Europe’s healthcare systems produce enormous quantities of data every day: electronic health records, laboratory results, disease registries, and genomic sequences. Used well, this data could help researchers understand diseases better and bring new treatments to patients sooner. In practice, much of their research value is lost. The data sits in incompatible systems, national rules on reuse differ, and a researcher who wants to combine records from three countries may face three separate procedures with three different outcomes. The European Health Data Space (EHDS) Regulation is designed to address this.
The Regulation balances the right of access against the interests of other parties involved. On the one hand, patients and other individuals whose data are used keep the protection of their fundamental rights, including data protection. On the other, businesses that are required to share their data must be able to protect their intellectual property and trade secrets. The European Commission published draft templates of key documents for the application and granting of access.
The EHDS Regulation therefore creates both opportunity and risk. In this Keynote, Thibaut D’hulst unpacks what this means for businesses and what can be done now to prepare for what’s coming.
Changes under the EHDS Regulation
From 2029, a pharmaceutical company running a real-world evidence study will be able to apply for health data held by hospitals, insurers, and registries across the EU. Conversely, data holders will be required to share their own data, such as completed clinical trial data or data from its health apps, with other researchers, including competitors.
The European Commission recently published various implementing acts that will allow organisations to start preparing for the EHDS Regulation, as it will take time. Companies should familiarise themselves with these new rules and the documents that have been made available, consider how it will affect them and join the conversation.
Organisations (or individuals) established in the EU may apply for access to the categories of data listed in Article 51 of the Regulation that are held by “health data holders”.
The process
- First, the applicant files a health data access application with a national health data access body (HDAB). An applicant who needs only anonymised statistics, such as counts or rates, can file a simpler health data request instead.
- Upon receipt of the application, the HDAB assesses the application, including the applicant’s legal basis under the GDPR, and issues or refuses a data permit. It must decide within three months of receiving a complete application, extendable by a further three months.
- The HDAB asks the relevant holders for the data, and they must provide it. A holder that misses the deadline, or withholds data to obstruct its use, faces daily penalty payments and fines. Repeated breaches can lead to its exclusion from using EHDS data itself, while it must still share its own.
- The user works on the data only inside a secure processing environment, a controlled computing space from which only anonymous results may be taken out. The user must then publish its results.
- The HealthData@EU infrastructure connects national contact points, so that a single application can cover data from several Member States.
The data can be requested for “secondary use” – use for purposes other than the care for which they were originally collected. The purpose must be specified in the application and access will be granted only where it is necessary for one of six purposes listed in Article 53 of the Regulation. Three of these, (i) public and occupational health; (ii) policymaking and regulation; (iii) and official statistics, are reserved for public bodies. The other three are open to companies and researchers as well: (iv) education; (v) scientific research that contributes to public health, health technology assessment or the safety and quality of care, medicines or devices (which expressly includes product development and the training and testing of algorithms); and (vi) improving the care of other patients.
Some uses are prohibited outright, including decisions detrimental to individuals, raising insurance premiums, advertising, and developing harmful products.
The process includes safeguards for intellectual property and trade secrets. Holders can flag protected data, and the HDAB can attach protective conditions to the permit or, where the risk cannot be managed, refuse access.
The EHDS provides the legal basis under the GDPR for holders to share data with the HDAB. An applicant that receives pseudonymised data acts as controller for its own processing and must have its own legal basis under the GDPR.
An obligation for data holders
In this process, the user requests the data from the HDAB, which can issue a permit and request the data from the relevant health data holders.
The definition of a health data holder is broad. It covers persons and organisations in the healthcare and care sectors, including reimbursement services. It also covers anyone who develops products or services for these sectors, develops or manufactures wellness applications, or carries out health research, as well as EU institutions, bodies, offices, and agencies. The obligation therefore reaches well beyond hospitals and medical practices to a wide range of health and wellness apps.
However, there are exceptions:
- Data holders that are natural persons or micro-enterprises (fewer than 10 staff and an annual turnover or balance sheet of EUR 2 million or less) are exempt unless national law extends the obligation to them.
- Data holders need only make available the data they control. An app designed so that data stay on the user’s own device, out of the developer’s reach, is therefore not covered. Nor is an organisation that handles data only as a processor (within the meaning of the GDPR) on someone else’s behalf.
- In addition, the EHDS gives patients a right to opt out of having their data used for secondary use purposes.
A researcher can only ask for data they know exists. Article 77 of the Regulation therefore provides for a public dataset catalogue. The catalogue describes the available datasets in a standard format: what each contains, where it comes from, and on what conditions it can be obtained. A potential user can search the catalogue and judge whether a dataset is worth applying for.
To compile the dataset catalogue, each health data holder must send the national HDAB descriptions of its datasets and check at least once a year that the entries in the national catalogue are accurate and up to date.
What comes next?
Access requests can be filed from 26 March 2029 for most categories of data. Some categories, including genetic data and data from clinical trials, follow on 26 March 2031.
The European Commission has now published a draft implementing regulation setting out templates for the health data access application, the data permit, and the health data request.
Prospective users can prepare by identifying the research and AI projects for which EU health data would help, and check how the templates’ publication rules affect what you would disclose about them.
Conversely, data holders should map their datasets against the EHDS categories, prepare to describe them in the required format, and identify data you would need to protect as trade secrets or intellectual property. They should also assess what information they will need to provide for the dataset catalogue.
The public consultation is open for comments until 13 November 2026 on the Commission’s Have your say portal. This is the moment to review them and raise practical concerns.
If you have questions or concerns about the EHDS Regulation, please contact Thibaut D’hulst.
For further information please contact:
This article is for general information purposes only and does not constitute legal or professional advice. It should not be used as a substitute for legal advice relating to your particular circumstances. Please note that the law may have changed since the date of this article.