EDPB adopts research data guidelines citing EHDS as legal derogation

The European Data Protection Board adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes on 15 April 2026, with public consultation open until 25 June 2026. The guidelines explicitly cite EHDS Article 53(1)(e) as a valid Article 9(2) derogation under GDPR for secondary use of health data — the first authoritative EDPB-level position connecting GDPR to the EHDS secondary use framework. National Health Data Access Bodies (HDABs) and Secure Processing Environments designing their access permit procedures have until now been working without a formal EDPB-endorsed legal basis. The 25 June consultation deadline matters: comments shape the version that will guide every Member State's secondary use processing once EHDS applies in March 2029.