Short answer
There is no general entitlement to use electronic health data merely because the proposed use concerns health.
For care, authorised health professionals and healthcare providers may access data needed to treat the patient where Union or national law supplies an Article 6 GDPR basis and an Article 9 exception, commonly healthcare under professional secrecy. The patient also has GDPR access rights.
For research, regulation or product development today, the controller needs both a GDPR legal basis and a special-category exception, plus minimisation, security and applicable national rules. Consent is one possible route, not a universal requirement.
The European Health Data Space (EHDS) will add a regulated secondary-use route from 26 March 2029. A natural or legal person may apply to a national health data access body. Access is limited to listed public-interest, regulatory, research, innovation and care-improvement purposes; must be necessary and proportionate; and normally occurs with anonymous or pseudonymised data in a secure processing environment. Advertising, discriminatory decisions and harmful product development are prohibited.
As of 31 July 2026, the GDPR and applicable national or sector law remain operative; the permit regime is not.
Health data receive special protection
The GDPR treats health, genetic and certain biometric data as special categories. The concept is broad: an apparently ordinary transaction can reveal health information.
In Lindenapotheke, C-21/23, the Court held that customer details connected with orders for pharmacy-only medicines were health data even where no prescription was required. It was enough that the data could reveal information about the customer's health through inference.
The concept of “data concerning health” must be interpreted broadly. —
Processing needs two legal layers:
- a basis under Article 6 GDPR, such as legal obligation, public task, legitimate interests or consent; and
- an exception under Article 9(2), such as healthcare, public health, substantial public interest, scientific research or explicit consent.
Meeting Article 9 does not remove the Article 6 requirement, and a data-sharing contract creates no basis by itself. Other GDPR principles and transfer rules still apply.
Access for care
Healthcare providers ordinarily process health data under Article 9(2)(h) for diagnosis, treatment, management of health services or related care, on the basis of Union or Member State law or a contract with a health professional and subject to professional secrecy. The Article 6 basis often derives from a legal duty, public task or the care relationship, depending on national law and the provider.
That does not let every hospital employee open every record. Role, treatment relationship, necessity and national professional rules define access. Vital interests may support emergency access where the patient cannot consent.
Patients have their own rights. Under Articles 12 and 15 GDPR, they can obtain access to personal data and a copy. In FT v DW, C-307/22, the Court held that the first copy must generally be free even where the patient's purpose is not data-protection related. In a doctor-patient relationship, the copy must include parts of the medical record necessary to make the data intelligible, including diagnoses, examination results and treatment assessments.
A controller must provide “free of charge” a first copy of the personal data. —
Research under the GDPR today
Scientific research can use Article 9(2)(j) where Union or Member State law supports proportionate processing with suitable safeguards. Article 89 requires technical and organisational measures, particularly data minimisation and, where feasible, pseudonymisation.
The researcher still needs an Article 6 basis and must define purpose, controller roles, data sources, retention, recipients and security. Clinical-trial, biobank and national health-data rules may add requirements. Ethics approval is not itself a GDPR legal basis.
Explicit consent under Article 9(2)(a) can support some research, but it must be specific, informed, freely given and withdrawable. In dependent relationships or large longitudinal projects it may be unsuitable. Conversely, calling work “research” does not automatically activate Article 9(2)(j); the necessary Union or national legal foundation and safeguards must exist.
Truly anonymous data fall outside the GDPR. Pseudonymised data remain personal data because re-identification remains possible using additional information.
Regulatory and public-health access
Medicines, medical-device, public-health and reimbursement authorities may process health data where a statute gives them a task or legal obligation. Typical combinations are Article 6(1)(c) or (e) with Article 9(2)(g) for substantial public interest, (i) for public health, or another applicable exception. The authority's mandate, not its institutional status alone, determines the permitted scope.
An authority may receive adverse-event reports, clinical evidence or surveillance data where sector law permits. It may not reuse them for unrelated purposes merely because it is a regulator.
Product development is not a blanket exception
A pharmaceutical, device, digital-health or AI developer has no general right to patient records. It needs the same two-layer legal basis and any national authorisation. Describing a project as innovation, or removing names while retaining linkable patient codes, does not legitimise disclosure.
Development may qualify as scientific research where its method and objective genuinely fit and applicable law supplies the Article 9(2)(j) route. Other projects may require explicit consent or another exception. Parties must assign controller and processor roles according to actual decisions and tasks.
What the EHDS will change
Regulation (EU) 2025/327 creates separate systems for primary use in care and secondary use for other permitted purposes. It complements rather than displaces the GDPR.
For primary use, the EHDS will give individuals electronic access and portability rights and will enable identified health professionals to use priority data through health-professional access services. Member State rules will still determine which professional categories can access which data and for which care tasks. The main rights start in phases: patient summaries, electronic prescriptions and dispensations from 26 March 2029; imaging, test results and discharge reports from 26 March 2031.
For secondary use, Chapter IV applies from 26 March 2029. Health data holders will make listed categories available through national access bodies and HealthData@EU, including EHR, administrative, registry, device and clinical-study data.
Commission Implementing Regulation (EU) 2026/771 now governs the establishment and operation of the EHDS Board. It supports implementation and coordination but does not bring the Chapter IV permit regime into operation before 26 March 2029.
“A natural or legal person may submit” a health-data access application. —
Permitted purposes include public and occupational health, official statistics, health regulation, health education, scientific research benefiting end users, development and innovation, algorithm training and evaluation, and improvement of care using other persons' data. Public-health, regulatory and official-statistics routes are reserved to public bodies and EU institutions, including contractors acting for them. Research and qualifying development are not limited to public applicants.
The EHDS permit does not mean open download
The health data access body must check that the purpose is permitted, the requested data are necessary, adequate and proportionate, and the applicant has suitable qualifications, safeguards and an Article 6 GDPR basis. Anonymous data must be used where they can achieve the purpose. Pseudonymised data are available only where the applicant justifies why anonymous data are insufficient.
Personal data are accessed in a secure processing environment. The health data user becomes controller for its permitted processing; the access body operates the environment as processor for that activity. Personal electronic health data cannot simply be extracted. Only reviewed non-personal outputs may leave the environment, and re-identification is prohibited.
The EHDS also prohibits using permitted data for:
- decisions that significantly harm the person or group represented in the data;
- employment, insurance, credit or discriminatory decisions;
- advertising or marketing;
- developing harmful or addictive products, including tobacco, weapons and illicit drugs; or
- activities conflicting with national ethical rules.
Commercial product development is therefore possible only when it fits a permitted health-related research or innovation purpose and passes the permit test. “Commercial” is not automatically disqualifying, but advertising and harmful uses are.
Consent, opt-out and individual control
An EHDS permit does not depend on consent from everyone in the dataset. From 2029, individuals will have a reversible secondary-use opt-out. Member States may legislate a narrow exception for specified public-health tasks or important public-interest research where alternatives are unavailable and safeguards apply.
For care, EHDS rights will allow individuals to restrict access to parts of their record. Necessary emergency access to restricted data may be allowed to protect vital interests and must be logged. Member States may also create a stronger primary-use opt-out under national law. These choices differ from withdrawing GDPR consent: the applicable mechanism depends on the legal route used.
A practical access test
Before granting or requesting access, identify:
- whether the data are personal, pseudonymised or truly anonymous;
- whether the purpose is care, research, regulation, product development or another use;
- the Article 6 basis and separate Article 9 exception;
- the Union and national law supporting that exception;
- who determines purposes and means, and therefore acts as controller;
- the minimum people, fields, records and retention period required;
- whether the EHDS provision relied upon actually applies yet;
- whether an opt-out, objection, restriction or transparency duty applies; and
- how access, output review, incidents and deletion will be logged and proved.
Conclusion
Electronic health data are not reserved exclusively to clinicians, nor opened generally to researchers and industry. Access follows purpose-specific authority: care under healthcare and secrecy rules; research under a supported scientific-research route; regulators within statutory mandates; and product developers only where a valid research, consent or future EHDS permit pathway applies.
The EHDS will standardise and widen controlled secondary access, but its operative Chapter IV regime begins on 26 March 2029. Until then, organisations must not treat a future EHDS eligibility category as a present legal basis under the GDPR.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.