In April 2026, the European Data Protection Board (EDPB) adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes (the EDPB Guidelines). The EDPB Guidelines aim to bring greater clarity and practical guidance on how the GDPR should be applied when processing personal data for the purposes of scientific research. 

In parallel, the UK’s Data Use and Access Act 2025 (DUAA) received Royal Assent on 19 June 2025, introducing more favourable amendments to the UK GDPR's scientific research provisions, including broadening the statutory definition of 'scientific research' and allowing broad consent in certain circumstances. The Information Commission’s Office (ICO) published its draft guidance on research-related processing in February 2026.

This article summarises the key updates under both the EU and UK regimes relating to processing personal data for scientific research purposes and provides takeaways for organisations to consider.

Background

It is now well-known that the GDPR treats scientific research as a favoured purpose and gives it a set of specific concessions, including derogations from certain data subject rights. Article 5(1)(b), GDPR considers secondary processing for scientific research purposes as compatible with the initial purpose, provided that this processing is compliant with the safeguards and derogations set out in Article 89, GDPR (the compatibility presumption). 

This is particularly attractive to institutions such as universities, hospitals, and research bodies because it removes the need to obtain fresh consent or identify a new lawful basis each time previously collected personal data is repurposed for research, significantly reducing the administrative and operational burden associated with large-scale or longitudinal studies.

Prior to the publication of the EDPB Guidelines, there was considerable uncertainty as to what constitutes 'scientific research' for the purposes of the GDPR, and consequently, which processing activities could benefit from the more favourable provisions afforded to such research.

Whilst the EDPB Guidelines are directed at EU member state organisations and controllers subject to the GDPR, UK organisations operating under the UK GDPR must also contend with a parallel and, in certain respects, distinct domestic framework, details of which are covered later in this article. 

Organisations engaged in UK-specific scientific research may consider the EDPB Guidelines as useful interpretive guidance whilst ensuring their practices are primarily calibrated to the amended UK framework.

What do the EDPB Guidelines seek to achieve?

The EDPB Guidelines aim to clarify what qualifies as 'scientific research' (as set out below), and provides clarity on a range of related issues, including: 

• the secondary use of personal data; 
• broad and dynamic consent;
• storage limitation and retention; 
• transparency obligations; 
• data subject rights; and 
• the allocation of roles and responsibilities in multi-party research.

‘The Magnificent Six’…what qualifies as ‘scientific research’? 

The EDPB Guidelines set out six key-indicative factors for determining whether processing of personal data is motivated by scientific research purposes: 

• a methodical and systematic approach; 
• adherence to ethical standards;
• verifiability and transparency; 
• autonomy and independence; 
• objectives aimed at contributing to societal knowledge and wellbeing; and 
• the potential to contribute to existing scientific knowledge or apply it in novel ways.

Research activities satisfying all six factors can be presumed to constitute ‘scientific research’ under the GDPR. Failure to meet all six factors does not automatically disqualify the research, but where organisations seek to consider their research activities as ‘scientific research’, they should document a clear justification of why such activities still qualify – the more criteria are met, the more likely this is to be the case.

Lawful bases for processing

The EDPB Guidelines recognise that the precise purposes of future research may not be known at the time consent is given to process personal data, and it distinguishes between two mechanisms – broad and dynamic consent. 

'Broad consent' permits a data controller to obtain consent covering a defined area of scientific research (for example, medical research in the field of oncology), without specifying individual research projects at the outset. The research area must be defined with sufficient clarity and additional safeguards and controls, including application of additional safeguards (such as pseudonymisation, access controls and ethical and/or governance oversight) and allowing the data subject to withdraw consent at any time. 

‘Dynamic consent’ is an alternative to broad consent, where a data controller contacts individuals for consent to participate in specific, identifiable research projects once the purposes of the project are known.

A combination of both approaches is also permissible under the EDPB Guidelines.

Beyond consent, the EDPB Guidelines confirm that scientific research can constitute a legitimate interest under Article 6(1)(f), GDPR, regardless of whether the research is undertaken on a non-profit or commercial basis, and that significant weight may be attributed to the research purpose when applying the balancing test.

Public interest under Article 6(1)(e), GDPR is also recognised as a legal basis, and is not limited to public entities provided the relevant legal act covers their activities.

Special categories of personal data

The EDPB Guidelines also address the processing of special categories of personal data including health, genetic and biometric data. Data controllers may rely on explicit consent (including broad or dynamic consent) or on derogations laid down in Union or Member State law, provided that suitable and specific safeguards are in place. 

The EDPB Guidelines confirm that it may be possible to process special categories of personal data that have been manifestly made public by the data subject, for example on social media, pursuant to Article 9(2)(e), GDPR. However, the threshold for relying on this exception is high: the controller must ascertain that the data subject intended, by a clear affirmative action, to make the data accessible to the general public, and must verify the platform settings and context in which the data was posted.[BJ2.1][PJ2.2]

Transparency, data subject rights and safeguards

Where personal data is being processed over extended periods of time, data controllers must maintain transparency throughout. This includes providing updates if the nature of the processing changes and even where the data controller has no direct contact with the data subjects.

The EDPB Guidelines also confirm the rights of data subjects, including the right to erasure of their data and the right to object to processing, whilst noting important limitation provisions on both rights in the research context. These provisions establish a clear attribution of responsibility regarding the handling of personal data.

Lastly, the EDPB Guidelines have reiterated that data controllers must adopt appropriate safeguards including, in line with data minimisation, anonymisation or pseudonymisation of data where possible. 

Interactions with UK regime

The DUAA defines 'scientific research' as “any research that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity”. This is a notably broader formulation than the approach taken in the EDPB Guidelines, aiming to ensure that privately funded and commercially motivated research is not excluded from the research exemption simply by virtue of its funding model or profit motive.

The DUAA also extends the categories of activities that may qualify as 'scientific research' to expressly include research in the public interest.  

UK organisations should note that this broadened statutory definition operates independently of the six-factor test set out in the EDPB Guidelines. Organisations with dual research operations in the EU and the UK should consider the EDPB Guidelines in conjunction with the statutory definition set out in the DUAA and ensure that its operations are compliant with both.

There are three key changes which DUAA brings about in this context:

1. Broad Consent now expressly valid (in certain circumstances)

Additionally, the DUAA amends Article 4, UK GDPR  to broaden consent for scientific research purposes, allowing a broader consent to be valid, provided that: 

• the processing is for an area of scientific research;
• it is not possible at the time of collection to identify fully all future research purposes; 
• the consent process (or mechanism) is consistent with generally recognised ethical standards; and 
• individuals are given the opportunity to consent to only part of the research programme.  

This allows consent to be used for an area of research that may not be in contemplation at the time the consent is taken, subject to the above conditions. In effect, a participant can consent to a broad research programme rather than having to be re-consented every time a new research question emerges.

2. Reuse of research data becomes easier

The DUAA also introduces greater flexibility around the purpose limitation principle. It expands the circumstances in which personal data collected for one purpose can later be used for scientific research without undertaking the full GDPR compatibility assessment that would otherwise be required. The practical effect is that organisations may find it easier to:

• use existing research cohorts for new studies;
• reuse biobank data;
• apply new analytical tools (including AI techniques) to existing datasets; and
• conduct follow-on scientific research without restarting the consent process from scratch.

3. Scientific research is defined more broadly

The Act also introduces a statutory definition of scientific research, confirming that it includes:

• publicly funded and privately funded research;
• commercial and non-commercial research;
• technological development and applied research; and
• certain public-interest public health research.

This wider definition means more organisations can rely on the research-related flexibilities.

What has not changed?

The Act does not eliminate core data protection requirements. Researchers still need:

• a lawful basis under Article 6, UK GDPR;
• an Article 9 condition when processing special-category data such as health data;
• transparency, security and accountability measures; and
• appropriate safeguards for research processing.

The key practical difference

The most significant relaxation is that consent no longer needs to identify every future scientific research purpose with precision. Provided ethical standards are observed and participants are given meaningful choices where possible, broad consent for an area of scientific research is now expressly recognised in legislation.

For organisations running longitudinal studies, biobanks, genomics programmes or AI-assisted medical research, that is probably the most important change introduced by the DUAA.

Conclusion

The publication of the EDPB Guidelines has provided some clarification on the processing of personal data for scientific research purposes in an area where regulatory complexity has made it difficult for organisations to navigate and determine their data controller obligations, data subject rights and streamline operations in compliance with the GDPR. 

A public consultation was open until the end of June 2026, which may result in further clarifications and amendments to the EDPB Guidelines. 

For UK organisations, the DUAA's provisions came into force on a phased basis following Royal Assent in June 2025, with the substantive data protection amendments. Organisations should monitor the ICO's website for updated codes of practice and research-specific guidance incorporating the changes incorporated by the DUAA – including any further guidance on the research, archive and statistics (RAS) provisions following a recent consultation which closed on 5 May 2026. 

Organisations processing personal data for scientific research in the EU and UK should consider the impact of the EDPB Guidelines and DUAA on their research activities, particularly whether they reduce the administrative and legal burden on carrying out scientific research.

Key takeaways

• Where an organisation seeks to rely on data processing for scientific research purposes, it should conduct a formal review of each research activity against the six factors, document the outcome, and where not all factors are met, prepare a robust justification demonstrating why the activity should nonetheless qualify. (Organisations operating solely in the UK should do so with reference to the DUAA's statutory definition as the primary legal benchmark, but may also wish to use the EDPB's six-factor test as a supplementary, indicative risk-based practical tool as part of their assessment).

• UK-based organisations should perform audits on existing datasets to identify any cohorts, biobanks or datasets that could now be repurposed for follow-on studies or new analytical approaches under the relaxed purpose limitation rules. 

• Organisations should review and update consent forms and fair processing notices to reflect the EDPB Guidelines (or, for UK-based organisations, the DUAA updates on the available consent mechanisms), including considering whether broad or dynamic consent may be used to allow wider use of personal data (where appropriate).

• Organisations should review and implement appropriate additional safeguards where it relies on scientific research legitimate interests as a means to process personal data, including independent oversight mechanisms.

• Privacy notices should be updated to reflect research-specific processing, including the legal basis relied upon, the research being conducted, relevant safeguards in place and how the data subjects can exercise their data protection rights.  

• UK organisations must still ensure that all scientific research processing retains a valid lawful basis, appropriate Article 9 conditions for special-category data, and adequate safeguards - the DUAA relaxes certain rules but does not remove these obligations.

If you have any questions or would like to discuss the implications of the EDPB Guidelines or DUAA on your organisation, please do not hesitate to get in touch with our data, privacy and cybersecurity team.