LIFE SCIENCES | EDPB’s Guidelines No. 1/2026 on the processing of personal data for scientific research purposes

On 25 June 2026, the public consultation period launched by the European Data Protection Board (EDPB) on the “Guidelines 1/2026 on the processing of personal data for scientific research purposes” (the Guidelines) ended. Numerous stakeholders submitted their feedback, including Italian associations such as Confindustria and the Associazione Farmaceutici Industria (AFI).

The Guidelines clarify key aspects of the application of the GDPR to scientific research, addressing issues raised by controllers, processors, and supervisory authorities. By way of example, they explain the proper classification of scientific research under the GDPR and provide guidance on the consent for the processing of personal data for scientific research.

The EDPB identifies six factors[1]  to assess whether data processing is carried out for scientific research purposes, considering also the nature, scope, and context of the processing. Where all these six factors are met, data controllers may presume that the activity constitutes scientific research within the meaning of the GDPR.

The Guidelines also define the concepts of broad consent and dynamic consent. Specifically, the EDPB states that data controllers may obtain data subjects’ consent to collect and process personal data for a certain area of scientific research where the specific purposes of the research are not yet fully known (so-called broad consent). However, broad consent may only be relied upon where stricter safeguards are adopted, such as: (i) compliance with the ethical standards applicable to scientific research, and (ii) the implementation of additional safeguards to compensate for the lack of a specific research purpose (e.g.: transparency measures and oversight by research ethics committees).

The EDPB also establishes that data controllers may seek consent from data subjects for specific research projects (or parts thereof) separately, as soon as the purposes of such projects become known (so-called “dynamic consent”). Dynamic consent and broad consent can be combined.

Although the EDPB Guidelines are not legally binding, they play a fundamental role in interpreting the GDPR and guide the activities of the supervisory authorities. It will be interesting to see whether the Italian Data Protection Authority (Garante) will implement the recommendations and clarifications provided by the Guidelines to increase an effective balance between the protection of personal data and the need to conduct scientific research.

Notes: 

[1] The six key-indicative factors are the following: (i) Methodical and systemic approach, (ii) Adherence to ethical standards, (iii) Verifiability and transparency, (iv) autonomy and independence, (v) Objectives of the research, (vi) Potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways.  

Newsletter n. 121 – August/September 2026