The EDPB’s draft Guidelines 1/2026 are probably the most important piece of EU-level GDPR guidance for research since the Board’s 2019 Clinical Trials Opinion. For Life Sciences stakeholders, they are not just a restatement of familiar principles. They bring more structure to how we approach Clinical Trials, secondary research, biobanks, research platforms and data re-use more broadly.
The draft Guidelines provide more structured guidance than previous EDPB materials, while at the same time raising several points that may benefit from further clarification during the consultation process. The message is quite clear: the rules are not new, but the level of expectation is becoming more precise.
📚 Notion of Scientific Research
The first major contribution is conceptual. The EDPB tries to define what counts as “Scientific Research” by introducing six “key-indicative factors”: a methodical and systematic approach, adherence to ethical standards, verifiability and transparency, autonomy and independence, objectives contributing to society’s general knowledge and wellbeing, and the potential to contribute to existing knowledge or apply it in novel ways. If all are met, research can be presumed to be Scientific Research under the GDPR. For Life Sciences, this is both useful and sensitive. Useful, because it gives sponsors, sites and research infrastructures a more concrete test than the usual abstract reference to Recital 159 GDPR. Sensitive, because several of those factors can become contested in commercial drug development. Clinical Trials fit this model quite well.
The draft text explicitly cites a pharmaceutical company’s Clinical Trial as an example of data processing for Scientific Research purposes and links this outcome to Good Clinical Practice (GCP), ethical review, qualified researchers and expected publications. But outside classical trials, the picture is less straightforward. Translational research, proprietary model development, platform optimization or real-world evidence generation may not always map neatly onto “verifiability”, “publication” or “independence” if those criteria are read too rigidly. The Guidelines acknowledge that trade secrets and intellectual property may limit openness, which reflects earlier EDPB thinking, but this will remain an important point in practice.
🏛️ Legal basis
The second major contribution is on legal bases. The draft is more open than some practitioners may have expected. It confirms that the main Article 6 bases relevant to research are consent, legal obligation, public interest and legitimate interests. More importantly for industry, it states that private entities may rely on Article 6(1)(e) where the relevant legal act covers their activities, and that Scientific Research may constitute a legitimate interest whether carried out on a commercial or non-profit basis. At the same time, the draft keeps the distinction set out in Opinion 3/2019, namely that compatibility does not replace lawfulness.
The GDPR already provides that further processing for Scientific Research is presumed compatible with the initial purpose. The Guidelines confirm this but also stress that controllers must still verify whether they have a valid legal basis for that further use. They also note that the same legal basis may sometimes continue to apply, but not always, especially where the original basis was consent or legal obligation. For Clinical Research, that is a crucial clarification. It means that research compatibility is not a free pass for secondary use. Sponsors will still need to carry out a rigorous mapping of the legal basis as they move from the trial conduct phase to the data retention, ancillary studies and secondary analysis phases, particularly where data in the special category is concerned.
⚖️ Ethical consent vs consent for processing Personal Data
Third, the draft makes a clear distinction between ethical/research participation consent and GDPR consent. It says this expressly and in strong terms: consent to participate in Scientific Research under ethical or legal requirements must be distinguished from consent as a GDPR legal basis. That is highly valuable in Life Sciences, where Informed Consent Forms are still treated as if they were solely concerned with Article 6 and Article 9. The EDPB also accepts broad consent and dynamic consent, but only with meaningful safeguards and real specificity around a research area. It is clear that “research in general” will not be enough.
🔍 Transparency requirements for controllers
Fourth, the transparency chapter is more demanding than many controllers may realize. The draft expects long-term research controllers to think in terms of continuing transparency, updates, contact points, websites, dashboards, and proactive communication where processing evolves over time. It even warns controllers not to deliberately delete participants’ contact details, in order to prevent them from failing to inform participants if they anticipate that the data will be used for research purposes later. In terms of biobanks, long-term cohorts, the use of post-Clinical Trial Data and integrated research platforms, this is a highly significant operational message. The standard of compliance is shifting from one-off reporting towards transparency throughout the entire lifecycle.
🚫 Conservative use of derogations
Fifth, the draft takes a narrow view of derogations from data subject rights. While the GDPR has always allowed derogations for Scientific Research under Article 89, the Guidelines emphasize that such derogations must be interpreted restrictively and applied on a case-by-case basis. The practical implication is that limitations to rights such as erasure or objection cannot be assumed as a general feature of research processing. Instead, they must be justified, documented and defensible in each situation. For Life Sciences, this creates a tangible challenge, as large-scale and long-term datasets must accommodate individual rights even where scientific validity and regulatory compliance depend on maintaining data integrity.
👥 Data Protection roles and responsibilities
Sixth, the Guidelines also revisit the question of roles and responsibilities, which is always sensitive in Clinical Trials and research collaborations. The EDPB states that active participation in defining a research protocol will normally point toward controller status, and it reiterates that a Clinical Trial sponsor remains a controller, or joint controller, even if it mainly processes pseudonymized data while the site handles direct identifiers. It also emphasizes joint controllership where multiple actors jointly shape protocol purposes and essential means. This may have substantial consequences for sponsor-site-CRO relations, academic-industry partnerships, registry access models and public-private research consortia. Parties that have historically relied on simplified contractual labels may need to revisit them.
🛡️ Recommended safeguards to be applied in research
Finally, the safeguards chapter is one of the strongest parts of the draft. By placing Article 89 at the heart of the framework, the EDPB clearly states that anonymization should be used wherever possible; where anonymization is not feasible, pseudonymization should be used; and that direct identifiers should only be used where strictly necessary and proportionate. It also lists a rich catalogue of additional safeguards: independent oversight, secure processing environments, PETs, confidentiality measures, publication controls, federated access and governance structures. For Life Sciences, this is a practical roadmap.
Overall, the draft is valuable because it treats research as a serious GDPR category rather than a vague policy aspiration. It gives the sector tools. But it also raises the compliance bar. In Life Sciences, the final version should be refined so that it does not unintentionally narrow the meaning of Scientific Research for commercial and translational settings, overstate transparency duties in ways that are operationally unrealistic, or expand joint controllership by reference to protocol participation too automatically.
This is exactly the kind of text that merits close engagement from sponsors, hospitals, universities, CROs, biobanks and patient-facing research infrastructures. The consultation is not a formality. It is the moment to shape how “Scientific Research” will be read under the GDPR for years to come.
Author: Ibrahim Yalvac
