The processing of personal data for scientific research purposes has given rise to a number of important and sometimes difficult questions from controllers, processors and supervisory authorities. In order to make GDPR compliance easier for researchers and ensure the protection of individuals’ fundamental rights, the European Data Protection Board (EDPB) has recently released a Guidelines on processing of personal data for scientific research purposes.  

These guidelines will help to drive beneficial scientific breakthroughs for society, as most of them are based on processing individuals’ personal data, and to manage properly the risks to fundamental rights and freedoms associated with the use of artificial intelligence.  

In particular, the following aspects are dealt: 

• Clarification on how to determine whether the processing of personal data is carried out for scientific purposes; 

• The conditions for further processing and long-term storage of personal data for scientific purposes; 

• The meaning and use of “broad consent” and “dynamic consent”; 

• The processing of personal data in the public interest or in the exercise of official authority; 

• Clarification of the legal basis of legitimate interest for scientific research and the related processing of personal data; 

• The possibility for the Union or Member State to authorise the processing of special categories of personal data, e.g. genetic, biometric, or health data, under specific conditions or limitations; 

• The appropriate measures to ensure transparency when processing personal data for scientific research over a long period; 

• The rights of individuals to erasure and to object when their personal data are processed for scientific purposes; 

• The necessity to assess and document how responsibility is allocated among the entities involved in the process of personal data; 

• The adoption of appropriate safeguards for the rights and freedoms of data subjects when their personal data are processed for scientific research purposes. 

The European Data Protection Board has opened these guidelines for comments until 25 June 2026.  

To learn more about and provide your input follow this link: Guidelines 1/2026 on processing of personal data for scientific research purposes | European Data Protection Board