Agency) · SpainM11 Clinical Electronic Structured Harmonised Protocol (CeSHarP); Guidance for Industry
FDA announces final ICH guidance on harmonized digital clinical trial protocol standards, templates, and technical specifications for international regulatory exchange.
US Federal Register - FDA Guidance Notices · United StatesSégur du numérique en santé: regulatory framework for paramedical professionals and midwives published
Official publication of the decree establishing the Ségur du numérique en santé programme for paramedical professionals and midwives, setting the regulatory framework for software interoperability and secure health data exchange.
ANS - French Digital Health Agency · FranceEuropean Health Data Space (EHDS) Regulation: overview
The EHDS is the EU's first sector-specific common data space, establishing a framework for health data access and use across member states.
European Health Data Space · EU-wideEuropean Health Data Space Regulation: entry into force
EHDS Regulation becomes law 20 days after publication in the EU Official Journal.
European Commission · EU-wideUpdating of the information sheet Guidance for Industry on the electronic exchange of ICSRs in E2B(R3) format through B2B gateway
Updated guidance on electronic exchange of individual case safety reports in E2B(R3) format via B2B gateway.
Swissmedic · Switzerland