Data protection

Table Of Contents

Overview #

Data protection is a fundamental component of biobank governance, ensuring that the collection, storage, processing, sharing and reuse of personal data associated with biological samples respect the rights and freedoms of research participants. Modern biobanks increasingly integrate biological specimens with extensive health-related information, including demographic, clinical, genomic, imaging, environmental, and lifestyle data. These rich datasets are essential for biomedical research, precision medicine, and the development of innovative diagnostics and therapies but also raise significant privacy and security concerns.

The processing of personal data in biobanking is governed in the European Union primarily by the General Data Protection Regulation (GDPR), which recognises scientific research as an important public interest while establishing safeguards for the protection of individuals. Biobanks must therefore balance two complementary objectives: facilitating responsible data sharing to advance scientific knowledge and ensuring that personal data are processed lawfully, fairly, transparently, and securely.

Given the longitudinal nature of biobank research, data may be retained and reused for future studies that were not fully specified at the time of collection. This requires robust governance mechanisms, including appropriate consent procedures, data minimisation, pseudonymisation, controlled access, and ongoing oversight by ethics committees and data protection authorities. Data protection should therefore be regarded not only as a legal obligation but also as an essential element for maintaining public trust and ensuring the long-term sustainability of biobanking infrastructures.

Key ethical, legal and societal issues #

Respect for privacy and confidentiality #

Biobanks process highly sensitive information, including genetic, genomic, and health data. Protecting participants’ privacy is essential to preserve confidentiality, prevent unauthorised disclosure, and maintain trust in biomedical research. Appropriate technical and organisational safeguards should be implemented throughout the entire data lifecycle.

Lawful processing and scientific research #

The GDPR provides a legal framework allowing the processing of personal data for scientific research purposes while requiring compliance with key data protection principles. Biobanks must identify an appropriate legal basis for processing, ensure transparency towards participants, and implement safeguards proportionate to the risks associated with research activities.

Informed consent and secondary use #

Biobank data are frequently reused in future research projects that cannot always be specified at the time of collection. This raises questions regarding the scope of participants’ consent, the compatibility of secondary uses, and the role of broad or dynamic consent models. Ethical governance requires that secondary use remains consistent with participants’ expectations and applicable legal requirements.

Pseudonymisation, anonymisation and re-identification risks #

Most biobanks rely on pseudonymisation rather than complete anonymisation, as maintaining a link between samples and participants is often necessary for longitudinal research or clinically relevant follow-up. However, advances in genomics, artificial intelligence, and data linkage increase the possibility of re-identifying individuals, particularly when multiple datasets are combined. Continuous assessment of re-identification risks is therefore essential.

Data sharing and international transfers #

Scientific progress increasingly depends on sharing data across institutions, countries, and international research infrastructures. Cross-border transfers of personal data require compliance with Chapter V of the GDPR and appropriate safeguards to ensure an equivalent level of protection. Data Transfer Agreements and controlled-access mechanisms play an important role in supporting secure and lawful collaboration.

Data governance and accountability #

Effective governance requires clear policies regarding data access, retention, security, data quality, and responsibilities among biobanks, researchers, and collaborating institutions. Accountability mechanisms, including Data Protection Impact Assessments (DPIAs), records of processing activities, and oversight by Data Protection Officers (DPOs), contribute to ensuring compliance and responsible stewardship of participants’ data.

Data subject rights #

Participants retain several rights under the GDPR, including the rights to information, access, rectification, restriction of processing, and, where applicable, erasure and objection. While certain derogations may apply for scientific research, biobanks should ensure that participants are informed about their rights and that any limitations are justified, proportionate, and established by law.

Public trust #

The success of biobanking depends on public confidence that personal data will be handled responsibly. Transparent governance, effective communication, meaningful participant engagement, and robust data protection practices contribute to maintaining the trust which is necessary for research participation.

Legal and ethical international and EU sources #

Charter of Fundamental Rights of the European Union

  • Article 7: Respect for private and family life.
  • Article 8: Protection of personal data.
  • Article 21: Non-discrimination.
  • Article 35: Health protection.

General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679

The GDPR provides the principal legal framework governing the processing of personal data in biobanking. Particularly relevant provisions include:

  • Article 5: Principles relating to processing of personal data.
  • Article 6: Lawfulness of processing.
  • Article 9: Processing of special categories of personal data, including health and genetic data.
  • Article 89: Safeguards and derogations relating to scientific research.
  • Chapter V: International transfers of personal data.
  • Articles 25 and 32: Data protection by design, by default, and security of processing.

Regulation (EU) 536/2014 on clinical trials

Where biobanks are associated with clinical trials, this Regulation establishes additional requirements regarding participant protection, informed consent, transparency, and data management.

European Health Data Space (EHDS)

The EHDS establishes a harmonised framework for the secure primary and secondary use of electronic health data across the European Union. It is expected to significantly facilitate health research and interoperability while strengthening governance and safeguards for personal health data.

Data Governance Act – Regulation (EU) 2022/868

The Data Governance Act promotes trustworthy mechanisms for data sharing and reuse, supporting the availability of data for scientific research while preserving individuals’ rights.

Artificial Intelligence Act – Regulation (EU) 2024/1689

Where biobank data are used to develop or validate AI systems, the AI Act introduces requirements relating to transparency, risk management, data governance, human oversight, and fundamental rights protection.

European Data Protection Board, guidelines 1/2026 on processing of personal data for scientific research purposes

The Guidelines focus on the notion of scientific research and provide indications to researchers as to how to lawfully process personal data when doing research.

FAIR guiding principles for scientific data management and stewardship

These Guidelines aim to improve the Findability, Accessibility, Interoperability, and Reuse of digital assets.

BBMRI-ERIC resources and publications #

  • BBMRI-ERIC Position Paper on GDPR, 2015
  • BBMRI-ERIC: FAQs on the GDPR, 2016
  • BBMRI.at: Legal Q&A: What are my donor’s rights? Are my data safe? How is handling with data regulated?
  • Mascalzoni D, Bentzen HB, Budin-Ljøsne I, Bygrave LA, Bell J, Dove ES, Fuchsberger C, Hveem K, Mayrhofer MT, Meraviglia V, O’Brien DR, Pattaro C, Pramstaller PP, Rakic V, Rossini A, Shabani M, Svantesson DJB, Tomasi M, Ursin L, Wjst M, Kaye J. Are Requirements to Deposit Data in Research Repositories Compatible With the European Union’s General Data Protection Regulation? Ann Intern Med. 2019 Mar 5;170(5):332-334. doi: 10.7326/M18-2854. Epub 2019 Feb 12. PMID: 30776795.
  • Bernier Alexander, Molnár-Gábor Fruzsina, Knoppers Bartha M., Borry Pascal, Cesar Priscilla M. D. G., Devriendt Thijs, Goisauf Melanie, Murtagh Madeleine, Nicolás Jiménez Pilar, Recuero Mikel, Rial-Sebbag Emmanuelle, Shabani Mahsa, Wilson Rebecca C., Zaccagnini Davide, Maxwell Lauren, Reconciling the biomedical data commons and the GDPR: three lessons from the EUCAN ELSI collaboratory. Eur J Hum Genet (2023). Open access
  • Marelli L, Colussi I, Schlünder I, Bahr A, Huys I, Krekora-Zając D, Kuráň J, Lalova-Spinks T, Mascalzoni D, Matei M, Nicolas P, Southerington T, Two-faced Janus? Consent to participate in research and consent to data processing in the EHDS era: a comparative analysis of requirements and standards in eight European countries, Journal of Law and the Biosciences, Volume 13, Issue 1, January-June 2026, https://doi.org/10.1093/jlb/lsag016
  • Molnár-Gábor F, Sellner J, Pagil S, Slokenberga S, Tzortzatou-Nanopoulou O, Nyström K.. Harmonization after the GDPR? Divergences in the rules for genetic and health data sharing in four member states and ways to overcome them by EU measures: Insights from Germany, Greece, Latvia and Sweden. Semin Cancer Biol. 2022. https://doi.org/10.1016/j.semcancer.2021.12.001
  • Goisauf M, Martin G, Bentzen HB, Budin-Ljøsne I, Ursin L, Durnová A, Leitsalu L, Smith K, Casati S, Lavitrano M, Mascalzoni D, Boeckhout M, Mayrhofer MT.. Data in question: A survey of European biobank professionals on ethical, legal and societal challenges of biobank research. PLoS One. 2019. https://doi.org/10.1371/journal.pone.0221496
  • Goisauf M, Martin G, Bentzen HB, Budin-Ljøsne I, Ursin L, Durnová A, Leitsalu L, Smith K, Casati S, Lavitrano M, Mascalzoni D, Boeckhout M, Mayrhofer MT. Correction: Data in question: A survey of European biobank professionals on ethical, legal and societal challenges of biobank research. PLoS One. 2019 Dec 2;14(12):e0226149. doi: 10.1371/journal.pone.0226149. Erratum for: PLoS One. 2019 Sep 18;14(9):e0221496. doi: 10.1371/journal.pone.0221496. PMID: 31790510; PMCID: PMC6886846.
  • Holub P, Kohlmayer F, Prasser F, Mayrhofer MT, Schlünder I, Martin GM, Casati S, Koumakis L, Wutte A, Kozera Ł, Strapagiel D, Anton G, Zanetti G, Sezerman OU, Mendy M, Valík D, Lavitrano M, Dagher G, Zatloukal K, van Ommen GB, Litton JE.. Enhancing Reuse of Data and Biological Material in Medical Research: From FAIR to FAIR-Health. Biopreserv Biobank. 2018. https://doi.org/10.1089/bio.2017.0110
  • Kesisoglou I, Cosgrove S, Derycke P, Bogaert P, Jacobsen A, Roos M, Niemeyer A, Martinez Garcia A, Thorogood A, Holub P, Schluender I,  Capella-Gutierrez S, Gonzalez Garcia J, Alvarez Romero C, D’Altri T,  Curwin A,  Portell Silva L, López Cuesta L. Glossary of commonly used terms in the field of health data research – developed by the EU project HealthyCloud. 2022. Zenodo. https://doi.org/10.5281/zenodo.6787119
  • Statement on the concerns about draft text of EHDS, 2024 
  • Statement on a potential opt-out mechanism for the EHDS, 2023 
  • Statement by BBMRI-ERIC on the realisation of the EHDS for biobanking from the viewpoint of patient advocates and patient representatives, 2023 
  • Response by BBMRI-ERIC to European Health Data Space Questionnaire, 2021 
  • Statement by BBMRI-ERIC on “A European Health Data Space”, 2021 
  • BBMRI-ERIC joint comments to the Article 29 Working Party Guidelines on Consent under Regulation 2016/679 (wp259) and Transparency under Regulation 2016/679 (wp260), 2018 
  • Avraam D, Wilson RC, Aguirre Chan N, Banerjee S, Bishop TRP, Butters O, Cadman T, Cederkvist L, Duijts L, Escribà Montagut X, Garner H, Gonçalves G, González JR, Haakma S, Hartlev M, Hasenauer J, Huth M, Hyde E, Jaddoe VWV, Marcon Y, Mayrhofer MT, Molnar-Gabor F, Morgan AS, Murtagh M, Nestor M, Nybo Andersen AM, Parker S, Pinot de Moira A, Schwarz F, Strandberg-Larsen K, Swertz MA, Welten M, Wheater S, Burton P.. DataSHIELD: mitigating disclosure risk in a multi-site federated analysis platform. Bioinform Adv. 2025. https://doi.org/10.1093/bioadv/vbaf046 
  • Colussi I, Majcen K. Data Management Plan EOSC4CANCER D 7.2, 2025. https://doi.org/10.5281/zenodo.10067318 
  • Rujano MA, Boiten JW, Ohmann C, Canham S, Contrino S, David R, Ewbank J, Filippone C, Connellan C, Custers I, van Nuland R, Mayrhofer MT, Holub P, Álvarez EG, Bacry E, Hughes N, Freeberg MA, Schaffhauser B, Wagener H, Sánchez-Pla A, Bertolini G, Panagiotopoulou M.. Sharing sensitive data in life sciences: an overview of centralized and federated approaches. Brief Bioinform. 2024. https://doi.org/10.1093/bib/bbae262 
  • Marelli L, Stevens M, Sharon T, Van Hoyweghen I, Boeckhout M, Colussi I, Degelsegger-Márquez A, El-Sayed S, Hoeyer K, van Kessel R, Zając DK, Matei M, Roda S, Prainsack B, Schlünder I, Shabani M, Southerington T.. The European health data space: Too big to succeed?. Health Policy. 2023. https://doi.org/10.1016/j.healthpol.2023.104861 
  • Holub P, Müller H, Bíl T, Pireddu L, Plass M, Prasser F, Schlünder I, Zatloukal K, Nenutil R, Brázdil T.. Privacy risks of whole-slide image sharing in digital pathology. Nat Commun. 2023. https://doi.org/10.1038/s41467-023-37991-y 
  • David, R., Rybina, A., Burel, J. et al. “Be sustainable”: EOSC‐Life recommendations for implementation of FAIR principles in life science data handling. EMBO J 42, EMBJ2023115008 (2023). https://doi.org/10.15252/embj.2023115008. 
  • David R, Ohmann C, Boiten JW, Abadía MC, Bietrix F, Canham S, Chiusano ML, Dastrù W, Laroquette A, Longo D, Mayrhofer MT, Panagiotopoulou M, Richard AS, Goryanin S, Verde PE.. An iterative and interdisciplinary categorisation process towards FAIRer digital resources for sensitive life-sciences data. Sci Rep. 2022. https://doi.org/10.1038/s41598-022-25278-z 
  • Ohmann C, David R, Cano Abadia M, Bietrix F, Boiten JW, Canham S, Chiusano ML, Dastrù W, Laroquette A, Longo D, Mayrhofer MT, Panagiotopoulou M, Richard A, Verde PE. Pilot Study on the Intercalibration of a Categorisation System for FAIRer Digital Objects Related to Sensitive Data in the Life Sciences. Data Intelligence Volume 4, Issue 2: 196 – 211 (2022). https://doi.org/10.1162/dint_a_00126 
  • Boiten JW, Ohmann C, Ayodeji A, Caham S, Cano Abadia M, Chassang G, Chiusano ML, David R, Fratelli M, Gribbom,  Holub P, Ludwig R, Mayrhofer MT, Matei M, Merchant A, Panagiotopoulou M, PiredduL, Sanchez Pla A, Schlünder I, Tsamis G, Wagener H. EOSC-LIFE WP4 TOOLBOX: Toolbox for sharing of sensitive data — a concept description. 2021. https://arxiv.org/pdf/2207.14296 
  • Sariyar M, Schlünder I.. Challenges and Legal Gaps of Genetic Profiling in the Era of Big Data. Front Big Data. 2019. https://doi.org/10.3389/fdata.2019.00040 
  • Goisauf M, Akyüz K, Martin GM, Moving back to the future of big data-driven research: reflecting on the social in genomics. Humanit Soc Sci Commun 7, 55 (2020). https://www.nature.com/articles/s41599-020-00544-5 
  • Vaillancourt M, Frenzel M, Colussi I, García Álvarez E,  Akyüz K, Oldoni E, Liaskos N, Demotes J. 2025. The EP PerMed – Guidelines for Data Reusability. https://www.eppermed.eu/wp-content/uploads/EPPerMed_Guidelines-for-data-reusability_v2-1.pdf 
  • Mayrhofer MT, Goisauf M, Akyüz K, Avraam D, Wilson B, Swertz M, Burton P, Murtagh M (2023). Deliverable D7.2: ELSI Governance Model and Data Management Plan for Federated Cohort Analysis. https://doi.org/10.5281/zenodo.8120778 
  • Schlünder I, Mayrhofer MT, Ene E (2023). Elements of Secure Processing Environments (Workshop Report) V1.0. Zenodo. https://doi.org/10.5281/zenodo.8341642 
  • Garcia Alvarez E, Ohmann C, Saunders G, Wagener H, Colussi I, Boiten JW, Panagiotopoulou M, Cano Abadía M, David R, Schluender I, Holub P, Mayrhofer MT,  EOSC-Life Requirements for hosting/ distributing and access control for sensitive data. 2022, Zenodo. https://doi.org/10.5281/zenodo.7037444 
  • Goisauf M, Feriol L, Rial-Sebbag E. (2022). CINECA First recommendations for implementation in IT Framework (Incl. a Data Management Plan) D7.3 (Version 1). Zenodo. https://doi.org/10.5281/zenodo.7267158 
  • Panagiotopoulou, M., Yaïche, S., Michon, A., Ohmann, C., Demotes, J., Matei, M., Canham, S., Hjelle, S. M., Klusek, P., Batuca, J., Schmid, C., Buoncervello, M., Toschi, E., Minghetti, L., Chiusano, M. L., Vives Vilatersana, A., Calvo I Orteu, M., Szabó, Z., Součková, L., Mayrhofer MT, Sonderlichová, S. (2022). EOSC-Life Public database inventorying the national health databases and registries and describing their access procedures for reuse for research purposes. Zenodo. https://doi.org/10.5281/zenodo.7148861 

Webinars #

External resources #

Relevant literature #

  • Staunton, C., Slokenberga, S. & Mascalzoni, D. The GDPR and the research exemption: considerations on the necessary safeguards for research biobanks. Eur J Hum Genet 27, 1159–1167 (2019). https://doi.org/10.1038/s41431-019-0386-5
  • Slokenberga, S., Reichel, J., & Tzortzatou, O. (Eds.). (2021). GDPR and biobanking: Individual rights, public interest and research regulation across Europe. Springer. doi.org
  • Voigt, P. and Von dem Bussche, A. (2017) The EU General Data Protection Regulation (GDPR): A Practical Guide. 1st Edition, Springer International Publishing, Cham. https://doi.org/10.1007/978-3-319-57959-7
  • Schulte In Den Baumen T, Paci D, Ibarreta Ruiz D. Data Protection in Biobanks ¿ A European challenge for the long-term sustainability of Biobanking. Revista de Derecho y Genoma Humano (31); 2009. p. 13-25. JRC58536
  • Kuner, C., Bygrave, L. A., & Docksey, C. (Eds.). The EU General Data Protection Regulation (GDPR): A Commentary: https://www.law.kuleuven.be/citip/en/docs/books/oup-gdpr-commentary-2nd-edition-compilation-march.pdf
  • Colcelli, V., Cippitani, R., Brochhausen-Delius, C., & Arnold, R. (Eds.). (2023). GDPR requirements for biobanking activities across Europe. Springer International Publishing. https://doi.org/10.1007/978-3-031-42944-6
  • Shabani M, Borry P. Rules for processing genetic data for research purposes in view of the new EU General Data Protection Regulation. Eur J Hum Genet. 2018 Feb;26(2):149-156. doi: 10.1038/s41431-017-0045-7. Epub 2017 Nov 29. PMID: 29187736; PMCID: PMC5838983.

data protection, ehds, ELSI, gdpr
Updated on 21 July, 2026