How does GDPR apply to health data?

The General Data Protection Regulation, Regulation (EU) 2016/679, is the EU's core data protection law. It treats data concerning health as a special category of personal data, which is prohibited from processing unless a specific condition applies, such as explicit consent, the provision of health or social care, or reasons of substantial public interest set out in EU or national law. Organisations processing health data must identify a lawful basis and a special category condition, apply data minimisation and security safeguards, and often carry out a data protection impact assessment. National laws add further conditions for health and research data, so requirements vary across member states. The GDPR underpins other health data initiatives, including the European Health Data Space, which builds sector-specific rules on top of it rather than replacing it.