DATA PROTECTION | EDPB adopts Guidelines on scientific research

On 15 April 2026, the European Data Protection Board (EDPB) adopted Guidelines 1/2026 on processing of personal data for scientific research (the Guidelines), providing extensive clarification on the application of the GDPR to research activities.

The Guidelines confirm that only “genuinely scientific” activities may benefit from the GDPR regime applicable to scientific research and identify six key criteria to assess whether processing qualifies as scientific research (a) methodical and systematic approach, (b) adherence to ethical standards, (c) verifiability and transparency, (d) autonomy and independence, (e) research objectives, and (f) the ability to contribute to or apply existing scientific knowledge. Where such criteria are not fully met, controllers must be able to demonstrate why the activities should nonetheless qualify as scientific research under the GDPR.

The EDPB further clarifies that controllers may rely on broad consent where research purposes are not fully identifiable at the time of data collection, provided that additional safeguards and ethical standards are implemented. Controllers may also rely on dynamic consent for specific research projects once their purposes become identifiable or combine both approaches. With regard to data subjects’ rights in the research context, the Guidelines provide that the rights to erasure and objection may be restricted where their exercise would render impossible or seriously impair scientific research activities, subject to the safeguards under Article 89 GDPR, including anonymisation, pseudonymisation, secure processing environments and ethical oversight mechanisms.

The draft Guidelines are currently open to public consultation until 25 June 2026 and, once finalised, are expected to become a key interpretative benchmark for the application and enforcement of the GDPR in the scientific research context.

Newsletter n. 118 – May 2026