Code of practice for scientific research under the GDPR

Table Of Contents

Overview #

In 2015, BBMRI-ERIC recognised the need for a sector-specific interpretation of the GDPR for health research. Therefore, it started coordinating an extensive collaboration among legal experts, researchers, research infrastructures, patient organisations, industry representatives, and policymakers.  

The purpose was to draft a Code of Conduct for Health Research to provide practical guidance on the application of the General Data Protection Regulation (GDPR) to health research. It had to be developed under Articles 40 and 41 of the GDPR. 

After many years of meetings, discussions, review, the Code ended up in being renamed “Code of practice for scientific research under the GDPR” (2026) and has reached its final stages.   

The Code aims to help researchers, research organisations, and other stakeholders interpret and implement data protection requirements consistently within the scientific research context.  

Importantly, the Code does not create new legal obligations. Instead, it translates the GDPR into practical, harmonised guidance tailored to the specific needs of the health research community. It explains how existing GDPR requirements can be applied in everyday research practice while respecting both scientific needs and the rights of research participants.  

Purpose  #

The Code of Conduct has four overarching objectives: 

  1. Consistent application of the GDPR 

The GDPR contains several provisions relating to scientific research that are intentionally flexible and therefore interpreted differently across Member States. The Code seeks to promote greater consistency and harmonisation in applying GDPR requirements to health research throughout Europe.  

  1. Practical guidance for researchers 

The Code translates legal requirements into operational guidance that is understandable by researchers and research organisations, rather than only legal experts. It provides practical examples and recommendations to facilitate GDPR compliance during the research lifecycle.  

  1. Protect participants while enabling research 

A central objective is to ensure that personal data are processed responsibly, safeguarding participants’ rights, privacy, and trust while enabling high-quality scientific research and innovation. The Code promotes transparency, accountability, and appropriate safeguards without creating unnecessary barriers to research.  

  1. Developed through stakeholder engagement 

The Code has been created through a collaborative process involving stakeholders from across the European health research ecosystem, including research infrastructures, academic institutions, patient organisations, industry, legal experts, ethics specialists, and policymakers. This participatory approach aims to ensure that the guidance is both legally robust and practically applicable.  

Key principles  #

The Code is based on several fundamental principles: 

  • It does not replace or amend the GDPR.  
  • It translates GDPR requirements into practical implementation guidance for health research.  
  • It promotes harmonised interpretation across the European Research Area.  
  • It encourages trust, transparency, and responsible data governance.  
  • It seeks to balance individual rights with the societal value of health research.  

Scope  #

The Code addresses the processing of personal data for scientific research. Among the topics covered are: 

  • fair and transparent processing;  
  • anonymous versus personal data;  
  • legal bases for processing;  
  • consent requirements;  
  • information provided to participants;  
  • exercise of data subject rights;  
  • controller and processor responsibilities;  
  • technical and organisational measures;  
  • security measures;  
  • appropriate safeguards;  
  • anonymisation and pseudonymisation; 
  • international data transfers. 

History  #

The initiative originated in 2015, when BBMRI-ERIC recognised the need for a sector-specific interpretation of the GDPR for health research. 

Key milestones include: 

  • 2015 – Launch of the initiative by BBMRI-ERIC.  
  • 2017 – Engagement with policymakers, European research infrastructures, industry representatives, and patient organisations to assess feasibility and define priorities.  
  • 2018 – Formal drafting of the Code began.  
  • 2020 – Work paused as many contributors focused on the COVID-19 pandemic; however, experiences from the pandemic informed subsequent development.  
  • 2021 onwards – Drafting resumed with regular expert meetings and wider stakeholder consultation.  
  • 2024 – More than 160 individuals representing approximately 90 organisations had expressed support for or interest in the initiative, demonstrating broad engagement across the European health research community.  
  • 2026 – draft finished, consultations with a Board of Experts mainly composed of representatives of National Nodes 

Benefits for the Health Research Community  #

The Code is intended to: 

  • improve legal certainty for researchers;  
  • facilitate responsible sharing and reuse of health data;  
  • strengthen public trust in health research;  
  • support harmonisation across European countries;  
  • reduce unnecessary administrative burden;  
  • demonstrate GDPR compliance through recognised good practice;  
  • foster responsible innovation while protecting participants’ rights.  

Relevant EU sources  #

External resources #

  1. Deontological Rules 
  1. Other codes of conduct (under art. 40 and 41 GDPR, or relevant for scientific research and secondary use of data) 

BBMRI-ERIC resources  #

Relevant literature  #

  • Staunton, C., Slokenberga, S. & Mascalzoni, D. The GDPR and the research exemption: considerations on the necessary safeguards for research biobanks. Eur J Hum Genet 27, 1159–1167 (2019). https://doi.org/10.1038/s41431-019-0386-5  
  • Slokenberga, S., Reichel, J., & Tzortzatou, O. (Eds.). (2021). GDPR and biobanking: Individual rights, public interest and research regulation across Europe. Springer. doi.org  
  • Voigt, P. and Von dem Bussche, A. (2017) The EU General Data Protection Regulation (GDPR): A Practical Guide. 1st Edition, Springer International Publishing, Cham. 
    https://doi.org/10.1007/978-3-319-57959-7 
data, ELSI
Updated on 25 August, 2026